Blame - docs/dyn/cloudresourcemanager_v1.projects.html - platform/external/python/google-api-python-client

2017-01-06 09:58:29 -0800

[diff] [blame]

310

<pre>Marks the Project identified by the specified

311

`project_id` (for example, `my-project-123`) for deletion.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

312

This method will only affect the Project if it has a lifecycle state of

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

313

ACTIVE.

314

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

315

This method changes the Project's lifecycle state from

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

316

ACTIVE

317

to DELETE_REQUESTED.

318

The deletion starts at an unspecified time,

319

at which point the Project is no longer accessible.

320

321

Until the deletion completes, you can check the lifecycle state

322

checked by retrieving the Project with GetProject,

323

and the Project remains visible to ListProjects.

324

However, you cannot update the project.

325

326

After the deletion completes, the Project is not retrievable by

327

the GetProject and

328

ListProjects methods.

329

330

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

331

332

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

333

projectId: string, The Project ID (for example, `foo-bar-123`).

334

335

Required. (required)

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

336

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

337

Allowed values

338

1 - v1 error format

339

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

340

341

Returns:

342

An object of the form:

343

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

344

{ # A generic empty message that you can re-use to avoid defining duplicated

345

# empty messages in your APIs. A typical example is to use it as the request

346

# or the response type of an API method. For instance:

347

#

348

# service Foo {

349

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

350

# }

351

#

352

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

357

<code class="details" id="get">get(projectId, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

358

<pre>Retrieves the Project identified by the specified

359

`project_id` (for example, `my-project-123`).

360

361

The caller must have read permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

362

363

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

364

projectId: string, The Project ID (for example, `my-project-123`).

365

366

Required. (required)

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

367

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

368

Allowed values

369

1 - v1 error format

370

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

371

372

Returns:

373

An object of the form:

374

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

375

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

376

# container for ACLs, APIs, App Engine Apps, VMs, and other

377

# Google Cloud Platform resources.

378

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

379

#

380

# Supported parent types include "organization" and "folder". Once set, the

381

# parent cannot be cleared. The `parent` can be set on creation or using the

382

# `UpdateProject` method; the end user must have the

383

# `resourcemanager.projects.create` permission on the parent.

384

#

385

# Read-write.

386

# Cloud Platform is a generic term for something you (a developer) may want to

387

# interact with through one of our API's. Some examples are an App Engine app,

388

# a Compute Engine instance, a Cloud SQL database, and so on.

389

"type": "A String", # Required field representing the resource type this id is for.

390

# At present, the valid types are: "organization", "folder", and "project".

391

"id": "A String", # Required field for the type-specific id. This should correspond to the id

392

# used in the type-specific API's.

393

},

394

"labels": { # The labels associated with this Project.

395

#

396

# Label keys must be between 1 and 63 characters long and must conform

397

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

398

#

399

# Label values must be between 0 and 63 characters long and must conform

400

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

401

# value can be empty.

402

#

403

# No more than 256 labels can be associated with a given resource.

404

#

405

# Clients should store labels in a representation such as JSON that does not

406

# depend on specific characters being disallowed.

407

#

408

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"createTime": "A String", # Creation time.

413

#

414

# Read-only.

415

"name": "A String", # The optional user-assigned display name of the Project.

416

# When present it must be between 4 to 30 characters.

417

# Allowed characters are: lowercase and uppercase letters, numbers,

418

# hyphen, single-quote, double-quote, space, and exclamation point.

419

#

420

# Example: <code>My Project</code>

421

# Read-write.

422

"projectId": "A String", # The unique, user-assigned ID of the Project.

423

# It must be 6 to 30 lowercase letters, digits, or hyphens.

424

# It must start with a letter.

425

# Trailing hyphens are prohibited.

426

#

427

# Example: <code>tokyo-rain-123</code>

428

# Read-only after creation.

429

"lifecycleState": "A String", # The Project lifecycle state.

430

#

431

# Read-only.

432

"projectNumber": "A String", # The number uniquely identifying the project.

433

#

434

# Example: <code>415104041262</code>

435

# Read-only.

436

}</pre>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

440

<code class="details" id="getAncestry">getAncestry(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

441

<pre>Gets a list of ancestors in the resource hierarchy for the Project

442

identified by the specified `project_id` (for example, `my-project-123`).

443

444

The caller must have read permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

445

446

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

447

projectId: string, The Project ID (for example, `my-project-123`).

448

449

Required. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

450

body: object, The request body.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

451

The object takes the form of:

452

453

{ # The request sent to the

# GetAncestry

# method.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

465

466

{ # Response from the GetAncestry method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

467

"ancestor": [ # Ancestors are ordered from bottom to top of the resource hierarchy. The

468

# first ancestor is the project itself, followed by the project's parent,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

469

# etc..

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

470

{ # Identifying information for a single ancestor of a project.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

471

"resourceId": { # A container to reference an id for any resource type. A `resource` in Google # Resource id of the ancestor.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

472

# Cloud Platform is a generic term for something you (a developer) may want to

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

473

# interact with through one of our API's. Some examples are an App Engine app,

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

474

# a Compute Engine instance, a Cloud SQL database, and so on.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

475

"type": "A String", # Required field representing the resource type this id is for.

476

# At present, the valid types are: "organization", "folder", and "project".

477

"id": "A String", # Required field for the type-specific id. This should correspond to the id

478

# used in the type-specific API's.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

},

},

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

486

<code class="details" id="getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

487

<pre>Gets the effective `Policy` on a resource. This is the result of merging

488

`Policies` in the resource hierarchy. The returned `Policy` will not have

489

an `etag`set because it is a computed `Policy` across multiple resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

490

Subtrees of Resource Manager resource hierarchy with 'under:' prefix will

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

491

not be expanded.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

492

493

Args:

494

resource: string, The name of the resource to start computing the effective `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

495

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

496

The object takes the form of:

497

498

{ # The request sent to the GetEffectiveOrgPolicy method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

499

"constraint": "A String", # The name of the `Constraint` to compute the effective `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

500

}

501

502

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

509

510

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

511

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

512

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

513

# server, not specified by the caller, and represents the last time a call to

514

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

515

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

516

"version": 42, # Version of the `Policy`. Default version is 0;

