Blame - docs/dyn/cloudresourcemanager_v1.folders.html - platform/external/python/google-api-python-client

2017-03-24 15:06:46 -0700

[diff] [blame]

335

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

336

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

337

# configuration is acceptable.

338

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

339

# Suppose you have a `Constraint`

340

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

341

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

342

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

343

# - If the `Policy` at this resource has enforced set to `false`, serial

344

# port connection attempts will be allowed.

345

# - If the `Policy` at this resource has enforced set to `true`, serial

346

# port connection attempts will be refused.

347

# - If the `Policy` at this resource is `RestoreDefault`, serial port

348

# connection attempts will be allowed.

349

# - If no `Policy` is set at this resource or anywhere higher in the

350

# resource hierarchy, serial port connection attempts will be allowed.

351

# - If no `Policy` is set at this resource, but one exists higher in the

352

# resource hierarchy, the behavior is as if the`Policy` were set at

353

# this resource.

354

#

355

# The following examples demonstrate the different possible layerings:

356

#

357

# Example 1 (nearest `Constraint` wins):

358

# `organizations/foo` has a `Policy` with:

359

# {enforced: false}

360

# `projects/bar` has no `Policy` set.

361

# The constraint at `projects/bar` and `organizations/foo` will not be

362

# enforced.

363

#

364

# Example 2 (enforcement gets replaced):

365

# `organizations/foo` has a `Policy` with:

366

# {enforced: false}

367

# `projects/bar` has a `Policy` with:

368

# {enforced: true}

369

# The constraint at `organizations/foo` is not enforced.

370

# The constraint at `projects/bar` is enforced.

371

#

372

# Example 3 (RestoreDefault):

373

# `organizations/foo` has a `Policy` with:

374

# {enforced: true}

375

# `projects/bar` has a `Policy` with:

376

# {RestoreDefault: {}}

377

# The constraint at `organizations/foo` is enforced.

378

# The constraint at `projects/bar` is not enforced, because

379

# `constraint_default` for the `Constraint` is `ALLOW`.

380

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

385

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

386

<pre>Gets a `Policy` on a resource.

387

388

If no `Policy` is set on the resource, a `Policy` is returned with default

389

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

390

`etag` value can be used with `SetOrgPolicy()` to create or update a

391

`Policy` during read-modify-write.

392

393

Args:

394

resource: string, Name of the resource the `Policy` is set on. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

396

The object takes the form of:

397

398

{ # The request sent to the GetOrgPolicy method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

399

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

400

}

401

402

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

409

410

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

411

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

412

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

413

# server, not specified by the caller, and represents the last time a call to

414

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

415

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

416

"version": 42, # Version of the `Policy`. Default version is 0;

