Blame - docs/dyn/cloudkms_v1.projects.locations.keyRings.html - platform/external/python/google-api-python-client

2017-03-27 10:39:26 -0700

[diff] [blame]

83

<code><a href="#create">create(parent, body, keyRingId=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

84

<p class="firstline">Create a new KeyRing in a given Project and Location.</p>

85

86

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

87

<p class="firstline">Returns metadata for a given KeyRing.</p>

88

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

89

<code><a href="#getIamPolicy">getIamPolicy(resource, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

90

<p class="firstline">Gets the access control policy for a resource.</p>

91

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

92

<code><a href="#list">list(parent, pageToken=None, x__xgafv=None, pageSize=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

93

<p class="firstline">Lists KeyRings.</p>

94

95

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

96

<p class="firstline">Retrieves the next page of results.</p>

97

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

98

<code><a href="#setIamPolicy">setIamPolicy(resource, body, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

99

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

100

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

101

<code><a href="#testIamPermissions">testIamPermissions(resource, body, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

102

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

103

<h3>Method Details</h3>

104

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

105

<code class="details" id="create">create(parent, body, keyRingId=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

106

<pre>Create a new KeyRing in a given Project and Location.

107

108

Args:

109

parent: string, Required. The resource name of the location associated with the

110

KeyRings, in the format `projects/*/locations/*`. (required)

111

body: object, The request body. (required)

112

The object takes the form of:

113

114

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

115

"createTime": "A String", # Output only. The time at which this KeyRing was created.

116

"name": "A String", # Output only. The resource name for the KeyRing in the format

117

# `projects/*/locations/*/keyRings/*`.

118

}

119

120

keyRingId: string, Required. It must be unique within a location and match the regular

121

expression `[a-zA-Z0-9_-]{1,63}`

122

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

129

130

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

131

"createTime": "A String", # Output only. The time at which this KeyRing was created.

132

"name": "A String", # Output only. The resource name for the KeyRing in the format

133

# `projects/*/locations/*/keyRings/*`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

139

<pre>Returns metadata for a given KeyRing.

140

141

Args:

142

name: string, The name of the KeyRing to get. (required)

143

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

150

151

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

152

"createTime": "A String", # Output only. The time at which this KeyRing was created.

153

"name": "A String", # Output only. The resource name for the KeyRing in the format

154

# `projects/*/locations/*/keyRings/*`.

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

159

<code class="details" id="getIamPolicy">getIamPolicy(resource, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

160

<pre>Gets the access control policy for a resource.

161

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

166

See the operation documentation for the appropriate value for this field. (required)

167

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

174

175

{ # Defines an Identity and Access Management (IAM) policy. It is used to

176

# specify access control policies for Cloud Platform resources.

177

#

178

#

179

# A `Policy` consists of a list of `bindings`. A `Binding` binds a list of

180

# `members` to a `role`, where the members can be user accounts, Google groups,

181

# Google domains, and service accounts. A `role` is a named list of permissions

# defined by IAM.

#

# **Example**

#

# {

# "bindings": [

# {

# "role": "roles/owner",

190

# "members": [

191

# "user:mike@example.com",

192

# "group:admins@example.com",

193

# "domain:google.com",

194

# "serviceAccount:my-other-app@appspot.gserviceaccount.com",

# ]

# },

# {

# "role": "roles/viewer",

199

# "members": ["user:sean@example.com"]

# }

# ]

# }

#

# For a description of IAM and its features, see the

205

# [IAM developer's guide](https://cloud.google.com/iam).

206

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

207

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

208

# The configuration determines which permission types are logged, and what

209

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

210

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

211

#

212

# If there are AuditConfigs for both `allServices` and a specific service,

213

# the union of the two AuditConfigs is used for that service: the log_types

214

# specified in each AuditConfig are enabled, and the exempted_members in each

215

# AuditConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

216

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

217

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

218

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

219

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

220

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

221

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

222

# "service": "allServices"

223

# "audit_log_configs": [

224

# {

225

# "log_type": "DATA_READ",

226

# "exempted_members": [

227

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

232

# },

233

# {

234

# "log_type": "ADMIN_READ",

235

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

236

# ]

237

# },

238

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

239

# "service": "fooservice.googleapis.com"

240

# "audit_log_configs": [

241

# {

242

# "log_type": "DATA_READ",

243

# },

244

# {

245

# "log_type": "DATA_WRITE",

246

# "exempted_members": [

247

# "user:bar@gmail.com"

248

# ]

249

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

254

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

255

# For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

256

# logging. It also exempts foo@gmail.com from DATA_READ logging, and

257

# bar@gmail.com from DATA_WRITE logging.

"exemptedMembers": [

"A String",

],

"auditLogConfigs": [ # The configuration for logging of each type of permission.