517

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

518

# `Constraint` type.

519

# `constraint_default` enforcement behavior of the specific `Constraint` at

520

# this resource.

521

#

522

# Suppose that `constraint_default` is set to `ALLOW` for the

523

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

524

# foo.com sets a `Policy` at their Organization resource node that restricts

525

# the allowed service activations to deny all service activations. They

526

# could then set a `Policy` with the `policy_type` `restore_default` on

527

# several experimental projects, restoring the `constraint_default`

528

# enforcement of the `Constraint` for only those projects, allowing those

529

# projects to have all services activated.

530

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

531

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

532

# resource.

533

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

534

# `ListPolicy` can define specific values and subtrees of Cloud Resource

535

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

536

# are allowed or denied by setting the `allowed_values` and `denied_values`

537

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

538

# The `under:` prefix is used to denote resource subtree values.

539

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

540

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

541

# same as values with no prefix.

542

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

543

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

544

# - "folders/<folder-id>", e.g. "folders/1234"

545

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

546

# The `supports_under` field of the associated `Constraint` defines whether

547

# ancestry prefixes can be used. You can set `allowed_values` and

548

# `denied_values` in the same `Policy` if `all_values` is

549

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

550

# values. If `all_values` is set to either `ALLOW` or `DENY`,

551

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

552

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

553

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

554

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

555

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

556

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

557

# that matches the value specified in this `Policy`. If `suggested_value`

558

# is not set, it will inherit the value specified higher in the hierarchy,

559

# unless `inherit_from_parent` is `false`.

560

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

561

#

562

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

563

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

564

# set to `true`, then the values from the effective `Policy` of the parent

565

# resource are inherited, meaning the values set in this `Policy` are

566

# added to the values inherited up the hierarchy.

567

#

568

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

569

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

570

# simple and understandable. However, it is possible to set a `Policy` with

571

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

572

# In this case, the values that are allowed must be in `allowed_values` and

573

# not present in `denied_values`.

574

#

575

# For example, suppose you have a `Constraint`

576

# `constraints/serviceuser.services`, which has a `constraint_type` of

577

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

578

# Suppose that at the Organization level, a `Policy` is applied that

579

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

580

# `Policy` is applied to a project below the Organization that has

581

# `inherit_from_parent` set to `false` and field all_values set to DENY,

582

# then an attempt to activate any API will be denied.

583

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

584

# The following examples demonstrate different possible layerings for

585

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

586

#

587

# Example 1 (no inherited values):

588

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

589

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

590

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

591

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

592

# The accepted values at `organizations/foo` are `E1`, `E2`.

593

# The accepted values at `projects/bar` are `E3`, and `E4`.

594

#

595

# Example 2 (inherited values):

596

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

597

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

598

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

599

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

600

# The accepted values at `organizations/foo` are `E1`, `E2`.

601

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

602

#

603

# Example 3 (inheriting both allowed and denied values):

604

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

605

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

606

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

607

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

608

# The accepted values at `organizations/foo` are `E1`, `E2`.

609

# The value accepted at `projects/bar` is `E2`.

610

#

611

# Example 4 (RestoreDefault):

612

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

613

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

614

# `projects/bar` has a `Policy` with values:

615

# {RestoreDefault: {}}

616

# The accepted values at `organizations/foo` are `E1`, `E2`.

617

# The accepted values at `projects/bar` are either all or none depending on

618

# the value of `constraint_default` (if `ALLOW`, all; if

619

# `DENY`, none).

620

#

621

# Example 5 (no policy inherits parent policy):

622

# `organizations/foo` has no `Policy` set.

623

# `projects/bar` has no `Policy` set.

624

# The accepted values at both levels are either all or none depending on

625

# the value of `constraint_default` (if `ALLOW`, all; if

626

# `DENY`, none).

627

#

628

# Example 6 (ListConstraint allowing all):

629

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

630

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

631

# `projects/bar` has a `Policy` with:

632

# {all: ALLOW}

633

# The accepted values at `organizations/foo` are `E1`, E2`.

634

# Any value is accepted at `projects/bar`.

635

#

636

# Example 7 (ListConstraint allowing none):

637

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

638

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

639

# `projects/bar` has a `Policy` with:

640

# {all: DENY}

641

# The accepted values at `organizations/foo` are `E1`, E2`.

642

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

643

#

644

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

645

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

646

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

647

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

648

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

649

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

650

# {allowed_values: "under:projects/P3"}

651

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

652

# The accepted values at `organizations/foo` are `organizations/O1`,

653

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

654

# `projects/P3`.

655

# The accepted values at `projects/bar` are `organizations/O1`,

656

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

657

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

658

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

659

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

660

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

661

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

662

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

663

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

664

# concurrency control.

665

#

666

# When the `Policy` is returned from either a `GetPolicy` or a

667

# `ListOrgPolicy` request, this `etag` indicates the version of the current

668

# `Policy` to use when executing a read-modify-write loop.

669

#

670

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

671

# `etag` will be unset.

672

#

673

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

674

# that was returned from a `GetOrgPolicy` request as part of a

675

# read-modify-write loop for concurrency control. Not setting the `etag`in a

676

# `SetOrgPolicy` request will result in an unconditional write of the

677

# `Policy`.

678

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

679

# `constraints/serviceuser.services`.

680

#

681

# Immutable after creation.

682

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

683

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

684

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

685

# configuration is acceptable.

686

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

687

# Suppose you have a `Constraint`

688

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

689

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

690

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

691

# - If the `Policy` at this resource has enforced set to `false`, serial

692

# port connection attempts will be allowed.

693

# - If the `Policy` at this resource has enforced set to `true`, serial

694

# port connection attempts will be refused.

695

# - If the `Policy` at this resource is `RestoreDefault`, serial port

696

# connection attempts will be allowed.

697

# - If no `Policy` is set at this resource or anywhere higher in the

698

# resource hierarchy, serial port connection attempts will be allowed.

699

# - If no `Policy` is set at this resource, but one exists higher in the

700

# resource hierarchy, the behavior is as if the`Policy` were set at

701

# this resource.

702

#

703

# The following examples demonstrate the different possible layerings:

704

#

705

# Example 1 (nearest `Constraint` wins):

706

# `organizations/foo` has a `Policy` with:

707

# {enforced: false}

708

# `projects/bar` has no `Policy` set.

709

# The constraint at `projects/bar` and `organizations/foo` will not be

710

# enforced.

711

#

712

# Example 2 (enforcement gets replaced):

713

# `organizations/foo` has a `Policy` with:

714

# {enforced: false}

715

# `projects/bar` has a `Policy` with:

716

# {enforced: true}

717

# The constraint at `organizations/foo` is not enforced.

718

# The constraint at `projects/bar` is enforced.

719

#

720

# Example 3 (RestoreDefault):

721

# `organizations/foo` has a `Policy` with:

722

# {enforced: true}

723

# `projects/bar` has a `Policy` with:

724

# {RestoreDefault: {}}

725

# The constraint at `organizations/foo` is enforced.

726

# The constraint at `projects/bar` is not enforced, because

727

# `constraint_default` for the `Constraint` is `ALLOW`.

728

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

733

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

734

<pre>Returns the IAM access control policy for the specified Project.

735

Permission is denied if the policy or the resource does not exist.

736

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

737

Authorization requires the Google IAM permission

738

`resourcemanager.projects.getIamPolicy` on the project.

739

740

For additional information about resource structure and identification,

741

see [Resource Names](/apis/design/resource_names).

742

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

743

Args:

744

resource: string, REQUIRED: The resource for which the policy is being requested.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

745

See the operation documentation for the appropriate value for this field. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

746

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

747

The object takes the form of:

748

749

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

750

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

751

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

752

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

753

#

754

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

755

# rejected.

756

#

757

# Requests for policies with any conditional bindings must specify version 3.

758

# Policies without any conditional bindings may specify any valid value or

759

# leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

760

#

761

# To learn which resources support conditions in their IAM policies, see the

762

# [IAM

763

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

764

},

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

765

}

766

767

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

768

Allowed values

769

1 - v1 error format

770

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

771

772

Returns:

773

An object of the form:

774

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

775

{ # An Identity and Access Management (IAM) policy, which specifies access

776

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

777

#

778

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

779

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

780

# `members` to a single `role`. Members can be user accounts, service accounts,

781

# Google groups, and domains (such as G Suite). A `role` is a named list of

782

# permissions; each `role` can be an IAM predefined role or a user-created

783

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

784

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

785

# For some types of Google Cloud resources, a `binding` can also specify a

786

# `condition`, which is a logical expression that allows access to a resource

787

# only if the expression evaluates to `true`. A condition can add constraints

788

# based on attributes of the request, the resource, or both. To learn which

789

# resources support conditions in their IAM policies, see the

790

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

791

#

792

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

793

#

794

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

795

# "bindings": [

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

796

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

797

# "role": "roles/resourcemanager.organizationAdmin",

798

# "members": [

799

# "user:mike@example.com",

800

# "group:admins@example.com",

801

# "domain:google.com",

802

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

803

# ]

804

# },

805

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

806

# "role": "roles/resourcemanager.organizationViewer",

807

# "members": [

808

# "user:eve@example.com"

809

# ],

810

# "condition": {

811

# "title": "expirable access",

812

# "description": "Does not grant access after Sep 2020",

813

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

814

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

815

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

816

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

817

# "etag": "BwWWja0YfJA=",

818

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

819

# }

820

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

821

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

826

# - group:admins@example.com

827

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

828

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

829

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

830

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

831

# - user:eve@example.com

832

# role: roles/resourcemanager.organizationViewer

833

# condition:

834

# title: expirable access

835

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

836

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

837

# - etag: BwWWja0YfJA=

838

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

839

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

840

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

841

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

842

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

843

# prevent simultaneous updates of a policy from overwriting each other.

844

# It is strongly suggested that systems make use of the `etag` in the

845

# read-modify-write cycle to perform policy updates in order to avoid race

846

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

847

# systems are expected to put that etag in the request to `setIamPolicy` to

848

# ensure that their change will be applied to the same version of the policy.

849

#

850

# **Important:** If you use IAM Conditions, you must include the `etag` field

851

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

852

# you to overwrite a version `3` policy with a version `1` policy, and all of

853

# the conditions in the version `3` policy are lost.

854

"version": 42, # Specifies the format of the policy.

855

#

856

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

857

# are rejected.

858

#

859

# Any operation that affects conditional role bindings must specify version

860

# `3`. This requirement applies to the following operations:

861

#

862

# * Getting a policy that includes a conditional role binding

863

# * Adding a conditional role binding to a policy

864

# * Changing a conditional role binding in a policy

865

# * Removing any role binding, with or without a condition, from a policy

866

# that includes conditions

867

#

868

# **Important:** If you use IAM Conditions, you must include the `etag` field

869

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

870

# you to overwrite a version `3` policy with a version `1` policy, and all of

871

# the conditions in the version `3` policy are lost.

872

#

873

# If a policy does not include any conditions, operations on that policy may

874

# specify any valid version or leave the field unset.

875

#

876

# To learn which resources support conditions in their IAM policies, see the

877

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

878

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

879

{ # Specifies the audit configuration for a service.

880

# The configuration determines which permission types are logged, and what

881

# identities, if any, are exempted from logging.

882

# An AuditConfig must have one or more AuditLogConfigs.

883

#

884

# If there are AuditConfigs for both `allServices` and a specific service,

885

# the union of the two AuditConfigs is used for that service: the log_types

886

# specified in each AuditConfig are enabled, and the exempted_members in each

887

# AuditLogConfig are exempted.

888

#

889

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

895

# "audit_log_configs": [

896

# {

897

# "log_type": "DATA_READ",

898

# "exempted_members": [

899

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

904

# },

905

# {

906

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

912

# "audit_log_configs": [

913

# {

914

# "log_type": "DATA_READ",

915

# },

916

# {

917

# "log_type": "DATA_WRITE",

918

# "exempted_members": [

919

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

928

# logging. It also exempts jose@example.com from DATA_READ logging, and

929

# aliya@example.com from DATA_WRITE logging.

930

"service": "A String", # Specifies a service that will be enabled for audit logging.

931

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

932

# `allServices` is a special value that covers all services.

933

"auditLogConfigs": [ # The configuration for logging of each type of permission.

934

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

939

# {

940

# "log_type": "DATA_READ",

941

# "exempted_members": [

942

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

952

# jose@example.com from DATA_READ logging.

953

"logType": "A String", # The log type that this config enables.

954

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

955

# permission.

956

# Follows the same format of Binding.members.

"A String",

],

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

964

# `condition` that determines how and when the `bindings` are applied. Each

965

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

966

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

967

"role": "A String", # Role that is assigned to `members`.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

968

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

969

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

970

#

971

# If the condition evaluates to `true`, then this binding applies to the

972

# current request.

973

#

974

# If the condition evaluates to `false`, then this binding does not apply to

975

# the current request. However, a different role binding might grant the same

976

# role to one or more of the members in this binding.

977

#

978

# To learn which resources support conditions in their IAM policies, see the

979

# [IAM

980

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

981

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

982

# are documented at https://github.com/google/cel-spec.

983

#

984

# Example (Comparison):

985

#

986

# title: "Summary size limit"

987

# description: "Determines if a summary is less than 100 chars"

988

# expression: "document.summary.size() < 100"

989

#

990

# Example (Equality):

991

#

992

# title: "Requestor is owner"

993

# description: "Determines if requestor is the document owner"

994

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

999

# description: "Determine whether the document should be publicly visible"

1000

# expression: "document.type != 'private' && document.type != 'internal'"

1001

#

1002

# Example (Data Manipulation):

1003

#

1004

# title: "Notification string"

1005

# description: "Create a notification string with a timestamp."

1006

# expression: "'New message received at ' + string(document.create_time)"

1007

#

1008

# The exact variables and functions that may be referenced within an expression

1009

# are determined by the service that evaluates it. See the service

1010

# documentation for additional information.

1011

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1012

# its purpose. This can be used e.g. in UIs which allow to enter the

1013

# expression.

1014

"location": "A String", # Optional. String indicating the location of the expression for error

1015

# reporting, e.g. a file name and a position in the file.

1016

"description": "A String", # Optional. Description of the expression. This is a longer text which

1017

# describes the expression, e.g. when hovered over it in a UI.

1018

"expression": "A String", # Textual representation of an expression in Common Expression Language

1019

# syntax.

1020

},

1021

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1022

# `members` can have the following values:

1023

#

1024

# * `allUsers`: A special identifier that represents anyone who is

1025

# on the internet; with or without a Google account.

1026

#

1027

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1028

# who is authenticated with a Google account or a service account.

1029

#

1030

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1031

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1032

#

1033

#

1034

# * `serviceAccount:{emailid}`: An email address that represents a service

1035

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1036

#

1037

# * `group:{emailid}`: An email address that represents a Google group.

1038

# For example, `admins@example.com`.

1039

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1040

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1041

# identifier) representing a user that has been recently deleted. For

1042

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1043

# recovered, this value reverts to `user:{emailid}` and the recovered user

1044

# retains the role in the binding.

1045

#

1046

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1047

# unique identifier) representing a service account that has been recently

1048

# deleted. For example,

1049

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1050

# If the service account is undeleted, this value reverts to

1051

# `serviceAccount:{emailid}` and the undeleted service account retains the

1052

# role in the binding.

1053

#

1054

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1055

# identifier) representing a Google group that has been recently

1056

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1057

# the group is recovered, this value reverts to `group:{emailid}` and the

1058

# recovered group retains the role in the binding.

1059

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1060

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1061

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1062

# users of that domain. For example, `google.com` or `example.com`.

1063

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1064

"A String",

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1065

],

1066

},

1067

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1072

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1073

<pre>Gets a `Policy` on a resource.