417

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

418

# `Constraint` type.

419

# `constraint_default` enforcement behavior of the specific `Constraint` at

420

# this resource.

421

#

422

# Suppose that `constraint_default` is set to `ALLOW` for the

423

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

424

# foo.com sets a `Policy` at their Organization resource node that restricts

425

# the allowed service activations to deny all service activations. They

426

# could then set a `Policy` with the `policy_type` `restore_default` on

427

# several experimental projects, restoring the `constraint_default`

428

# enforcement of the `Constraint` for only those projects, allowing those

429

# projects to have all services activated.

430

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

431

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

432

# resource.

433

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

434

# `ListPolicy` can define specific values and subtrees of Cloud Resource

435

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

436

# are allowed or denied by setting the `allowed_values` and `denied_values`

437

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

438

# The `under:` prefix is used to denote resource subtree values.

439

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

440

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

441

# same as values with no prefix.

442

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

443

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

444

# - "folders/<folder-id>", e.g. "folders/1234"

445

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

446

# The `supports_under` field of the associated `Constraint` defines whether

447

# ancestry prefixes can be used. You can set `allowed_values` and

448

# `denied_values` in the same `Policy` if `all_values` is

449

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

450

# values. If `all_values` is set to either `ALLOW` or `DENY`,

451

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

452

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

453

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

454

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

455

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

456

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

457

# that matches the value specified in this `Policy`. If `suggested_value`

458

# is not set, it will inherit the value specified higher in the hierarchy,

459

# unless `inherit_from_parent` is `false`.

460

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

461

#

462

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

463

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

464

# set to `true`, then the values from the effective `Policy` of the parent

465

# resource are inherited, meaning the values set in this `Policy` are

466

# added to the values inherited up the hierarchy.

467

#

468

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

469

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

470

# simple and understandable. However, it is possible to set a `Policy` with

471

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

472

# In this case, the values that are allowed must be in `allowed_values` and

473

# not present in `denied_values`.

474

#

475

# For example, suppose you have a `Constraint`

476

# `constraints/serviceuser.services`, which has a `constraint_type` of

477

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

478

# Suppose that at the Organization level, a `Policy` is applied that

479

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

480

# `Policy` is applied to a project below the Organization that has

481

# `inherit_from_parent` set to `false` and field all_values set to DENY,

482

# then an attempt to activate any API will be denied.

483

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

484

# The following examples demonstrate different possible layerings for

485

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

486

#

487

# Example 1 (no inherited values):

488

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

489

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

490

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

491

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

492

# The accepted values at `organizations/foo` are `E1`, `E2`.

493

# The accepted values at `projects/bar` are `E3`, and `E4`.

494

#

495

# Example 2 (inherited values):

496

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

497

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

498

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

499

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

500

# The accepted values at `organizations/foo` are `E1`, `E2`.

501

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

502

#

503

# Example 3 (inheriting both allowed and denied values):

504

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

505

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

506

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

507

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

508

# The accepted values at `organizations/foo` are `E1`, `E2`.

509

# The value accepted at `projects/bar` is `E2`.

510

#

511

# Example 4 (RestoreDefault):

512

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

513

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

514

# `projects/bar` has a `Policy` with values:

515

# {RestoreDefault: {}}

516

# The accepted values at `organizations/foo` are `E1`, `E2`.

517

# The accepted values at `projects/bar` are either all or none depending on

518

# the value of `constraint_default` (if `ALLOW`, all; if

519

# `DENY`, none).

520

#

521

# Example 5 (no policy inherits parent policy):

522

# `organizations/foo` has no `Policy` set.

523

# `projects/bar` has no `Policy` set.

524

# The accepted values at both levels are either all or none depending on

525

# the value of `constraint_default` (if `ALLOW`, all; if

526

# `DENY`, none).

527

#

528

# Example 6 (ListConstraint allowing all):

529

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

530

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

531

# `projects/bar` has a `Policy` with:

532

# {all: ALLOW}

533

# The accepted values at `organizations/foo` are `E1`, E2`.

534

# Any value is accepted at `projects/bar`.

535

#

536

# Example 7 (ListConstraint allowing none):

537

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

538

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

539

# `projects/bar` has a `Policy` with:

540

# {all: DENY}

541

# The accepted values at `organizations/foo` are `E1`, E2`.

542

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

543

#

544

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

545

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

546

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

547

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

548

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

549

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

550

# {allowed_values: "under:projects/P3"}

551

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

552

# The accepted values at `organizations/foo` are `organizations/O1`,

553

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

554

# `projects/P3`.

555

# The accepted values at `projects/bar` are `organizations/O1`,

556

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

557

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

558

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

559

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

560

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

561

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

562

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

563

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

564

# concurrency control.

565

#

566

# When the `Policy` is returned from either a `GetPolicy` or a

567

# `ListOrgPolicy` request, this `etag` indicates the version of the current

568

# `Policy` to use when executing a read-modify-write loop.

569

#

570

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

571

# `etag` will be unset.

572

#

573

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

574