262

# Next ID: 4

263

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

268

# {

269

# "log_type": "DATA_READ",

270

# "exempted_members": [

271

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

281

# foo@gmail.com from DATA_READ logging.

282

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

283

# permission.

284

# Follows the same format of Binding.members.

285

"A String",

286

],

287

"logType": "A String", # The log type that this config enables.

288

},

289

],

290

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

291

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

292

# `allServices` is a special value that covers all services.

293

},

294

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

295

"rules": [ # If more than one rule is specified, the rules are applied in the following

296

# manner:

297

# - All matching LOG rules are always applied.

298

# - If any DENY/DENY_WITH_LOG rule matches, permission is denied.

299

# Logging will be applied if one or more matching rule requires logging.

300

# - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is

301

# granted.

302

# Logging will be applied if one or more matching rule requires logging.

303

# - Otherwise, if no rule applies, permission is denied.

304

{ # A rule to be applied in a Policy.

305

"notIn": [ # If one or more 'not_in' clauses are specified, the rule matches

306

# if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

307

# The format for in and not_in entries is the same as for members in a

308

# Binding (see google/iam/v1/policy.proto).

309

"A String",

310

],

311

"description": "A String", # Human-readable description of the rule.

312

"in": [ # If one or more 'in' clauses are specified, the rule matches if

313

# the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

314

"A String",

315

],

316

"action": "A String", # Required

317

"conditions": [ # Additional restrictions that must be met

318

{ # A condition to be met.

319

"iam": "A String", # Trusted attributes supplied by the IAM system.

320

"svc": "A String", # Trusted attributes discharged by the service.

321

"value": "A String", # DEPRECATED. Use 'values' instead.

322

"sys": "A String", # Trusted attributes supplied by any service that owns resources and uses

323

# the IAM system for access control.

324

"values": [ # The objects of the condition. This is mutually exclusive with 'value'.

325

"A String",

326

],

327

"op": "A String", # An operator to apply the subject with.

328

},

329

],

330

"logConfig": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries

331

# that match the LOG action.

332

{ # Specifies what kind of log the caller must write

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

333

"counter": { # Options for counters # Counter options.

334

"field": "A String", # The field value to attribute.

335

"metric": "A String", # The metric to update.

336

},

337

"dataAccess": { # Write a Data Access (Gin) log # Data access options.

338

},

339

"cloudAudit": { # Write a Cloud Audit log # Cloud audit options.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

340

"logName": "A String", # The log_name to populate in the Cloud Audit Record.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

},

},

],

"permissions": [ # A permission is a string of form '<service>.<resource type>.<verb>'

345

# (e.g., 'storage.buckets.list'). A value of '*' matches all permissions,

346

# and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

"A String",

],

},

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

351

"version": 42, # Version of the `Policy`. The default version is 0.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

352

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

353

# prevent simultaneous updates of a policy from overwriting each other.

354

# It is strongly suggested that systems make use of the `etag` in the

355

# read-modify-write cycle to perform policy updates in order to avoid race

356

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

357

# systems are expected to put that etag in the request to `setIamPolicy` to

358

# ensure that their change will be applied to the same version of the policy.

359

#

360

# If no `etag` is provided in the call to `setIamPolicy`, then the existing

361

# policy is overwritten blindly.

362

"bindings": [ # Associates a list of `members` to a `role`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

363

# `bindings` with no members will result in an error.

364

{ # Associates `members` with a `role`.

365

"role": "A String", # Role that is assigned to `members`.

366

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

367

# Required

368

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

369

# `members` can have the following values:

370

#

371

# * `allUsers`: A special identifier that represents anyone who is

372

# on the internet; with or without a Google account.

373

#

374

# * `allAuthenticatedUsers`: A special identifier that represents anyone

375

# who is authenticated with a Google account or a service account.

376

#

377

# * `user:{emailid}`: An email address that represents a specific Google

378

# account. For example, `alice@gmail.com` or `joe@example.com`.

379

#

380

#

381

# * `serviceAccount:{emailid}`: An email address that represents a service

382

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

383

#

384

# * `group:{emailid}`: An email address that represents a Google group.

385

# For example, `admins@example.com`.

386

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

387

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

388

# * `domain:{domain}`: A Google Apps domain name that represents all the

389

# users of that domain. For example, `google.com` or `example.com`.

390

#

391

"A String",

392

],

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

393

"condition": { # Represents an expression text. Example: # The condition that is associated with this binding.