1074

1075

If no `Policy` is set on the resource, a `Policy` is returned with default

1076

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

1077

`etag` value can be used with `SetOrgPolicy()` to create or update a

1078

`Policy` during read-modify-write.

1079

1080

Args:

1081

resource: string, Name of the resource the `Policy` is set on. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1082

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1083

The object takes the form of:

1084

1085

{ # The request sent to the GetOrgPolicy method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1086

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1087

}

1088

1089

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1096

1097

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1098

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1099

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1100

# server, not specified by the caller, and represents the last time a call to

1101

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1102

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1103

"version": 42, # Version of the `Policy`. Default version is 0;

1104

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1105

# `Constraint` type.

1106

# `constraint_default` enforcement behavior of the specific `Constraint` at

1107

# this resource.

1108

#

1109

# Suppose that `constraint_default` is set to `ALLOW` for the

1110

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1111

# foo.com sets a `Policy` at their Organization resource node that restricts

1112

# the allowed service activations to deny all service activations. They

1113

# could then set a `Policy` with the `policy_type` `restore_default` on

1114

# several experimental projects, restoring the `constraint_default`

1115

# enforcement of the `Constraint` for only those projects, allowing those

1116

# projects to have all services activated.

1117

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1118

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1119

# resource.

1120

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1121

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1122

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1123

# are allowed or denied by setting the `allowed_values` and `denied_values`

1124

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1125

# The `under:` prefix is used to denote resource subtree values.

1126

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1127

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1128

# same as values with no prefix.

1129

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1130

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1131

# - "folders/<folder-id>", e.g. "folders/1234"

1132

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1133

# The `supports_under` field of the associated `Constraint` defines whether

1134

# ancestry prefixes can be used. You can set `allowed_values` and

1135

# `denied_values` in the same `Policy` if `all_values` is

1136

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1137

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1138

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1139

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1140

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1141

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1142

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1143

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1144

# that matches the value specified in this `Policy`. If `suggested_value`

1145

# is not set, it will inherit the value specified higher in the hierarchy,

1146

# unless `inherit_from_parent` is `false`.

1147

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1148

#

1149

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1150

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1151

# set to `true`, then the values from the effective `Policy` of the parent

1152

# resource are inherited, meaning the values set in this `Policy` are

1153

# added to the values inherited up the hierarchy.

1154

#

1155

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1156

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1157

# simple and understandable. However, it is possible to set a `Policy` with

1158

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1159

# In this case, the values that are allowed must be in `allowed_values` and

1160

# not present in `denied_values`.

1161

#

1162

# For example, suppose you have a `Constraint`

1163

# `constraints/serviceuser.services`, which has a `constraint_type` of

1164

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1165

# Suppose that at the Organization level, a `Policy` is applied that

1166

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1167

# `Policy` is applied to a project below the Organization that has

1168

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1169

# then an attempt to activate any API will be denied.

1170

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1171

# The following examples demonstrate different possible layerings for

1172

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1173

#

1174

# Example 1 (no inherited values):

1175

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1176

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1177

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1178

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1179

# The accepted values at `organizations/foo` are `E1`, `E2`.

1180

# The accepted values at `projects/bar` are `E3`, and `E4`.

1181

#

1182

# Example 2 (inherited values):

1183

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1184

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1185

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1186

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1187

# The accepted values at `organizations/foo` are `E1`, `E2`.

1188

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1189

#

1190

# Example 3 (inheriting both allowed and denied values):

1191

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1192

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1193

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1194

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1195

# The accepted values at `organizations/foo` are `E1`, `E2`.

1196

# The value accepted at `projects/bar` is `E2`.

1197

#

1198

# Example 4 (RestoreDefault):

1199

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1200

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1201

# `projects/bar` has a `Policy` with values:

1202

# {RestoreDefault: {}}

1203

# The accepted values at `organizations/foo` are `E1`, `E2`.

1204

# The accepted values at `projects/bar` are either all or none depending on

1205

# the value of `constraint_default` (if `ALLOW`, all; if

1206

# `DENY`, none).

1207

#

1208

# Example 5 (no policy inherits parent policy):

1209

# `organizations/foo` has no `Policy` set.

1210

# `projects/bar` has no `Policy` set.

1211

# The accepted values at both levels are either all or none depending on

1212

# the value of `constraint_default` (if `ALLOW`, all; if

1213

# `DENY`, none).

1214

#

1215

# Example 6 (ListConstraint allowing all):

1216

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1217

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1218

# `projects/bar` has a `Policy` with:

1219

# {all: ALLOW}

1220

# The accepted values at `organizations/foo` are `E1`, E2`.

1221

# Any value is accepted at `projects/bar`.

1222

#

1223

# Example 7 (ListConstraint allowing none):

1224

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1225

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1226

# `projects/bar` has a `Policy` with:

1227

# {all: DENY}

1228

# The accepted values at `organizations/foo` are `E1`, E2`.

1229

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1230

#

1231

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1232

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1233

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1234

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1235

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1236

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1237

# {allowed_values: "under:projects/P3"}

1238

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1239

# The accepted values at `organizations/foo` are `organizations/O1`,

1240

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1241

# `projects/P3`.

1242

# The accepted values at `projects/bar` are `organizations/O1`,

1243

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1244

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1245

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1246

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1247

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1248

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1249

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1250

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1251

# concurrency control.

1252

#

1253

# When the `Policy` is returned from either a `GetPolicy` or a

1254

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1255

# `Policy` to use when executing a read-modify-write loop.

1256

#

1257

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1258

# `etag` will be unset.

1259

#

1260

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1261

# that was returned from a `GetOrgPolicy` request as part of a

1262

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1263

# `SetOrgPolicy` request will result in an unconditional write of the

1264

# `Policy`.

1265

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1266

# `constraints/serviceuser.services`.

1267

#

1268

# Immutable after creation.

1269

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1270

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1271

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1272

# configuration is acceptable.

1273

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1274

# Suppose you have a `Constraint`

1275

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1276

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1277

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1278

# - If the `Policy` at this resource has enforced set to `false`, serial

1279

# port connection attempts will be allowed.

1280

# - If the `Policy` at this resource has enforced set to `true`, serial

1281

# port connection attempts will be refused.

1282

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1283

# connection attempts will be allowed.

1284

# - If no `Policy` is set at this resource or anywhere higher in the

1285

# resource hierarchy, serial port connection attempts will be allowed.

1286

# - If no `Policy` is set at this resource, but one exists higher in the

1287

# resource hierarchy, the behavior is as if the`Policy` were set at

1288

# this resource.

1289

#

1290

# The following examples demonstrate the different possible layerings:

1291

#

1292

# Example 1 (nearest `Constraint` wins):

1293

# `organizations/foo` has a `Policy` with:

1294

# {enforced: false}

1295

# `projects/bar` has no `Policy` set.

1296

# The constraint at `projects/bar` and `organizations/foo` will not be

1297

# enforced.

1298

#

1299

# Example 2 (enforcement gets replaced):

1300

# `organizations/foo` has a `Policy` with:

1301

# {enforced: false}

1302

# `projects/bar` has a `Policy` with:

1303

# {enforced: true}

1304

# The constraint at `organizations/foo` is not enforced.

1305

# The constraint at `projects/bar` is enforced.

1306

#

1307

# Example 3 (RestoreDefault):

1308

# `organizations/foo` has a `Policy` with:

1309

# {enforced: true}

1310

# `projects/bar` has a `Policy` with:

1311

# {RestoreDefault: {}}

1312

# The constraint at `organizations/foo` is enforced.

1313

# The constraint at `projects/bar` is not enforced, because

1314

# `constraint_default` for the `Constraint` is `ALLOW`.

1315

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1320

<code class="details" id="list">list(filter=None, pageToken=None, pageSize=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1321

<pre>Lists Projects that the caller has the `resourcemanager.projects.get`

1322

permission on and satisfy the specified filter.

1323

1324

This method returns Projects in an unspecified order.

1325

This method is eventually consistent with project mutations; this means

1326

that a newly created project may not appear in the results or recent

1327

updates to an existing project may not be reflected in the results. To

1328

retrieve the latest state of a project, use the

1329

GetProject method.

1330

1331

NOTE: If the request filter contains a `parent.type` and `parent.id` and

1332

the caller has the `resourcemanager.projects.list` permission on the

1333

parent, the results will be drawn from an alternate index which provides

1334

more consistent results. In future versions of this API, this List method

1335

will be split into List and Search to properly capture the behavorial

1336

difference.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1337

1338

Args:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1339

filter: string, An expression for filtering the results of the request. Filter rules are

1340

case insensitive. The fields eligible for filtering are:

1341

1342

+ `name`

1343

+ `id`

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1344

+ `labels.<key>` (where *key* is the name of a label)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

+ `parent.type`

+ `parent.id`

Some examples of using labels as filters:

1349

1350

| Filter | Description |

1351

|------------------|-----------------------------------------------------|

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1352

| name:how* | The project's name starts with "how". |

1353

| name:Howl | The project's name is `Howl` or `howl`. |

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1354

| name:HOWL | Equivalent to above. |

1355

| NAME:howl | Equivalent to above. |

1356

| labels.color:* | The project has the label `color`. |

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1357

| labels.color:red | The project's label `color` has the value `red`. |

1358

| labels.color:red&nbsp;labels.size:big |The project's label `color` has

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1359

the value `red` and its label `size` has the value `big`. |

1360

1361

If no filter is specified, the call will return projects for which the user

1362

has the `resourcemanager.projects.get` permission.

1363

1364

NOTE: To perform a by-parent query (eg., what projects are directly in a

1365

Folder), the caller must have the `resourcemanager.projects.list`

1366

permission on the parent and the filter must contain both a `parent.type`

1367

and a `parent.id` restriction

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1368

(example: "parent.type:folder parent.id:123"). In this case an alternate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1369

search index is used which provides more consistent results.

1370

1371

Optional.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1372

pageToken: string, A pagination token returned from a previous call to ListProjects

1373

that indicates from where listing should continue.

1374

1375

Optional.

1376

pageSize: integer, The maximum number of Projects to return in the response.

1377

The server can return fewer Projects than requested.

1378

If unspecified, server picks an appropriate default.

1379

1380

Optional.

1381

x__xgafv: string, V1 error format.