# that was returned from a `GetOrgPolicy` request as part of a

575

# read-modify-write loop for concurrency control. Not setting the `etag`in a

576

# `SetOrgPolicy` request will result in an unconditional write of the

577

# `Policy`.

578

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

579

# `constraints/serviceuser.services`.

580

#

581

# Immutable after creation.

582

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

583

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

584

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

585

# configuration is acceptable.

586

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

587

# Suppose you have a `Constraint`

588

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

589

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

590

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

591

# - If the `Policy` at this resource has enforced set to `false`, serial

592

# port connection attempts will be allowed.

593

# - If the `Policy` at this resource has enforced set to `true`, serial

594

# port connection attempts will be refused.

595

# - If the `Policy` at this resource is `RestoreDefault`, serial port

596

# connection attempts will be allowed.

597

# - If no `Policy` is set at this resource or anywhere higher in the

598

# resource hierarchy, serial port connection attempts will be allowed.

599

# - If no `Policy` is set at this resource, but one exists higher in the

600

# resource hierarchy, the behavior is as if the`Policy` were set at

601

# this resource.

602

#

603

# The following examples demonstrate the different possible layerings:

604

#

605

# Example 1 (nearest `Constraint` wins):

606

# `organizations/foo` has a `Policy` with:

607

# {enforced: false}

608

# `projects/bar` has no `Policy` set.

609

# The constraint at `projects/bar` and `organizations/foo` will not be

610

# enforced.

611

#

612

# Example 2 (enforcement gets replaced):

613

# `organizations/foo` has a `Policy` with:

614

# {enforced: false}

615

# `projects/bar` has a `Policy` with:

616

# {enforced: true}

617

# The constraint at `organizations/foo` is not enforced.

618

# The constraint at `projects/bar` is enforced.

619

#

620

# Example 3 (RestoreDefault):

621

# `organizations/foo` has a `Policy` with:

622

# {enforced: true}

623

# `projects/bar` has a `Policy` with:

624

# {RestoreDefault: {}}

625

# The constraint at `organizations/foo` is enforced.

626

# The constraint at `projects/bar` is not enforced, because

627

# `constraint_default` for the `Constraint` is `ALLOW`.

628

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

633

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

634

<pre>Lists `Constraints` that could be applied on the specified resource.

635

636

Args:

637

resource: string, Name of the resource to list `Constraints` for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

638

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

639

The object takes the form of:

640

641

{ # The request sent to the [ListAvailableOrgPolicyConstraints]

642

# google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

643

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

644

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

645

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

646

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

657

658

{ # The response returned from the ListAvailableOrgPolicyConstraints method.

659

# Returns all `Constraints` that could be set at this level of the hierarchy

660

# (contrast with the response from `ListPolicies`, which returns all policies

661

# which are set).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

662

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

663

"constraints": [ # The collection of constraints that are settable on the request resource.

664

{ # A `Constraint` describes a way in which a resource's configuration can be

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

665

# restricted. For example, it controls which cloud services can be activated

666

# across an organization, or whether a Compute Engine instance can have

667

# serial port connections established. `Constraints` can be configured by the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

668

# organization's policy adminstrator to fit the needs of the organzation by

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

669

# setting Policies for `Constraints` at different locations in the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

670

# organization's resource hierarchy. Policies are inherited down the resource

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

671

# hierarchy from higher levels, but can also be overridden. For details about

672

# the inheritance rules please read about

673

# Policies.

674

#

675

# `Constraints` have a default behavior determined by the `constraint_default`

676

# field, which is the enforcement behavior that is used in the absence of a

677

# `Policy` being defined or inherited for the resource in question.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

678

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

679

# configured by an Organization's policy administrator with a `Policy`.

680

"supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy

681

# can be used in `Policy.allowed_values` and `Policy.denied_values`. For

682

# example, `"under:folders/123"` would match any resource under the

683

# 'folders/123' folder.

684

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

685

# that matches the value specified in this `Constraint`.

686

},

687

"version": 42, # Version of the `Constraint`. Default version is 0;

688

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

689

# where it is enforced.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

690

#

691

# Mutable.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

692

"displayName": "A String", # The human readable name.

693

#

694

# Mutable.

695

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

696

#

697

# For example a constraint `constraints/compute.disableSerialPortAccess`.

698

# If it is enforced on a VM instance, serial port connections will not be

699

# opened to that instance.

700

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

701

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absense of 'Policy'.

702

"name": "A String", # Immutable value, required to globally be unique. For example,

703

# `constraints/serviceuser.services`

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

711

<pre>Retrieves the next page of results.

712

713

Args:

714

previous_request: The request for the previous page. (required)

715

previous_response: The response from the request for the previous page. (required)

716

717

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

718

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

719

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

724

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

725

<pre>Lists all the `Policies` set for a particular resource.

726

727

Args:

728

resource: string, Name of the resource to list Policies for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

729

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

730

The object takes the form of:

731

732

{ # The request sent to the ListOrgPolicies method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

733

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

734

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

735

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

736

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

747

748

{ # The response returned from the ListOrgPolicies method. It will be empty

749

# if no `Policies` are set on the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

750

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

751

# `Policies` are set.

752

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

753

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

754

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

755

# server, not specified by the caller, and represents the last time a call to

756

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

757

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

758

"version": 42, # Version of the `Policy`. Default version is 0;