394

# NOTE: an unsatisfied condition will not allow user access via current

395

# binding. Different bindings, including their conditions, are examined

396

# independently.

397

# This field is GOOGLE_INTERNAL.

398

#

399

# title: "User account presence"

400

# description: "Determines whether the request has a user account"

401

# expression: "size(request.user) > 0"

402

"location": "A String", # An optional string indicating the location of the expression for error

403

# reporting, e.g. a file name and a position in the file.

404

"expression": "A String", # Textual representation of an expression in

405

# [Common Expression Language](http://go/api-expr) syntax.

406

#

407

# The application context of the containing message determines which

408

# well-known feature set of CEL is supported.

409

"description": "A String", # An optional description of the expression. This is a longer text which

410

# describes the expression, e.g. when hovered over it in a UI.

411

"title": "A String", # An optional title for the expression, i.e. a short string describing

412

# its purpose. This can be used e.g. in UIs which allow to enter the

413

# expression.

414

},

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

415

},

416

],

417

"iamOwned": True or False,

}</pre>

</div>

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

422

<code class="details" id="list">list(parent, pageToken=None, x__xgafv=None, pageSize=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

<pre>Lists KeyRings.

Args:

parent: string, Required. The resource name of the location associated with the

427

KeyRings, in the format `projects/*/locations/*`. (required)

428

pageToken: string, Optional pagination token, returned earlier via

429

ListKeyRingsResponse.next_page_token.

430

x__xgafv: string, V1 error format.

431

Allowed values

432

1 - v1 error format

433

2 - v2 error format

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

434

pageSize: integer, Optional limit on the number of KeyRings to include in the

435

response. Further KeyRings can subsequently be obtained by

436

including the ListKeyRingsResponse.next_page_token in a subsequent

437

request. If unspecified, the server will pick an appropriate default.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

438

439

Returns:

440

An object of the form:

441

442

{ # Response message for KeyManagementService.ListKeyRings.

443

"nextPageToken": "A String", # A token to retrieve next page of results. Pass this value in

444

# ListKeyRingsRequest.page_token to retrieve the next page of results.

445

"totalSize": 42, # The total number of KeyRings that matched the query.

446

"keyRings": [ # The list of KeyRings.

447

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

448

"createTime": "A String", # Output only. The time at which this KeyRing was created.

449

"name": "A String", # Output only. The resource name for the KeyRing in the format

450

# `projects/*/locations/*/keyRings/*`.

},

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

458

<pre>Retrieves the next page of results.

459

460

Args:

461

previous_request: The request for the previous page. (required)

462

previous_response: The response from the request for the previous page. (required)

463

464

Returns:

465

A request object that you can call 'execute()' on to request the next

466

page. Returns None if there are no more items in the collection.

</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

471

<code class="details" id="setIamPolicy">setIamPolicy(resource, body, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

472

<pre>Sets the access control policy on the specified resource. Replaces any

existing policy.

Args:

resource: string, REQUIRED: The resource for which the policy is being specified.

477

See the operation documentation for the appropriate value for this field. (required)

478

body: object, The request body. (required)

479

The object takes the form of:

480

481

{ # Request message for `SetIamPolicy` method.

482

"policy": { # Defines an Identity and Access Management (IAM) policy. It is used to # REQUIRED: The complete policy to be applied to the `resource`. The size of