1382

Allowed values

1383

1 - v1 error format

1384

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1385

1386

Returns:

1387

An object of the form:

1388

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1389

{ # A page of the response received from the

# ListProjects

# method.

#

# A paginated response where more pages are available has

1394

# `next_page_token` set. This token can be used in a subsequent request to

1395

# retrieve the next request page.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1396

"projects": [ # The list of Projects that matched the list filter. This list can

1397

# be paginated.

1398

{ # A Project is a high-level Google Cloud Platform entity. It is a

1399

# container for ACLs, APIs, App Engine Apps, VMs, and other

1400

# Google Cloud Platform resources.

1401

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

1402

#

1403

# Supported parent types include "organization" and "folder". Once set, the

1404

# parent cannot be cleared. The `parent` can be set on creation or using the

1405

# `UpdateProject` method; the end user must have the

1406

# `resourcemanager.projects.create` permission on the parent.

1407

#

1408

# Read-write.

1409

# Cloud Platform is a generic term for something you (a developer) may want to

1410

# interact with through one of our API's. Some examples are an App Engine app,

1411

# a Compute Engine instance, a Cloud SQL database, and so on.

1412

"type": "A String", # Required field representing the resource type this id is for.

1413

# At present, the valid types are: "organization", "folder", and "project".

1414

"id": "A String", # Required field for the type-specific id. This should correspond to the id

1415

# used in the type-specific API's.

1416

},

1417

"labels": { # The labels associated with this Project.

1418

#

1419

# Label keys must be between 1 and 63 characters long and must conform

1420

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

1421

#

1422

# Label values must be between 0 and 63 characters long and must conform

1423

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

1424

# value can be empty.

1425

#

1426

# No more than 256 labels can be associated with a given resource.

1427

#

1428

# Clients should store labels in a representation such as JSON that does not

1429

# depend on specific characters being disallowed.

1430

#

1431

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"createTime": "A String", # Creation time.

1436

#

1437

# Read-only.

1438

"name": "A String", # The optional user-assigned display name of the Project.

1439

# When present it must be between 4 to 30 characters.

1440

# Allowed characters are: lowercase and uppercase letters, numbers,

1441

# hyphen, single-quote, double-quote, space, and exclamation point.

1442

#

1443

# Example: <code>My Project</code>

1444

# Read-write.

1445

"projectId": "A String", # The unique, user-assigned ID of the Project.

1446

# It must be 6 to 30 lowercase letters, digits, or hyphens.

1447

# It must start with a letter.

1448

# Trailing hyphens are prohibited.

1449

#

1450

# Example: <code>tokyo-rain-123</code>

1451

# Read-only after creation.

1452

"lifecycleState": "A String", # The Project lifecycle state.

1453

#

1454

# Read-only.

1455

"projectNumber": "A String", # The number uniquely identifying the project.

1456

#

1457

# Example: <code>415104041262</code>

# Read-only.

},

],

"nextPageToken": "A String", # Pagination token.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1462

#

1463

# If the result set is too large to fit in a single response, this token

1464

# is returned. It encodes the position of the current result cursor.

1465

# Feeding this value into a new list request with the `page_token` parameter

1466

# gives the next page of the results.

1467

#

1468

# When `next_page_token` is not filled in, there is no next page and

1469

# the list returned is the last page in the result set.

1470

#

1471

# Pagination tokens have a limited lifetime.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1476

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1477

<pre>Lists `Constraints` that could be applied on the specified resource.

1478

1479

Args:

1480

resource: string, Name of the resource to list `Constraints` for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1481

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1482

The object takes the form of:

1483

1484

{ # The request sent to the [ListAvailableOrgPolicyConstraints]

1485

# google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1486

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1487

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1488

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1489

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1500

1501

{ # The response returned from the ListAvailableOrgPolicyConstraints method.

1502

# Returns all `Constraints` that could be set at this level of the hierarchy

1503

# (contrast with the response from `ListPolicies`, which returns all policies

1504

# which are set).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1505

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

1506

"constraints": [ # The collection of constraints that are settable on the request resource.

1507

{ # A `Constraint` describes a way in which a resource's configuration can be

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1508

# restricted. For example, it controls which cloud services can be activated

1509

# across an organization, or whether a Compute Engine instance can have

1510

# serial port connections established. `Constraints` can be configured by the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1511

# organization's policy adminstrator to fit the needs of the organzation by

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1512

# setting Policies for `Constraints` at different locations in the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1513

# organization's resource hierarchy. Policies are inherited down the resource

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1514

# hierarchy from higher levels, but can also be overridden. For details about

1515

# the inheritance rules please read about

1516

# Policies.

1517

#

1518

# `Constraints` have a default behavior determined by the `constraint_default`

1519

# field, which is the enforcement behavior that is used in the absence of a

1520

# `Policy` being defined or inherited for the resource in question.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1521

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

1522

# configured by an Organization's policy administrator with a `Policy`.

1523

"supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy

1524

# can be used in `Policy.allowed_values` and `Policy.denied_values`. For

1525

# example, `"under:folders/123"` would match any resource under the

1526

# 'folders/123' folder.

1527

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1528

# that matches the value specified in this `Constraint`.

1529

},

1530

"version": 42, # Version of the `Constraint`. Default version is 0;

1531

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

1532

# where it is enforced.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1533

#

1534

# Mutable.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1535

"displayName": "A String", # The human readable name.

1536

#

1537

# Mutable.

1538

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1539

#

1540

# For example a constraint `constraints/compute.disableSerialPortAccess`.

1541

# If it is enforced on a VM instance, serial port connections will not be

1542

# opened to that instance.

1543

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1544

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absense of 'Policy'.

1545

"name": "A String", # Immutable value, required to globally be unique. For example,

1546

# `constraints/serviceuser.services`

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

1554

<pre>Retrieves the next page of results.

1555

1556

Args:

1557

previous_request: The request for the previous page. (required)

1558

previous_response: The response from the request for the previous page. (required)

1559

1560

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1561

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1562

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1567

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1568

<pre>Lists all the `Policies` set for a particular resource.

1569

1570

Args:

1571

resource: string, Name of the resource to list Policies for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1572

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1573

The object takes the form of:

1574

1575

{ # The request sent to the ListOrgPolicies method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1576

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1577

# and will be ignored. The server may at any point start using this field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1578

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1579

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1590

1591

{ # The response returned from the ListOrgPolicies method. It will be empty

1592

# if no `Policies` are set on the resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1593

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1594

# `Policies` are set.

1595

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1596

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1597

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1598

# server, not specified by the caller, and represents the last time a call to

1599

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1600

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1601

"version": 42, # Version of the `Policy`. Default version is 0;