759

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

760

# `Constraint` type.

761

# `constraint_default` enforcement behavior of the specific `Constraint` at

762

# this resource.

763

#

764

# Suppose that `constraint_default` is set to `ALLOW` for the

765

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

766

# foo.com sets a `Policy` at their Organization resource node that restricts

767

# the allowed service activations to deny all service activations. They

768

# could then set a `Policy` with the `policy_type` `restore_default` on

769

# several experimental projects, restoring the `constraint_default`

770

# enforcement of the `Constraint` for only those projects, allowing those

771

# projects to have all services activated.

772

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

773

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

774

# resource.

775

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

776

# `ListPolicy` can define specific values and subtrees of Cloud Resource

777

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

778

# are allowed or denied by setting the `allowed_values` and `denied_values`

779

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

780

# The `under:` prefix is used to denote resource subtree values.

781

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

782

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

783

# same as values with no prefix.

784

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

785

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

786

# - "folders/<folder-id>", e.g. "folders/1234"

787

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

788

# The `supports_under` field of the associated `Constraint` defines whether

789

# ancestry prefixes can be used. You can set `allowed_values` and

790

# `denied_values` in the same `Policy` if `all_values` is

791

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

792

# values. If `all_values` is set to either `ALLOW` or `DENY`,

793

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

794

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

795

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

796

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

797

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

798

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

799

# that matches the value specified in this `Policy`. If `suggested_value`

800

# is not set, it will inherit the value specified higher in the hierarchy,

801

# unless `inherit_from_parent` is `false`.

802

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

803

#

804

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

805

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

806

# set to `true`, then the values from the effective `Policy` of the parent

807

# resource are inherited, meaning the values set in this `Policy` are

808

# added to the values inherited up the hierarchy.

809

#

810

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

811

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

812

# simple and understandable. However, it is possible to set a `Policy` with

813

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

814

# In this case, the values that are allowed must be in `allowed_values` and

815

# not present in `denied_values`.

816

#

817

# For example, suppose you have a `Constraint`

818

# `constraints/serviceuser.services`, which has a `constraint_type` of

819

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

820

# Suppose that at the Organization level, a `Policy` is applied that

821

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

822

# `Policy` is applied to a project below the Organization that has

823

# `inherit_from_parent` set to `false` and field all_values set to DENY,

824

# then an attempt to activate any API will be denied.

825

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

826

# The following examples demonstrate different possible layerings for

827

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

828

#

829

# Example 1 (no inherited values):

830

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

831

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

832

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

833

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

834

# The accepted values at `organizations/foo` are `E1`, `E2`.

835

# The accepted values at `projects/bar` are `E3`, and `E4`.

836

#

837

# Example 2 (inherited values):

838

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

839

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

840

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

841

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

842

# The accepted values at `organizations/foo` are `E1`, `E2`.

843

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

844

#

845

# Example 3 (inheriting both allowed and denied values):

846

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

847

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

848

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

849

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

850

# The accepted values at `organizations/foo` are `E1`, `E2`.

851

# The value accepted at `projects/bar` is `E2`.

852

#

853

# Example 4 (RestoreDefault):

854

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

855

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

856

# `projects/bar` has a `Policy` with values:

857

# {RestoreDefault: {}}

858

# The accepted values at `organizations/foo` are `E1`, `E2`.

859

# The accepted values at `projects/bar` are either all or none depending on

860

# the value of `constraint_default` (if `ALLOW`, all; if

861

# `DENY`, none).

862

#

863

# Example 5 (no policy inherits parent policy):

864

# `organizations/foo` has no `Policy` set.

865

# `projects/bar` has no `Policy` set.

866

# The accepted values at both levels are either all or none depending on

867

# the value of `constraint_default` (if `ALLOW`, all; if

868

# `DENY`, none).

869

#

870

# Example 6 (ListConstraint allowing all):

871

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

872

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

873

# `projects/bar` has a `Policy` with:

874

# {all: ALLOW}

875

# The accepted values at `organizations/foo` are `E1`, E2`.

876