483

# the policy is limited to a few 10s of KB. An empty policy is a

484

# valid policy but certain Cloud Platform services (such as Projects)

485

# might reject them.

486

# specify access control policies for Cloud Platform resources.

487

#

488

#

489

# A `Policy` consists of a list of `bindings`. A `Binding` binds a list of

490

# `members` to a `role`, where the members can be user accounts, Google groups,

491

# Google domains, and service accounts. A `role` is a named list of permissions

# defined by IAM.

#

# **Example**

#

# {

# "bindings": [

# {

# "role": "roles/owner",

500

# "members": [

501

# "user:mike@example.com",

502

# "group:admins@example.com",

503

# "domain:google.com",

504

# "serviceAccount:my-other-app@appspot.gserviceaccount.com",

# ]

# },

# {

# "role": "roles/viewer",

509

# "members": ["user:sean@example.com"]

# }

# ]

# }

#

# For a description of IAM and its features, see the

515

# [IAM developer's guide](https://cloud.google.com/iam).

516

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

517

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

518

# The configuration determines which permission types are logged, and what

519

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

520

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

521

#

522

# If there are AuditConfigs for both `allServices` and a specific service,

523

# the union of the two AuditConfigs is used for that service: the log_types

524

# specified in each AuditConfig are enabled, and the exempted_members in each

525

# AuditConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

526

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

527

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

528

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

529

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

530

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

531

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

532

# "service": "allServices"

533

# "audit_log_configs": [

534

# {

535

# "log_type": "DATA_READ",

536

# "exempted_members": [

537

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

542

# },

543

# {

544

# "log_type": "ADMIN_READ",

545

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

546

# ]

547

# },

548

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

549

# "service": "fooservice.googleapis.com"

550

# "audit_log_configs": [

551

# {

552

# "log_type": "DATA_READ",

553

# },

554

# {

555

# "log_type": "DATA_WRITE",

556

# "exempted_members": [

557

# "user:bar@gmail.com"

558

# ]

559

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

564

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

565

# For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

566

# logging. It also exempts foo@gmail.com from DATA_READ logging, and

567

# bar@gmail.com from DATA_WRITE logging.

"exemptedMembers": [

"A String",

],

"auditLogConfigs": [ # The configuration for logging of each type of permission.

572

# Next ID: 4

573

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

578

# {

579

# "log_type": "DATA_READ",

580

# "exempted_members": [

581

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

591

# foo@gmail.com from DATA_READ logging.

592

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

593

# permission.

594

# Follows the same format of Binding.members.

595

"A String",

596

],

597

"logType": "A String", # The log type that this config enables.

598

},

599

],

600

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

601

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

602

# `allServices` is a special value that covers all services.

603

},

604

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

605

"rules": [ # If more than one rule is specified, the rules are applied in the following

606

# manner:

607

# - All matching LOG rules are always applied.

608

# - If any DENY/DENY_WITH_LOG rule matches, permission is denied.

609

# Logging will be applied if one or more matching rule requires logging.

610

# - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is

611

# granted.

612

# Logging will be applied if one or more matching rule requires logging.

613

# - Otherwise, if no rule applies, permission is denied.

614

{ # A rule to be applied in a Policy.

615

"notIn": [ # If one or more 'not_in' clauses are specified, the rule matches

616

# if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

617

# The format for in and not_in entries is the same as for members in a

618

# Binding (see google/iam/v1/policy.proto).

619

"A String",

620

],

621

"description": "A String", # Human-readable description of the rule.

622

"in": [ # If one or more 'in' clauses are specified, the rule matches if

623

# the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

624

"A String",

625

],

626

"action": "A String", # Required

627

"conditions": [ # Additional restrictions that must be met

628

{ # A condition to be met.

629

"iam": "A String", # Trusted attributes supplied by the IAM system.

630

"svc": "A String", # Trusted attributes discharged by the service.

631

"value": "A String", # DEPRECATED. Use 'values' instead.

632

"sys": "A String", # Trusted attributes supplied by any service that owns resources and uses

633

# the IAM system for access control.

634

"values": [ # The objects of the condition. This is mutually exclusive with 'value'.

635

"A String",

636

],

637

"op": "A String", # An operator to apply the subject with.

638

},

639

],

640

"logConfig": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries

641

# that match the LOG action.

642

{ # Specifies what kind of log the caller must write

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

643

"counter": { # Options for counters # Counter options.

644

"field": "A String", # The field value to attribute.

645

"metric": "A String", # The metric to update.

646

},

647

"dataAccess": { # Write a Data Access (Gin) log # Data access options.

648

},

649

"cloudAudit": { # Write a Cloud Audit log # Cloud audit options.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

650

"logName": "A String", # The log_name to populate in the Cloud Audit Record.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

},

},

],

"permissions": [ # A permission is a string of form '<service>.<resource type>.<verb>'

655

# (e.g., 'storage.buckets.list'). A value of '*' matches all permissions,

656

# and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

"A String",

],

},

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

661

"version": 42, # Version of the `Policy`. The default version is 0.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

662

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

663

# prevent simultaneous updates of a policy from overwriting each other.

664

# It is strongly suggested that systems make use of the `etag` in the

665

# read-modify-write cycle to perform policy updates in order to avoid race

666

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

667

# systems are expected to put that etag in the request to `setIamPolicy` to

668

# ensure that their change will be applied to the same version of the policy.

669

#

670

# If no `etag` is provided in the call to `setIamPolicy`, then the existing

671

# policy is overwritten blindly.

672

"bindings": [ # Associates a list of `members` to a `role`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

673

# `bindings` with no members will result in an error.

674

{ # Associates `members` with a `role`.

675

"role": "A String", # Role that is assigned to `members`.