1602

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1603

# `Constraint` type.

1604

# `constraint_default` enforcement behavior of the specific `Constraint` at

1605

# this resource.

1606

#

1607

# Suppose that `constraint_default` is set to `ALLOW` for the

1608

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1609

# foo.com sets a `Policy` at their Organization resource node that restricts

1610

# the allowed service activations to deny all service activations. They

1611

# could then set a `Policy` with the `policy_type` `restore_default` on

1612

# several experimental projects, restoring the `constraint_default`

1613

# enforcement of the `Constraint` for only those projects, allowing those

1614

# projects to have all services activated.

1615

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1616

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1617

# resource.

1618

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1619

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1620

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1621

# are allowed or denied by setting the `allowed_values` and `denied_values`

1622

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1623

# The `under:` prefix is used to denote resource subtree values.

1624

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1625

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1626

# same as values with no prefix.

1627

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1628

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1629

# - "folders/<folder-id>", e.g. "folders/1234"

1630

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1631

# The `supports_under` field of the associated `Constraint` defines whether

1632

# ancestry prefixes can be used. You can set `allowed_values` and

1633

# `denied_values` in the same `Policy` if `all_values` is

1634

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1635

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1636

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1637

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1638

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1639

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1640

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1641

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1642

# that matches the value specified in this `Policy`. If `suggested_value`

1643

# is not set, it will inherit the value specified higher in the hierarchy,

1644

# unless `inherit_from_parent` is `false`.

1645

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1646

#

1647

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1648

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1649

# set to `true`, then the values from the effective `Policy` of the parent

1650

# resource are inherited, meaning the values set in this `Policy` are

1651

# added to the values inherited up the hierarchy.

1652

#

1653

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1654

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1655

# simple and understandable. However, it is possible to set a `Policy` with

1656

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1657

# In this case, the values that are allowed must be in `allowed_values` and

1658

# not present in `denied_values`.

1659

#

1660

# For example, suppose you have a `Constraint`

1661

# `constraints/serviceuser.services`, which has a `constraint_type` of

1662

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1663

# Suppose that at the Organization level, a `Policy` is applied that

1664

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1665

# `Policy` is applied to a project below the Organization that has

1666

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1667

# then an attempt to activate any API will be denied.

1668

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1669

# The following examples demonstrate different possible layerings for

1670

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1671

#

1672

# Example 1 (no inherited values):

1673

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1674

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1675

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1676

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1677

# The accepted values at `organizations/foo` are `E1`, `E2`.

1678

# The accepted values at `projects/bar` are `E3`, and `E4`.

1679

#

1680

# Example 2 (inherited values):

1681

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1682

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1683

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1684

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1685

# The accepted values at `organizations/foo` are `E1`, `E2`.

1686

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1687

#

1688

# Example 3 (inheriting both allowed and denied values):

1689

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1690

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1691

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1692

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1693

# The accepted values at `organizations/foo` are `E1`, `E2`.

1694

# The value accepted at `projects/bar` is `E2`.

1695

#

1696

# Example 4 (RestoreDefault):

1697

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1698

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1699

# `projects/bar` has a `Policy` with values:

1700

# {RestoreDefault: {}}

1701

# The accepted values at `organizations/foo` are `E1`, `E2`.

1702

# The accepted values at `projects/bar` are either all or none depending on

1703

# the value of `constraint_default` (if `ALLOW`, all; if

1704

# `DENY`, none).

1705

#

1706

# Example 5 (no policy inherits parent policy):

1707

# `organizations/foo` has no `Policy` set.

1708

# `projects/bar` has no `Policy` set.

1709

# The accepted values at both levels are either all or none depending on

1710

# the value of `constraint_default` (if `ALLOW`, all; if

1711

# `DENY`, none).

1712

#

1713

# Example 6 (ListConstraint allowing all):

1714

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1715

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1716

# `projects/bar` has a `Policy` with:

1717

# {all: ALLOW}

1718

# The accepted values at `organizations/foo` are `E1`, E2`.

1719

# Any value is accepted at `projects/bar`.

1720

#

1721

# Example 7 (ListConstraint allowing none):

1722

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1723

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1724

# `projects/bar` has a `Policy` with:

1725

# {all: DENY}

1726

# The accepted values at `organizations/foo` are `E1`, E2`.

1727

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1728

#

1729

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1730

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1731

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1732

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1733

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1734

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1735

# {allowed_values: "under:projects/P3"}

1736

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1737

# The accepted values at `organizations/foo` are `organizations/O1`,

1738

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1739

# `projects/P3`.

1740

# The accepted values at `projects/bar` are `organizations/O1`,

1741

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1742

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1743

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1744

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1745

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1746

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1747

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1748

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1749

# concurrency control.

1750

#

1751

# When the `Policy` is returned from either a `GetPolicy` or a

1752

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1753

# `Policy` to use when executing a read-modify-write loop.

1754

#

1755

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1756

# `etag` will be unset.

1757

#

1758

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1759

# that was returned from a `GetOrgPolicy` request as part of a

1760

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1761

# `SetOrgPolicy` request will result in an unconditional write of the

1762

# `Policy`.

1763

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1764

# `constraints/serviceuser.services`.

1765

#

1766

# Immutable after creation.

1767

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1768

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1769

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1770

# configuration is acceptable.

1771

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1772

# Suppose you have a `Constraint`

1773

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1774

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1775

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1776

# - If the `Policy` at this resource has enforced set to `false`, serial

1777

# port connection attempts will be allowed.

1778

# - If the `Policy` at this resource has enforced set to `true`, serial

1779

# port connection attempts will be refused.

1780

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1781

# connection attempts will be allowed.

1782

# - If no `Policy` is set at this resource or anywhere higher in the

1783

# resource hierarchy, serial port connection attempts will be allowed.

1784

# - If no `Policy` is set at this resource, but one exists higher in the

1785

# resource hierarchy, the behavior is as if the`Policy` were set at

1786

# this resource.

1787

#

1788

# The following examples demonstrate the different possible layerings:

1789

#

1790

# Example 1 (nearest `Constraint` wins):

1791

# `organizations/foo` has a `Policy` with:

1792

# {enforced: false}

1793

# `projects/bar` has no `Policy` set.

1794

# The constraint at `projects/bar` and `organizations/foo` will not be

1795

# enforced.

1796

#

1797

# Example 2 (enforcement gets replaced):

1798

# `organizations/foo` has a `Policy` with:

1799

# {enforced: false}

1800

# `projects/bar` has a `Policy` with:

1801

# {enforced: true}

1802

# The constraint at `organizations/foo` is not enforced.

1803

# The constraint at `projects/bar` is enforced.

1804

#

1805

# Example 3 (RestoreDefault):

1806

# `organizations/foo` has a `Policy` with:

1807

# {enforced: true}

1808

# `projects/bar` has a `Policy` with:

1809

# {RestoreDefault: {}}

1810

# The constraint at `organizations/foo` is enforced.

1811

# The constraint at `projects/bar` is not enforced, because

1812

# `constraint_default` for the `Constraint` is `ALLOW`.

1813

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1814

},

1815

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1816

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

1817

# the server may at any point start supplying a valid token.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

1823

<pre>Retrieves the next page of results.

1824

1825

Args:

1826

previous_request: The request for the previous page. (required)

1827

previous_response: The response from the request for the previous page. (required)

1828

1829

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1830

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1831

page. Returns None if there are no more items in the collection.

</pre>

</div>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1836

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

1837

<pre>Retrieves the next page of results.

1838

1839

Args:

1840

previous_request: The request for the previous page. (required)

1841

previous_response: The response from the request for the previous page. (required)

1842

1843

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1844

A request object that you can call 'execute()' on to request the next

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1845

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1850

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1851

<pre>Sets the IAM access control policy for the specified Project. Overwrites

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1852

any existing policy.

1853

1854

The following constraints apply when using `setIamPolicy()`:

1855

1856

+ Project does not support `allUsers` and `allAuthenticatedUsers` as

1857

`members` in a `Binding` of a `Policy`.

1858

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1859

+ The owner role can be granted to a `user`, `serviceAccount`, or a group

1860

that is part of an organization. For example,

1861

group@myownpersonaldomain.com could be added as an owner to a project in

1862

the myownpersonaldomain.com organization, but not the examplepetstore.com

1863

organization.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1864

1865

+ Service accounts can be made owners of a project directly

1866

without any restrictions. However, to be added as an owner, a user must be

1867

invited via Cloud Platform console and must accept the invitation.

1868

1869

+ A user cannot be granted the owner role using `setIamPolicy()`. The user

1870

must be granted the owner role using the Cloud Platform Console and must

1871

explicitly accept the invitation.

1872

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1873

+ You can only grant ownership of a project to a member by using the

1874

GCP Console. Inviting a member will deliver an invitation email that

1875

they must accept. An invitation email is not generated if you are

1876

granting a role other than owner, or if both the member you are inviting

1877

and the project are part of your organization.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1878

1879

+ Membership changes that leave the project without any owners that have

1880

accepted the Terms of Service (ToS) will be rejected.

1881

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1882

+ If the project is not part of an organization, there must be at least

1883

one owner who has accepted the Terms of Service (ToS) agreement in the

1884

policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner

1885

from the policy will fail. This restriction also applies to legacy

1886

projects that no longer have owners who have accepted the ToS. Edits to

1887

IAM policies will be rejected until the lack of a ToS-accepting owner is

1888

rectified.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1889

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1890

+ This method will replace the existing policy, and cannot be used to

1891

append additional IAM settings.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1892

1893

Note: Removing service accounts from policies or changing their roles

1894

can render services completely inoperable. It is important to understand

1895

how the service account is being used before removing or updating its

1896

roles.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1897

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1898

Authorization requires the Google IAM permission

1899

`resourcemanager.projects.setIamPolicy` on the project

1900

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1901

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1902

resource: string, REQUIRED: The resource for which the policy is being specified.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

1903

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1904

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1905

The object takes the form of:

1906

1907

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1908

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1909

# the policy is limited to a few 10s of KB. An empty policy is a

1910

# valid policy but certain Cloud Platform services (such as Projects)

1911

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1912

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1913

#

1914

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1915

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1916

# `members` to a single `role`. Members can be user accounts, service accounts,

1917

# Google groups, and domains (such as G Suite). A `role` is a named list of

1918

# permissions; each `role` can be an IAM predefined role or a user-created

1919

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1920

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1921

# For some types of Google Cloud resources, a `binding` can also specify a

1922

# `condition`, which is a logical expression that allows access to a resource

1923

# only if the expression evaluates to `true`. A condition can add constraints

1924

# based on attributes of the request, the resource, or both. To learn which

1925

# resources support conditions in their IAM policies, see the

1926

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1927

#

1928

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1929

#

1930

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1931

# "bindings": [

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1932

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1933

# "role": "roles/resourcemanager.organizationAdmin",

1934

# "members": [

1935

# "user:mike@example.com",

1936

# "group:admins@example.com",

1937

# "domain:google.com",

1938

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1939

# ]

1940

# },

1941

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1942

# "role": "roles/resourcemanager.organizationViewer",

1943

# "members": [

1944

# "user:eve@example.com"

1945

# ],

1946

# "condition": {

1947

# "title": "expirable access",

1948

# "description": "Does not grant access after Sep 2020",

1949

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1950

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1951

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1952

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1953

# "etag": "BwWWja0YfJA=",

1954

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1955

# }

1956

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1957

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1962

# - group:admins@example.com

1963

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1964

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1965

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1966

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1967

# - user:eve@example.com

1968

# role: roles/resourcemanager.organizationViewer

1969

# condition:

1970

# title: expirable access

1971

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1972

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1973

# - etag: BwWWja0YfJA=

1974

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1975

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1976

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1977

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

1978

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1979

# prevent simultaneous updates of a policy from overwriting each other.

1980

# It is strongly suggested that systems make use of the `etag` in the

1981

# read-modify-write cycle to perform policy updates in order to avoid race

1982

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1983

# systems are expected to put that etag in the request to `setIamPolicy` to

1984

# ensure that their change will be applied to the same version of the policy.

1985

#

1986

# **Important:** If you use IAM Conditions, you must include the `etag` field

1987

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1988

# you to overwrite a version `3` policy with a version `1` policy, and all of

1989

# the conditions in the version `3` policy are lost.

1990

"version": 42, # Specifies the format of the policy.

1991

#

1992

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1993

# are rejected.

1994

#

1995

# Any operation that affects conditional role bindings must specify version

1996

# `3`. This requirement applies to the following operations:

1997

#

1998

# * Getting a policy that includes a conditional role binding

1999

# * Adding a conditional role binding to a policy

2000

# * Changing a conditional role binding in a policy

2001

# * Removing any role binding, with or without a condition, from a policy

2002

# that includes conditions

2003

#

2004

# **Important:** If you use IAM Conditions, you must include the `etag` field

2005

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2006

# you to overwrite a version `3` policy with a version `1` policy, and all of

2007

# the conditions in the version `3` policy are lost.

2008

#

2009

# If a policy does not include any conditions, operations on that policy may

2010

# specify any valid version or leave the field unset.

2011

#

2012

# To learn which resources support conditions in their IAM policies, see the

2013

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2014

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

2015

{ # Specifies the audit configuration for a service.

2016

# The configuration determines which permission types are logged, and what

2017

# identities, if any, are exempted from logging.

2018

# An AuditConfig must have one or more AuditLogConfigs.

2019

#

2020

# If there are AuditConfigs for both `allServices` and a specific service,

2021

# the union of the two AuditConfigs is used for that service: the log_types

2022

# specified in each AuditConfig are enabled, and the exempted_members in each

2023

# AuditLogConfig are exempted.

2024

#

2025

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

2031

# "audit_log_configs": [

2032

# {

2033

# "log_type": "DATA_READ",

2034

# "exempted_members": [

2035

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

2040

# },

2041

# {

2042

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

2048

# "audit_log_configs": [

2049

# {

2050

# "log_type": "DATA_READ",

2051

# },

2052

# {

2053

# "log_type": "DATA_WRITE",

2054

# "exempted_members": [

2055

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2064

# logging. It also exempts jose@example.com from DATA_READ logging, and

2065

# aliya@example.com from DATA_WRITE logging.

2066

"service": "A String", # Specifies a service that will be enabled for audit logging.

2067

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

2068

# `allServices` is a special value that covers all services.

2069

"auditLogConfigs": [ # The configuration for logging of each type of permission.

2070

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2075

# {

2076

# "log_type": "DATA_READ",

2077

# "exempted_members": [

2078

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

2088

# jose@example.com from DATA_READ logging.

2089

"logType": "A String", # The log type that this config enables.