# Any value is accepted at `projects/bar`.

877

#

878

# Example 7 (ListConstraint allowing none):

879

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

880

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

881

# `projects/bar` has a `Policy` with:

882

# {all: DENY}

883

# The accepted values at `organizations/foo` are `E1`, E2`.

884

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

885

#

886

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

887

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

888

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

889

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

890

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

891

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

892

# {allowed_values: "under:projects/P3"}

893

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

894

# The accepted values at `organizations/foo` are `organizations/O1`,

895

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

896

# `projects/P3`.

897

# The accepted values at `projects/bar` are `organizations/O1`,

898

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

899

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

900

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

901

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

902

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

903

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

904

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

905

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

906

# concurrency control.

907

#

908

# When the `Policy` is returned from either a `GetPolicy` or a

909

# `ListOrgPolicy` request, this `etag` indicates the version of the current

910

# `Policy` to use when executing a read-modify-write loop.

911

#

912

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

913

# `etag` will be unset.

914

#

915

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

916

# that was returned from a `GetOrgPolicy` request as part of a

917

# read-modify-write loop for concurrency control. Not setting the `etag`in a

918

# `SetOrgPolicy` request will result in an unconditional write of the

919

# `Policy`.

920

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

921

# `constraints/serviceuser.services`.

922

#

923

# Immutable after creation.

924

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

925

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

926

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

927

# configuration is acceptable.

928

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

929

# Suppose you have a `Constraint`

930

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

931

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

932

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

933

# - If the `Policy` at this resource has enforced set to `false`, serial

934

# port connection attempts will be allowed.

935

# - If the `Policy` at this resource has enforced set to `true`, serial

936

# port connection attempts will be refused.

937

# - If the `Policy` at this resource is `RestoreDefault`, serial port

938

# connection attempts will be allowed.

939

# - If no `Policy` is set at this resource or anywhere higher in the

940

# resource hierarchy, serial port connection attempts will be allowed.

941

# - If no `Policy` is set at this resource, but one exists higher in the

942

# resource hierarchy, the behavior is as if the`Policy` were set at

943

# this resource.

944

#

945

# The following examples demonstrate the different possible layerings:

946

#

947

# Example 1 (nearest `Constraint` wins):

948

# `organizations/foo` has a `Policy` with:

949

# {enforced: false}

950

# `projects/bar` has no `Policy` set.

951

# The constraint at `projects/bar` and `organizations/foo` will not be

952

# enforced.

953

#

954

# Example 2 (enforcement gets replaced):

955

# `organizations/foo` has a `Policy` with:

956

# {enforced: false}

957

# `projects/bar` has a `Policy` with:

958

# {enforced: true}

959

# The constraint at `organizations/foo` is not enforced.

960

# The constraint at `projects/bar` is enforced.

961

#

962

# Example 3 (RestoreDefault):

963

# `organizations/foo` has a `Policy` with:

964

# {enforced: true}

965

# `projects/bar` has a `Policy` with:

966

# {RestoreDefault: {}}

967

# The constraint at `organizations/foo` is enforced.

968

# The constraint at `projects/bar` is not enforced, because

969

# `constraint_default` for the `Constraint` is `ALLOW`.

970

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

971

},

972

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

973

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

974

# the server may at any point start supplying a valid token.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

980

<pre>Retrieves the next page of results.

981

982

Args:

983

previous_request: The request for the previous page. (required)

984

previous_response: The response from the request for the previous page. (required)

985

986

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

987

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

988

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

993

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

994

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

995

that `Constraint` on the resource if one does not exist.

996

997

Not supplying an `etag` on the request `Policy` results in an unconditional

998

write of the `Policy`.

999

1000

Args:

1001

resource: string, Resource name of the resource to attach the `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1002

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1003

The object takes the form of:

1004

1005

{ # The request sent to the SetOrgPolicyRequest method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1006

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1007

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1008

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1009

# server, not specified by the caller, and represents the last time a call to

1010

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1011

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1012

"version": 42, # Version of the `Policy`. Default version is 0;

1013

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1014

# `Constraint` type.

1015

# `constraint_default` enforcement behavior of the specific `Constraint` at

1016

# this resource.

1017

#

1018

# Suppose that `constraint_default` is set to `ALLOW` for the

1019

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1020

# foo.com sets a `Policy` at their Organization resource node that restricts

1021

# the allowed service activations to deny all service activations. They

1022

# could then set a `Policy` with the `policy_type` `restore_default` on

1023

# several experimental projects, restoring the `constraint_default`

1024

# enforcement of the `Constraint` for only those projects, allowing those

1025

# projects to have all services activated.

1026

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1027

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1028

# resource.

1029

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1030

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1031

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1032

# are allowed or denied by setting the `allowed_values` and `denied_values`

1033

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1034

# The `under:` prefix is used to denote resource subtree values.

1035

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1036

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1037

# same as values with no prefix.

1038

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1039

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1040

# - "folders/<folder-id>", e.g. "folders/1234"

1041

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1042

# The `supports_under` field of the associated `Constraint` defines whether

1043

# ancestry prefixes can be used. You can set `allowed_values` and

1044

# `denied_values` in the same `Policy` if `all_values` is

1045

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1046

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1047

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1048

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1049

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1050

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1051

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1052

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1053

# that matches the value specified in this `Policy`. If `suggested_value`

1054

# is not set, it will inherit the value specified higher in the hierarchy,

1055

# unless `inherit_from_parent` is `false`.

1056

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1057

#

1058

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1059

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1060

# set to `true`, then the values from the effective `Policy` of the parent

1061

# resource are inherited, meaning the values set in this `Policy` are

1062

# added to the values inherited up the hierarchy.

1063

#

1064

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1065

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1066

# simple and understandable. However, it is possible to set a `Policy` with

1067

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1068

# In this case, the values that are allowed must be in `allowed_values` and

1069

# not present in `denied_values`.

1070

#

1071

# For example, suppose you have a `Constraint`

1072

# `constraints/serviceuser.services`, which has a `constraint_type` of

1073

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1074

# Suppose that at the Organization level, a `Policy` is applied that

1075

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1076

# `Policy` is applied to a project below the Organization that has

1077

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1078

# then an attempt to activate any API will be denied.

1079

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1080

# The following examples demonstrate different possible layerings for

1081

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1082

#

1083

# Example 1 (no inherited values):

1084

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1085

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1086

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1087

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1088

# The accepted values at `organizations/foo` are `E1`, `E2`.

1089

# The accepted values at `projects/bar` are `E3`, and `E4`.

1090

#

1091

# Example 2 (inherited values):

1092

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1093

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1094

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1095

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1096

# The accepted values at `organizations/foo` are `E1`, `E2`.

1097

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1098

#

1099

# Example 3 (inheriting both allowed and denied values):

1100

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1101

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1102

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1103

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1104

# The accepted values at `organizations/foo` are `E1`, `E2`.

1105

# The value accepted at `projects/bar` is `E2`.

1106

#

1107

# Example 4 (RestoreDefault):

1108

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1109

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1110

# `projects/bar` has a `Policy` with values:

1111

# {RestoreDefault: {}}

1112

# The accepted values at `organizations/foo` are `E1`, `E2`.

1113

# The accepted values at `projects/bar` are either all or none depending on

1114

# the value of `constraint_default` (if `ALLOW`, all; if

1115