2090

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2091

# permission.

2092

# Follows the same format of Binding.members.

"A String",

],

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2100

# `condition` that determines how and when the `bindings` are applied. Each

2101

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2102

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2103

"role": "A String", # Role that is assigned to `members`.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2104

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2105

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2106

#

2107

# If the condition evaluates to `true`, then this binding applies to the

2108

# current request.

2109

#

2110

# If the condition evaluates to `false`, then this binding does not apply to

2111

# the current request. However, a different role binding might grant the same

2112

# role to one or more of the members in this binding.

2113

#

2114

# To learn which resources support conditions in their IAM policies, see the

2115

# [IAM

2116

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2117

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2118

# are documented at https://github.com/google/cel-spec.

2119

#

2120

# Example (Comparison):

2121

#

2122

# title: "Summary size limit"

2123

# description: "Determines if a summary is less than 100 chars"

2124

# expression: "document.summary.size() < 100"

2125

#

2126

# Example (Equality):

2127

#

2128

# title: "Requestor is owner"

2129

# description: "Determines if requestor is the document owner"

2130

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2135

# description: "Determine whether the document should be publicly visible"

2136

# expression: "document.type != 'private' && document.type != 'internal'"

2137

#

2138

# Example (Data Manipulation):

2139

#

2140

# title: "Notification string"

2141

# description: "Create a notification string with a timestamp."

2142

# expression: "'New message received at ' + string(document.create_time)"

2143

#

2144

# The exact variables and functions that may be referenced within an expression

2145

# are determined by the service that evaluates it. See the service

2146

# documentation for additional information.

2147

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2148

# its purpose. This can be used e.g. in UIs which allow to enter the

2149

# expression.

2150

"location": "A String", # Optional. String indicating the location of the expression for error

2151

# reporting, e.g. a file name and a position in the file.

2152

"description": "A String", # Optional. Description of the expression. This is a longer text which

2153

# describes the expression, e.g. when hovered over it in a UI.

2154

"expression": "A String", # Textual representation of an expression in Common Expression Language

2155

# syntax.

2156

},

2157

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2158

# `members` can have the following values:

2159

#

2160

# * `allUsers`: A special identifier that represents anyone who is

2161

# on the internet; with or without a Google account.

2162

#

2163

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2164

# who is authenticated with a Google account or a service account.

2165

#

2166

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2167

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2168

#

2169

#

2170

# * `serviceAccount:{emailid}`: An email address that represents a service

2171

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2172

#

2173

# * `group:{emailid}`: An email address that represents a Google group.

2174

# For example, `admins@example.com`.

2175

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2176

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2177

# identifier) representing a user that has been recently deleted. For

2178

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2179

# recovered, this value reverts to `user:{emailid}` and the recovered user

2180

# retains the role in the binding.

2181

#

2182

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2183

# unique identifier) representing a service account that has been recently

2184

# deleted. For example,

2185

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2186

# If the service account is undeleted, this value reverts to

2187

# `serviceAccount:{emailid}` and the undeleted service account retains the

2188

# role in the binding.

2189

#

2190

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2191

# identifier) representing a Google group that has been recently

2192

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2193

# the group is recovered, this value reverts to `group:{emailid}` and the

2194

# recovered group retains the role in the binding.

2195

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2196

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2197

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2198

# users of that domain. For example, `google.com` or `example.com`.

2199

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2200

"A String",

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2201

],

2202

},

2203

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2204

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2205

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2206

# the fields in the mask will be modified. If no mask is provided, the

2207

# following default mask is used:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2208

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2209

# `paths: "bindings, etag"`

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2210

}

2211

2212

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2213

Allowed values

2214

1 - v1 error format

2215

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2216

2217

Returns:

2218

An object of the form:

2219

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2220

{ # An Identity and Access Management (IAM) policy, which specifies access

2221

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2222

#

2223

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2224

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

2225

# `members` to a single `role`. Members can be user accounts, service accounts,

2226

# Google groups, and domains (such as G Suite). A `role` is a named list of

2227

# permissions; each `role` can be an IAM predefined role or a user-created

2228

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2229

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2230

# For some types of Google Cloud resources, a `binding` can also specify a

2231

# `condition`, which is a logical expression that allows access to a resource

2232

# only if the expression evaluates to `true`. A condition can add constraints

2233

# based on attributes of the request, the resource, or both. To learn which

2234

# resources support conditions in their IAM policies, see the

2235

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2236

#

2237

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2238

#

2239

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2240

# "bindings": [

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2241

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2242

# "role": "roles/resourcemanager.organizationAdmin",

2243

# "members": [

2244

# "user:mike@example.com",

2245

# "group:admins@example.com",

2246

# "domain:google.com",

2247

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2248

# ]

2249

# },

2250

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2251

# "role": "roles/resourcemanager.organizationViewer",

2252

# "members": [

2253

# "user:eve@example.com"

2254

# ],

2255

# "condition": {

2256

# "title": "expirable access",

2257

# "description": "Does not grant access after Sep 2020",

2258

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2259

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2260

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2261

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2262

# "etag": "BwWWja0YfJA=",

2263

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2264

# }

2265

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2266

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

2271

# - group:admins@example.com

2272

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2273

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

2274

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2275

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2276

# - user:eve@example.com

2277

# role: roles/resourcemanager.organizationViewer

2278

# condition:

2279

# title: expirable access

2280

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2281

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2282

# - etag: BwWWja0YfJA=

2283

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2284

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2285

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2286

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2287

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2288

# prevent simultaneous updates of a policy from overwriting each other.

2289

# It is strongly suggested that systems make use of the `etag` in the

2290

# read-modify-write cycle to perform policy updates in order to avoid race

2291

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2292

# systems are expected to put that etag in the request to `setIamPolicy` to

2293

# ensure that their change will be applied to the same version of the policy.

2294

#

2295

# **Important:** If you use IAM Conditions, you must include the `etag` field

2296

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2297

# you to overwrite a version `3` policy with a version `1` policy, and all of

2298

# the conditions in the version `3` policy are lost.

2299

"version": 42, # Specifies the format of the policy.

2300

#

2301

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

2302

# are rejected.

2303

#

2304

# Any operation that affects conditional role bindings must specify version

2305

# `3`. This requirement applies to the following operations:

2306

#

2307

# * Getting a policy that includes a conditional role binding

2308

# * Adding a conditional role binding to a policy

2309

# * Changing a conditional role binding in a policy

2310

# * Removing any role binding, with or without a condition, from a policy

2311

# that includes conditions

2312

#

2313

# **Important:** If you use IAM Conditions, you must include the `etag` field

2314

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2315

# you to overwrite a version `3` policy with a version `1` policy, and all of

2316

# the conditions in the version `3` policy are lost.

2317

#

2318

# If a policy does not include any conditions, operations on that policy may

2319

# specify any valid version or leave the field unset.

2320

#

2321

# To learn which resources support conditions in their IAM policies, see the

2322

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2323

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

2324

{ # Specifies the audit configuration for a service.

2325

# The configuration determines which permission types are logged, and what

2326

# identities, if any, are exempted from logging.

2327

# An AuditConfig must have one or more AuditLogConfigs.

2328

#

2329

# If there are AuditConfigs for both `allServices` and a specific service,

2330

# the union of the two AuditConfigs is used for that service: the log_types

2331

# specified in each AuditConfig are enabled, and the exempted_members in each

2332

# AuditLogConfig are exempted.

2333

#

2334

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

2340

# "audit_log_configs": [

2341

# {

2342

# "log_type": "DATA_READ",

2343

# "exempted_members": [

2344

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

2349

# },

2350

# {

2351

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

2357

# "audit_log_configs": [

2358

# {

2359

# "log_type": "DATA_READ",

2360

# },

2361

# {

2362

# "log_type": "DATA_WRITE",

2363

# "exempted_members": [

2364

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2373

# logging. It also exempts jose@example.com from DATA_READ logging, and

2374

# aliya@example.com from DATA_WRITE logging.

2375

"service": "A String", # Specifies a service that will be enabled for audit logging.

2376

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

2377

# `allServices` is a special value that covers all services.

2378

"auditLogConfigs": [ # The configuration for logging of each type of permission.

2379

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2384

# {

2385

# "log_type": "DATA_READ",

2386

# "exempted_members": [

2387

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

2397

# jose@example.com from DATA_READ logging.

2398

"logType": "A String", # The log type that this config enables.

2399

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2400

# permission.

2401

# Follows the same format of Binding.members.

"A String",

],

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2409

# `condition` that determines how and when the `bindings` are applied. Each

2410

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2411

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2412

"role": "A String", # Role that is assigned to `members`.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2413

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2414

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2415

#

2416

# If the condition evaluates to `true`, then this binding applies to the

2417

# current request.

2418

#

2419

# If the condition evaluates to `false`, then this binding does not apply to

2420

# the current request. However, a different role binding might grant the same

2421

# role to one or more of the members in this binding.

2422

#

2423

# To learn which resources support conditions in their IAM policies, see the

2424

# [IAM

2425

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

2426

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2427

# are documented at https://github.com/google/cel-spec.

2428

#

2429

# Example (Comparison):

2430

#

2431

# title: "Summary size limit"

2432

# description: "Determines if a summary is less than 100 chars"

2433

# expression: "document.summary.size() < 100"

2434

#

2435

# Example (Equality):

2436

#

2437

# title: "Requestor is owner"

2438

# description: "Determines if requestor is the document owner"

2439

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2444

# description: "Determine whether the document should be publicly visible"

2445

# expression: "document.type != 'private' && document.type != 'internal'"

2446

#

2447

# Example (Data Manipulation):

2448

#

2449

# title: "Notification string"

2450

# description: "Create a notification string with a timestamp."

2451

# expression: "'New message received at ' + string(document.create_time)"

2452

#

2453

# The exact variables and functions that may be referenced within an expression

2454

# are determined by the service that evaluates it. See the service

2455

# documentation for additional information.

2456

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2457

# its purpose. This can be used e.g. in UIs which allow to enter the

2458

# expression.

2459

"location": "A String", # Optional. String indicating the location of the expression for error

2460

# reporting, e.g. a file name and a position in the file.

2461

"description": "A String", # Optional. Description of the expression. This is a longer text which

2462

# describes the expression, e.g. when hovered over it in a UI.

2463

"expression": "A String", # Textual representation of an expression in Common Expression Language

2464

# syntax.

2465

},

2466

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2467

# `members` can have the following values:

2468

#

2469

# * `allUsers`: A special identifier that represents anyone who is

2470

# on the internet; with or without a Google account.

2471

#

2472

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2473

# who is authenticated with a Google account or a service account.

2474

#

2475

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2476

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2477

#

2478

#

2479

# * `serviceAccount:{emailid}`: An email address that represents a service

2480

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2481

#

2482

# * `group:{emailid}`: An email address that represents a Google group.

2483

# For example, `admins@example.com`.

2484

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2485

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2486

# identifier) representing a user that has been recently deleted. For

2487

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2488

# recovered, this value reverts to `user:{emailid}` and the recovered user

2489

# retains the role in the binding.

2490

#

2491

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2492

# unique identifier) representing a service account that has been recently

2493

# deleted. For example,

2494

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2495

# If the service account is undeleted, this value reverts to

2496

# `serviceAccount:{emailid}` and the undeleted service account retains the

2497

# role in the binding.

2498

#

2499

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2500

# identifier) representing a Google group that has been recently

2501

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2502

# the group is recovered, this value reverts to `group:{emailid}` and the

2503

# recovered group retains the role in the binding.

2504

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2505

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2506

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2507

# users of that domain. For example, `google.com` or `example.com`.

2508

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2509

"A String",

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2510

],

2511

},

2512

],

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2517

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2518

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

2519

that `Constraint` on the resource if one does not exist.

2520

2521

Not supplying an `etag` on the request `Policy` results in an unconditional

2522

write of the `Policy`.