# `DENY`, none).

1116

#

1117

# Example 5 (no policy inherits parent policy):

1118

# `organizations/foo` has no `Policy` set.

1119

# `projects/bar` has no `Policy` set.

1120

# The accepted values at both levels are either all or none depending on

1121

# the value of `constraint_default` (if `ALLOW`, all; if

1122

# `DENY`, none).

1123

#

1124

# Example 6 (ListConstraint allowing all):

1125

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1126

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1127

# `projects/bar` has a `Policy` with:

1128

# {all: ALLOW}

1129

# The accepted values at `organizations/foo` are `E1`, E2`.

1130

# Any value is accepted at `projects/bar`.

1131

#

1132

# Example 7 (ListConstraint allowing none):

1133

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1134

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1135

# `projects/bar` has a `Policy` with:

1136

# {all: DENY}

1137

# The accepted values at `organizations/foo` are `E1`, E2`.

1138

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1139

#

1140

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1141

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1142

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1143

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1144

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1145

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1146

# {allowed_values: "under:projects/P3"}

1147

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1148

# The accepted values at `organizations/foo` are `organizations/O1`,

1149

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1150

# `projects/P3`.

1151

# The accepted values at `projects/bar` are `organizations/O1`,

1152

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1153

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1154

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1155

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1156

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1157

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1158

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1159

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1160

# concurrency control.

1161

#

1162

# When the `Policy` is returned from either a `GetPolicy` or a

1163

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1164

# `Policy` to use when executing a read-modify-write loop.

1165

#

1166

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1167

# `etag` will be unset.

1168

#

1169

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1170

# that was returned from a `GetOrgPolicy` request as part of a

1171

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1172

# `SetOrgPolicy` request will result in an unconditional write of the

1173

# `Policy`.

1174

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1175

# `constraints/serviceuser.services`.

1176

#

1177

# Immutable after creation.

1178

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1179

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1180

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1181

# configuration is acceptable.

1182

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1183

# Suppose you have a `Constraint`

1184

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1185

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1186

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1187

# - If the `Policy` at this resource has enforced set to `false`, serial

1188

# port connection attempts will be allowed.

1189

# - If the `Policy` at this resource has enforced set to `true`, serial

1190

# port connection attempts will be refused.

1191

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1192

# connection attempts will be allowed.

1193

# - If no `Policy` is set at this resource or anywhere higher in the

1194

# resource hierarchy, serial port connection attempts will be allowed.

1195

# - If no `Policy` is set at this resource, but one exists higher in the

1196

# resource hierarchy, the behavior is as if the`Policy` were set at

1197

# this resource.

1198

#

1199

# The following examples demonstrate the different possible layerings:

1200

#

1201

# Example 1 (nearest `Constraint` wins):

1202

# `organizations/foo` has a `Policy` with:

1203

# {enforced: false}

1204

# `projects/bar` has no `Policy` set.

1205

# The constraint at `projects/bar` and `organizations/foo` will not be

1206

# enforced.

1207

#

1208

# Example 2 (enforcement gets replaced):

1209

# `organizations/foo` has a `Policy` with:

1210

# {enforced: false}

1211

# `projects/bar` has a `Policy` with:

1212

# {enforced: true}

1213

# The constraint at `organizations/foo` is not enforced.

1214

# The constraint at `projects/bar` is enforced.

1215

#

1216

# Example 3 (RestoreDefault):

1217

# `organizations/foo` has a `Policy` with:

1218

# {enforced: true}

1219

# `projects/bar` has a `Policy` with:

1220

# {RestoreDefault: {}}

1221

# The constraint at `organizations/foo` is enforced.

1222

# The constraint at `projects/bar` is not enforced, because

1223

# `constraint_default` for the `Constraint` is `ALLOW`.

1224

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1235

1236

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1237

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1238

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1239

# server, not specified by the caller, and represents the last time a call to

1240

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1241

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1242

"version": 42, # Version of the `Policy`. Default version is 0;