2523

2524

Args:

2525

resource: string, Resource name of the resource to attach the `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2526

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2527

The object takes the form of:

2528

2529

{ # The request sent to the SetOrgPolicyRequest method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2530

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2531

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2532

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2533

# server, not specified by the caller, and represents the last time a call to

2534

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2535

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2536

"version": 42, # Version of the `Policy`. Default version is 0;

2537

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2538

# `Constraint` type.

2539

# `constraint_default` enforcement behavior of the specific `Constraint` at

2540

# this resource.

2541

#

2542

# Suppose that `constraint_default` is set to `ALLOW` for the

2543

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2544

# foo.com sets a `Policy` at their Organization resource node that restricts

2545

# the allowed service activations to deny all service activations. They

2546

# could then set a `Policy` with the `policy_type` `restore_default` on

2547

# several experimental projects, restoring the `constraint_default`

2548

# enforcement of the `Constraint` for only those projects, allowing those

2549

# projects to have all services activated.

2550

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2551

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2552

# resource.

2553

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2554

# `ListPolicy` can define specific values and subtrees of Cloud Resource

2555

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

2556

# are allowed or denied by setting the `allowed_values` and `denied_values`

2557

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

2558

# The `under:` prefix is used to denote resource subtree values.

2559

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2560

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2561

# same as values with no prefix.

2562

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2563

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

2564

# - "folders/<folder-id>", e.g. "folders/1234"

2565

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2566

# The `supports_under` field of the associated `Constraint` defines whether

2567

# ancestry prefixes can be used. You can set `allowed_values` and

2568

# `denied_values` in the same `Policy` if `all_values` is

2569

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

2570

# values. If `all_values` is set to either `ALLOW` or `DENY`,

2571

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2572

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2573

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2574

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2575

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2576

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2577

# that matches the value specified in this `Policy`. If `suggested_value`

2578

# is not set, it will inherit the value specified higher in the hierarchy,

2579

# unless `inherit_from_parent` is `false`.

2580

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2581

#

2582

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

2583

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2584

# set to `true`, then the values from the effective `Policy` of the parent

2585

# resource are inherited, meaning the values set in this `Policy` are

2586

# added to the values inherited up the hierarchy.

2587

#

2588

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2589

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2590

# simple and understandable. However, it is possible to set a `Policy` with

2591

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2592

# In this case, the values that are allowed must be in `allowed_values` and

2593

# not present in `denied_values`.

2594

#

2595

# For example, suppose you have a `Constraint`

2596

# `constraints/serviceuser.services`, which has a `constraint_type` of

2597

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2598

# Suppose that at the Organization level, a `Policy` is applied that

2599

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2600

# `Policy` is applied to a project below the Organization that has

2601

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2602

# then an attempt to activate any API will be denied.

2603

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2604

# The following examples demonstrate different possible layerings for

2605

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2606

#

2607

# Example 1 (no inherited values):

2608

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2609

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2610

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2611

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2612

# The accepted values at `organizations/foo` are `E1`, `E2`.

2613

# The accepted values at `projects/bar` are `E3`, and `E4`.

2614

#

2615

# Example 2 (inherited values):

2616

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2617

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2618

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2619

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2620

# The accepted values at `organizations/foo` are `E1`, `E2`.

2621

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2622

#

2623

# Example 3 (inheriting both allowed and denied values):

2624

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2625

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2626

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2627

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2628

# The accepted values at `organizations/foo` are `E1`, `E2`.

2629

# The value accepted at `projects/bar` is `E2`.

2630

#

2631

# Example 4 (RestoreDefault):

2632

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2633

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2634

# `projects/bar` has a `Policy` with values:

2635

# {RestoreDefault: {}}

2636

# The accepted values at `organizations/foo` are `E1`, `E2`.

2637

# The accepted values at `projects/bar` are either all or none depending on

2638

# the value of `constraint_default` (if `ALLOW`, all; if

2639

# `DENY`, none).

2640

#

2641

# Example 5 (no policy inherits parent policy):

2642

# `organizations/foo` has no `Policy` set.

2643

# `projects/bar` has no `Policy` set.

2644

# The accepted values at both levels are either all or none depending on

2645

# the value of `constraint_default` (if `ALLOW`, all; if

2646

# `DENY`, none).

2647

#

2648

# Example 6 (ListConstraint allowing all):

2649

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2650

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2651

# `projects/bar` has a `Policy` with:

2652

# {all: ALLOW}

2653

# The accepted values at `organizations/foo` are `E1`, E2`.

2654

# Any value is accepted at `projects/bar`.

2655

#

2656

# Example 7 (ListConstraint allowing none):

2657

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2658

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2659

# `projects/bar` has a `Policy` with:

2660

# {all: DENY}

2661

# The accepted values at `organizations/foo` are `E1`, E2`.

2662

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2663

#

2664

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

2665

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2666

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2667

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2668

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2669

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2670

# {allowed_values: "under:projects/P3"}

2671

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2672

# The accepted values at `organizations/foo` are `organizations/O1`,

2673

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

2674

# `projects/P3`.

2675

# The accepted values at `projects/bar` are `organizations/O1`,

2676

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2677

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2678

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2679

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2680

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2681

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2682

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2683

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2684

# concurrency control.

2685

#

2686

# When the `Policy` is returned from either a `GetPolicy` or a

2687

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2688

# `Policy` to use when executing a read-modify-write loop.

2689

#

2690

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2691

# `etag` will be unset.

2692

#

2693

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2694

# that was returned from a `GetOrgPolicy` request as part of a

2695

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2696

# `SetOrgPolicy` request will result in an unconditional write of the

2697

# `Policy`.

2698

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2699

# `constraints/serviceuser.services`.

2700

#

2701

# Immutable after creation.

2702

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2703

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2704

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2705

# configuration is acceptable.

2706

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2707

# Suppose you have a `Constraint`

2708

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

2709

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

2710

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2711

# - If the `Policy` at this resource has enforced set to `false`, serial

2712

# port connection attempts will be allowed.

2713

# - If the `Policy` at this resource has enforced set to `true`, serial

2714

# port connection attempts will be refused.

2715

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2716

# connection attempts will be allowed.

2717

# - If no `Policy` is set at this resource or anywhere higher in the

2718

# resource hierarchy, serial port connection attempts will be allowed.

2719

# - If no `Policy` is set at this resource, but one exists higher in the

2720

# resource hierarchy, the behavior is as if the`Policy` were set at

2721

# this resource.

2722

#

2723

# The following examples demonstrate the different possible layerings:

2724

#

2725

# Example 1 (nearest `Constraint` wins):

2726

# `organizations/foo` has a `Policy` with:

2727

# {enforced: false}

2728

# `projects/bar` has no `Policy` set.

2729

# The constraint at `projects/bar` and `organizations/foo` will not be

2730

# enforced.

2731

#

2732

# Example 2 (enforcement gets replaced):

2733

# `organizations/foo` has a `Policy` with:

2734

# {enforced: false}

2735

# `projects/bar` has a `Policy` with:

2736

# {enforced: true}

2737

# The constraint at `organizations/foo` is not enforced.

2738

# The constraint at `projects/bar` is enforced.

2739

#

2740

# Example 3 (RestoreDefault):

2741

# `organizations/foo` has a `Policy` with:

2742

# {enforced: true}

2743

# `projects/bar` has a `Policy` with:

2744

# {RestoreDefault: {}}

2745

# The constraint at `organizations/foo` is enforced.

2746

# The constraint at `projects/bar` is not enforced, because

2747

# `constraint_default` for the `Constraint` is `ALLOW`.

2748

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2759

2760

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

2761

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2762

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2763

# server, not specified by the caller, and represents the last time a call to

2764

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2765

# be ignored.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2766

"version": 42, # Version of the `Policy`. Default version is 0;

2767

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2768

# `Constraint` type.

2769

# `constraint_default` enforcement behavior of the specific `Constraint` at

2770

# this resource.

2771

#

2772

# Suppose that `constraint_default` is set to `ALLOW` for the

2773

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2774

# foo.com sets a `Policy` at their Organization resource node that restricts

2775

# the allowed service activations to deny all service activations. They

2776

# could then set a `Policy` with the `policy_type` `restore_default` on

2777

# several experimental projects, restoring the `constraint_default`

2778

# enforcement of the `Constraint` for only those projects, allowing those

2779

# projects to have all services activated.

2780

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2781

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2782

# resource.

2783

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2784

# `ListPolicy` can define specific values and subtrees of Cloud Resource

2785

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

2786

# are allowed or denied by setting the `allowed_values` and `denied_values`

2787

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

2788

# The `under:` prefix is used to denote resource subtree values.

2789

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2790

# if the value contains a ":". Values prefixed with "is:" are treated the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2791