1243

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1244

# `Constraint` type.

1245

# `constraint_default` enforcement behavior of the specific `Constraint` at

1246

# this resource.

1247

#

1248

# Suppose that `constraint_default` is set to `ALLOW` for the

1249

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1250

# foo.com sets a `Policy` at their Organization resource node that restricts

1251

# the allowed service activations to deny all service activations. They

1252

# could then set a `Policy` with the `policy_type` `restore_default` on

1253

# several experimental projects, restoring the `constraint_default`

1254

# enforcement of the `Constraint` for only those projects, allowing those

1255

# projects to have all services activated.

1256

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1257

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1258

# resource.

1259

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1260

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1261

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1262

# are allowed or denied by setting the `allowed_values` and `denied_values`

1263

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1264

# The `under:` prefix is used to denote resource subtree values.

1265

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1266

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1267

# same as values with no prefix.

1268

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1269

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1270

# - "folders/<folder-id>", e.g. "folders/1234"

1271

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1272

# The `supports_under` field of the associated `Constraint` defines whether

1273

# ancestry prefixes can be used. You can set `allowed_values` and

1274

# `denied_values` in the same `Policy` if `all_values` is

1275

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1276

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1277

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1278

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1279

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1280

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1281

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1282

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1283

# that matches the value specified in this `Policy`. If `suggested_value`

1284

# is not set, it will inherit the value specified higher in the hierarchy,

1285

# unless `inherit_from_parent` is `false`.

1286

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1287

#

1288

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1289

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1290

# set to `true`, then the values from the effective `Policy` of the parent

1291

# resource are inherited, meaning the values set in this `Policy` are

1292

# added to the values inherited up the hierarchy.

1293

#

1294

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1295

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1296

# simple and understandable. However, it is possible to set a `Policy` with

1297

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1298

# In this case, the values that are allowed must be in `allowed_values` and

1299

# not present in `denied_values`.

1300

#

1301

# For example, suppose you have a `Constraint`

1302

# `constraints/serviceuser.services`, which has a `constraint_type` of

1303

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1304

# Suppose that at the Organization level, a `Policy` is applied that

1305

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1306

# `Policy` is applied to a project below the Organization that has

1307

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1308

# then an attempt to activate any API will be denied.

1309

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1310

# The following examples demonstrate different possible layerings for

1311

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1312

#

1313

# Example 1 (no inherited values):

1314

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1315

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1316

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1317

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1318

# The accepted values at `organizations/foo` are `E1`, `E2`.

1319

# The accepted values at `projects/bar` are `E3`, and `E4`.

1320

#

1321

# Example 2 (inherited values):

1322

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1323

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1324

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1325

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1326

# The accepted values at `organizations/foo` are `E1`, `E2`.

1327

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1328

#

1329

# Example 3 (inheriting both allowed and denied values):

1330

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1331

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1332

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1333

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1334

# The accepted values at `organizations/foo` are `E1`, `E2`.

1335

# The value accepted at `projects/bar` is `E2`.

1336

#

1337

# Example 4 (RestoreDefault):

1338

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1339

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1340

# `projects/bar` has a `Policy` with values:

1341

# {RestoreDefault: {}}

1342

# The accepted values at `organizations/foo` are `E1`, `E2`.

1343

# The accepted values at `projects/bar` are either all or none depending on

1344

# the value of `constraint_default` (if `ALLOW`, all; if

1345

# `DENY`, none).

1346

#

1347

# Example 5 (no policy inherits parent policy):

1348

# `organizations/foo` has no `Policy` set.

1349

# `projects/bar` has no `Policy` set.

1350

# The accepted values at both levels are either all or none depending on

1351

# the value of `constraint_default` (if `ALLOW`, all; if

1352

# `DENY`, none).

1353

#

1354

# Example 6 (ListConstraint allowing all):

1355

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1356

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1357

# `projects/bar` has a `Policy` with:

1358

# {all: ALLOW}

1359

# The accepted values at `organizations/foo` are `E1`, E2`.

1360

# Any value is accepted at `projects/bar`.

1361

#

1362

# Example 7 (ListConstraint allowing none):

1363

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1364

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1365

# `projects/bar` has a `Policy` with:

1366

# {all: DENY}

1367

# The accepted values at `organizations/foo` are `E1`, E2`.

1368

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1369

#

1370

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1371

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1372

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1373

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1374

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1375

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1376

# {allowed_values: "under:projects/P3"}

1377

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1378

# The accepted values at `organizations/foo` are `organizations/O1`,

1379

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1380

# `projects/P3`.

1381

# The accepted values at `projects/bar` are `organizations/O1`,

1382

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1383

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1384

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1385

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1386

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1387

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1388

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1389

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1390

# concurrency control.

1391

#

1392

# When the `Policy` is returned from either a `GetPolicy` or a

1393

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1394

# `Policy` to use when executing a read-modify-write loop.

1395

#

1396

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1397

# `etag` will be unset.

1398

#

1399

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1400

# that was returned from a `GetOrgPolicy` request as part of a

1401

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1402

# `SetOrgPolicy` request will result in an unconditional write of the

1403

# `Policy`.

1404

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1405

# `constraints/serviceuser.services`.

1406

#

1407

# Immutable after creation.

1408

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1409

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1410

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1411

# configuration is acceptable.

1412

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1413

# Suppose you have a `Constraint`

1414

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1415

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1416

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1417

# - If the `Policy` at this resource has enforced set to `false`, serial

1418

# port connection attempts will be allowed.

1419

# - If the `Policy` at this resource has enforced set to `true`, serial

1420

# port connection attempts will be refused.

1421

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1422

# connection attempts will be allowed.

1423

# - If no `Policy` is set at this resource or anywhere higher in the

1424

# resource hierarchy, serial port connection attempts will be allowed.

1425

# - If no `Policy` is set at this resource, but one exists higher in the

1426

# resource hierarchy, the behavior is as if the`Policy` were set at

1427

# this resource.

1428

#

1429

# The following examples demonstrate the different possible layerings:

1430

#

1431

# Example 1 (nearest `Constraint` wins):

1432

# `organizations/foo` has a `Policy` with:

1433

# {enforced: false}

1434

# `projects/bar` has no `Policy` set.

1435

# The constraint at `projects/bar` and `organizations/foo` will not be

1436

# enforced.

1437

#

1438

# Example 2 (enforcement gets replaced):

1439

# `organizations/foo` has a `Policy` with:

1440

# {enforced: false}

1441

# `projects/bar` has a `Policy` with:

1442

# {enforced: true}

1443

# The constraint at `organizations/foo` is not enforced.

1444

# The constraint at `projects/bar` is enforced.

1445

#

1446

# Example 3 (RestoreDefault):

1447

# `organizations/foo` has a `Policy` with:

1448

# {enforced: true}

1449

# `projects/bar` has a `Policy` with:

1450

# {RestoreDefault: {}}

1451

# The constraint at `organizations/foo` is enforced.

1452

# The constraint at `projects/bar` is not enforced, because

1453

# `constraint_default` for the `Constraint` is `ALLOW`.

1454

},

Sai Cheemalapati