# same as values with no prefix.

2792

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2793

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

2794

# - "folders/<folder-id>", e.g. "folders/1234"

2795

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2796

# The `supports_under` field of the associated `Constraint` defines whether

2797

# ancestry prefixes can be used. You can set `allowed_values` and

2798

# `denied_values` in the same `Policy` if `all_values` is

2799

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

2800

# values. If `all_values` is set to either `ALLOW` or `DENY`,

2801

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2802

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2803

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2804

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2805

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2806

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2807

# that matches the value specified in this `Policy`. If `suggested_value`

2808

# is not set, it will inherit the value specified higher in the hierarchy,

2809

# unless `inherit_from_parent` is `false`.

2810

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2811

#

2812

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

2813

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2814

# set to `true`, then the values from the effective `Policy` of the parent

2815

# resource are inherited, meaning the values set in this `Policy` are

2816

# added to the values inherited up the hierarchy.

2817

#

2818

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2819

# values isn't recommended in most circumstances to keep the configuration

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2820

# simple and understandable. However, it is possible to set a `Policy` with

2821

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2822

# In this case, the values that are allowed must be in `allowed_values` and

2823

# not present in `denied_values`.

2824

#

2825

# For example, suppose you have a `Constraint`

2826

# `constraints/serviceuser.services`, which has a `constraint_type` of

2827

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2828

# Suppose that at the Organization level, a `Policy` is applied that

2829

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2830

# `Policy` is applied to a project below the Organization that has

2831

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2832

# then an attempt to activate any API will be denied.

2833

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2834

# The following examples demonstrate different possible layerings for

2835

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2836

#

2837

# Example 1 (no inherited values):

2838

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2839

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2840

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2841

# {allowed_values: "E3" allowed_values: "E4"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2842

# The accepted values at `organizations/foo` are `E1`, `E2`.

2843

# The accepted values at `projects/bar` are `E3`, and `E4`.

2844

#

2845

# Example 2 (inherited values):

2846

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2847

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2848

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2849

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2850

# The accepted values at `organizations/foo` are `E1`, `E2`.

2851

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2852

#

2853

# Example 3 (inheriting both allowed and denied values):

2854

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2855

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2856

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2857

# {denied_values: "E1"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2858

# The accepted values at `organizations/foo` are `E1`, `E2`.

2859

# The value accepted at `projects/bar` is `E2`.

2860

#

2861

# Example 4 (RestoreDefault):

2862

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2863

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2864

# `projects/bar` has a `Policy` with values:

2865

# {RestoreDefault: {}}

2866

# The accepted values at `organizations/foo` are `E1`, `E2`.

2867

# The accepted values at `projects/bar` are either all or none depending on

2868

# the value of `constraint_default` (if `ALLOW`, all; if

2869

# `DENY`, none).

2870

#

2871

# Example 5 (no policy inherits parent policy):

2872

# `organizations/foo` has no `Policy` set.

2873

# `projects/bar` has no `Policy` set.

2874

# The accepted values at both levels are either all or none depending on

2875

# the value of `constraint_default` (if `ALLOW`, all; if

2876

# `DENY`, none).

2877

#

2878

# Example 6 (ListConstraint allowing all):

2879

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2880

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2881

# `projects/bar` has a `Policy` with:

2882

# {all: ALLOW}

2883

# The accepted values at `organizations/foo` are `E1`, E2`.

2884

# Any value is accepted at `projects/bar`.

2885

#

2886

# Example 7 (ListConstraint allowing none):

2887

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2888

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2889

# `projects/bar` has a `Policy` with:

2890

# {all: DENY}

2891

# The accepted values at `organizations/foo` are `E1`, E2`.

2892

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2893

#

2894

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

2895

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2896

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2897

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2898

# {allowed_values: "under:organizations/O1"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2899

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2900

# {allowed_values: "under:projects/P3"}

2901

# {denied_values: "under:folders/F2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2902

# The accepted values at `organizations/foo` are `organizations/O1`,

2903

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

2904

# `projects/P3`.

2905

# The accepted values at `projects/bar` are `organizations/O1`,

2906

# `folders/F1`, `projects/P1`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2907

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2908

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2909

"A String",

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2910

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2911

"allValues": "A String", # The policy all_values state.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2912

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2913

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2914

# concurrency control.

2915

#

2916

# When the `Policy` is returned from either a `GetPolicy` or a

2917

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2918

# `Policy` to use when executing a read-modify-write loop.

2919

#

2920

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2921

# `etag` will be unset.

2922

#

2923

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2924

# that was returned from a `GetOrgPolicy` request as part of a

2925

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2926

# `SetOrgPolicy` request will result in an unconditional write of the

2927

# `Policy`.

2928

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2929

# `constraints/serviceuser.services`.

2930

#

2931

# Immutable after creation.

2932

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2933

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2934

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2935

# configuration is acceptable.

2936

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2937

# Suppose you have a `Constraint`

2938

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

2939

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

2940

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2941

# - If the `Policy` at this resource has enforced set to `false`, serial

2942

# port connection attempts will be allowed.

2943

# - If the `Policy` at this resource has enforced set to `true`, serial

2944

# port connection attempts will be refused.

2945

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2946

# connection attempts will be allowed.

2947

# - If no `Policy` is set at this resource or anywhere higher in the

2948

# resource hierarchy, serial port connection attempts will be allowed.

2949

# - If no `Policy` is set at this resource, but one exists higher in the

2950

# resource hierarchy, the behavior is as if the`Policy` were set at

2951

# this resource.

2952

#

2953

# The following examples demonstrate the different possible layerings:

2954

#

2955

# Example 1 (nearest `Constraint` wins):

2956

# `organizations/foo` has a `Policy` with:

2957

# {enforced: false}

2958

# `projects/bar` has no `Policy` set.

2959

# The constraint at `projects/bar` and `organizations/foo` will not be

2960

# enforced.

2961

#

2962

# Example 2 (enforcement gets replaced):

2963

# `organizations/foo` has a `Policy` with:

2964

# {enforced: false}

2965

# `projects/bar` has a `Policy` with:

2966

# {enforced: true}

2967

# The constraint at `organizations/foo` is not enforced.

2968

# The constraint at `projects/bar` is enforced.

2969

#

2970

# Example 3 (RestoreDefault):

2971

# `organizations/foo` has a `Policy` with:

2972

# {enforced: true}

2973

# `projects/bar` has a `Policy` with:

2974

# {RestoreDefault: {}}

2975

# The constraint at `organizations/foo` is enforced.

2976

# The constraint at `projects/bar` is not enforced, because

2977

# `constraint_default` for the `Constraint` is `ALLOW`.

2978

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2983

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2984

<pre>Returns permissions that a caller has on the specified Project.

2985

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2986

There are no permissions required for making this API call.

2987

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2988

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2989

resource: string, REQUIRED: The resource for which the policy detail is being requested.

Sai Cheemalapati

c30d2b5

2017-03-13 12:12:03 -0400

[diff] [blame]

2990

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2991

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2992

The object takes the form of:

2993

2994

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2995

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

2996

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2997

# information see

2998

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

2999

"A String",

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3004

Allowed values

3005

1 - v1 error format

3006

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3007

3008

Returns:

3009

An object of the form:

3010

3011

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

3012

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3013

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

3014

"A String",

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

],

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3020

<code class="details" id="undelete">undelete(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3021

<pre>Restores the Project identified by the specified

3022

`project_id` (for example, `my-project-123`).

3023

You can only use this method for a Project that has a lifecycle state of

3024

DELETE_REQUESTED.

3025

After deletion starts, the Project cannot be restored.

3026

3027

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3028

3029

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3030

projectId: string, The project ID (for example, `foo-bar-123`).

3031

3032

Required. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3033

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3034

The object takes the form of:

3035

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3036

{ # The request sent to the UndeleteProject

3037

# method.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3038

}

3039

3040

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3041

Allowed values

3042

1 - v1 error format

3043

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3044

3045

Returns:

3046

An object of the form:

3047

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3048

{ # A generic empty message that you can re-use to avoid defining duplicated

3049

# empty messages in your APIs. A typical example is to use it as the request

3050

# or the response type of an API method. For instance:

3051

#

3052

# service Foo {

3053

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

3054

# }

3055

#

3056

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3061

<code class="details" id="update">update(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3062

<pre>Updates the attributes of the Project identified by the specified

3063

`project_id` (for example, `my-project-123`).

3064

3065

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3066

3067

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3068

projectId: string, The project ID (for example, `my-project-123`).

3069

3070

Required. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3071

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3072

The object takes the form of:

3073

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3074

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

3075

# container for ACLs, APIs, App Engine Apps, VMs, and other

3076

# Google Cloud Platform resources.

3077

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

3078

#

3079

# Supported parent types include "organization" and "folder". Once set, the

3080

# parent cannot be cleared. The `parent` can be set on creation or using the

3081

# `UpdateProject` method; the end user must have the

3082

# `resourcemanager.projects.create` permission on the parent.

3083

#

3084

# Read-write.

3085

# Cloud Platform is a generic term for something you (a developer) may want to

3086

# interact with through one of our API's. Some examples are an App Engine app,

3087

# a Compute Engine instance, a Cloud SQL database, and so on.

3088

"type": "A String", # Required field representing the resource type this id is for.

3089

# At present, the valid types are: "organization", "folder", and "project".

3090

"id": "A String", # Required field for the type-specific id. This should correspond to the id

3091

# used in the type-specific API's.

3092

},

3093

"labels": { # The labels associated with this Project.

3094

#

3095

# Label keys must be between 1 and 63 characters long and must conform

3096

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

3097

#

3098

# Label values must be between 0 and 63 characters long and must conform

3099

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

3100

# value can be empty.

3101

#

3102

# No more than 256 labels can be associated with a given resource.

3103

#

3104

# Clients should store labels in a representation such as JSON that does not

3105

# depend on specific characters being disallowed.

3106

#

3107

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"createTime": "A String", # Creation time.

3112

#

3113

# Read-only.

3114

"name": "A String", # The optional user-assigned display name of the Project.

3115

# When present it must be between 4 to 30 characters.

3116

# Allowed characters are: lowercase and uppercase letters, numbers,

3117

# hyphen, single-quote, double-quote, space, and exclamation point.

3118

#

3119

# Example: <code>My Project</code>

3120

# Read-write.

3121

"projectId": "A String", # The unique, user-assigned ID of the Project.

3122

# It must be 6 to 30 lowercase letters, digits, or hyphens.

3123

# It must start with a letter.

3124

# Trailing hyphens are prohibited.

3125

#

3126

# Example: <code>tokyo-rain-123</code>

3127

# Read-only after creation.

3128

"lifecycleState": "A String", # The Project lifecycle state.

3129

#

3130

# Read-only.

3131

"projectNumber": "A String", # The number uniquely identifying the project.

3132

#

3133

# Example: <code>415104041262</code>

3134

# Read-only.

3135

}

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

3136

3137

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

3144

3145

{ # A Project is a high-level Google Cloud Platform entity. It is a

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame^]

3146

# container for ACLs, APIs, App Engine Apps, VMs, and other

3147

# Google Cloud Platform resources.

3148

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

3149

#

3150

# Supported parent types include "organization" and "folder". Once set, the

3151

# parent cannot be cleared. The `parent` can be set on creation or using the

3152

# `UpdateProject` method; the end user must have the

3153

# `resourcemanager.projects.create` permission on the parent.

3154

#

3155

# Read-write.

3156

# Cloud Platform is a generic term for something you (a developer) may want to

3157

# interact with through one of our API's. Some examples are an App Engine app,

3158

# a Compute Engine instance, a Cloud SQL database, and so on.

3159

"type": "A String", # Required field representing the resource type this id is for.

3160

# At present, the valid types are: "organization", "folder", and "project".

3161

"id": "A String", # Required field for the type-specific id. This should correspond to the id

3162

# used in the type-specific API's.

3163

},

3164

"labels": { # The labels associated with this Project.

3165

#

3166

# Label keys must be between 1 and 63 characters long and must conform

3167

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

3168

#

3169

# Label values must be between 0 and 63 characters long and must conform

3170

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

3171

# value can be empty.

3172

#

3173

# No more than 256 labels can be associated with a given resource.

3174

#

3175

# Clients should store labels in a representation such as JSON that does not

3176

# depend on specific characters being disallowed.

3177

#

3178

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"createTime": "A String", # Creation time.

3183

#

3184

# Read-only.

3185

"name": "A String", # The optional user-assigned display name of the Project.

3186

# When present it must be between 4 to 30 characters.

3187

# Allowed characters are: lowercase and uppercase letters, numbers,

3188

# hyphen, single-quote, double-quote, space, and exclamation point.

3189

#

3190

# Example: <code>My Project</code>

3191

# Read-write.

3192

"projectId": "A String", # The unique, user-assigned ID of the Project.

3193

# It must be 6 to 30 lowercase letters, digits, or hyphens.

3194

# It must start with a letter.

3195

# Trailing hyphens are prohibited.

3196

#

3197

# Example: <code>tokyo-rain-123</code>

3198

# Read-only after creation.

3199

"lifecycleState": "A String", # The Project lifecycle state.

3200

#

3201

# Read-only.

3202

"projectNumber": "A String", # The number uniquely identifying the project.

3203

#

3204

# Example: <code>415104041262</code>

3205

# Read-only.

3206

}</pre>

Jon Wayne Parrott