676

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

677

# Required

678

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

679

# `members` can have the following values:

680

#

681

# * `allUsers`: A special identifier that represents anyone who is

682

# on the internet; with or without a Google account.

683

#

684

# * `allAuthenticatedUsers`: A special identifier that represents anyone

685

# who is authenticated with a Google account or a service account.

686

#

687

# * `user:{emailid}`: An email address that represents a specific Google

688

# account. For example, `alice@gmail.com` or `joe@example.com`.

689

#

690

#

691

# * `serviceAccount:{emailid}`: An email address that represents a service

692

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

693

#

694

# * `group:{emailid}`: An email address that represents a Google group.

695

# For example, `admins@example.com`.

696

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

697

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

698

# * `domain:{domain}`: A Google Apps domain name that represents all the

699

# users of that domain. For example, `google.com` or `example.com`.

700

#

701

"A String",

702

],

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

703

"condition": { # Represents an expression text. Example: # The condition that is associated with this binding.

704

# NOTE: an unsatisfied condition will not allow user access via current

705

# binding. Different bindings, including their conditions, are examined

706

# independently.

707

# This field is GOOGLE_INTERNAL.

708

#

709

# title: "User account presence"

710

# description: "Determines whether the request has a user account"

711

# expression: "size(request.user) > 0"

712

"location": "A String", # An optional string indicating the location of the expression for error

713

# reporting, e.g. a file name and a position in the file.

714

"expression": "A String", # Textual representation of an expression in

715

# [Common Expression Language](http://go/api-expr) syntax.

716

#

717

# The application context of the containing message determines which

718

# well-known feature set of CEL is supported.

719

"description": "A String", # An optional description of the expression. This is a longer text which

720

# describes the expression, e.g. when hovered over it in a UI.

721

"title": "A String", # An optional title for the expression, i.e. a short string describing

722

# its purpose. This can be used e.g. in UIs which allow to enter the

723

# expression.

724

},

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

725

},

726

],

727

"iamOwned": True or False,

728

},

729

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

730

# the fields in the mask will be modified. If no mask is provided, the

731

# following default mask is used:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

732

# paths: "bindings, etag"

733

# This field is only used by Cloud IAM.

734

}

735

736

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

743

744

{ # Defines an Identity and Access Management (IAM) policy. It is used to

745

# specify access control policies for Cloud Platform resources.

746

#

747

#

748

# A `Policy` consists of a list of `bindings`. A `Binding` binds a list of

749

# `members` to a `role`, where the members can be user accounts, Google groups,

750

# Google domains, and service accounts. A `role` is a named list of permissions

# defined by IAM.

#

# **Example**

#

# {

# "bindings": [

# {

# "role": "roles/owner",

759

# "members": [

760

# "user:mike@example.com",

761

# "group:admins@example.com",

762

# "domain:google.com",

763

# "serviceAccount:my-other-app@appspot.gserviceaccount.com",

# ]

# },

# {

# "role": "roles/viewer",

768

# "members": ["user:sean@example.com"]

# }

# ]

# }

#

# For a description of IAM and its features, see the

774

# [IAM developer's guide](https://cloud.google.com/iam).

775

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

776

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

777

# The configuration determines which permission types are logged, and what

778

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

779

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

780

#

781

# If there are AuditConfigs for both `allServices` and a specific service,

782

# the union of the two AuditConfigs is used for that service: the log_types

783

# specified in each AuditConfig are enabled, and the exempted_members in each

784

# AuditConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

785

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

786

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

787

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

788

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

789

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

790

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

791

# "service": "allServices"

792

# "audit_log_configs": [

793

# {

794

# "log_type": "DATA_READ",

795

# "exempted_members": [

796

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

801

# },

802

# {

803

# "log_type": "ADMIN_READ",

804

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

805

# ]

806

# },

807

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

808

# "service": "fooservice.googleapis.com"

809

# "audit_log_configs": [

810

# {

811

# "log_type": "DATA_READ",

812

# },

813

# {

814

# "log_type": "DATA_WRITE",

815

# "exempted_members": [

816

# "user:bar@gmail.com"

817

# ]

818

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

823

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

824

# For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

825

# logging. It also exempts foo@gmail.com from DATA_READ logging, and

826

# bar@gmail.com from DATA_WRITE logging.

"exemptedMembers": [

"A String",

],

"auditLogConfigs": [ # The configuration for logging of each type of permission.

831

# Next ID: 4

832

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

837

# {

838

# "log_type": "DATA_READ",

839

# "exempted_members": [

840

# "user:foo@gmail.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

850

# foo@gmail.com from DATA_READ logging.

851

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

852

# permission.

853

# Follows the same format of Binding.members.

854

"A String",

855

],

856

"logType": "A String", # The log type that this config enables.

857

},

858

],

859

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

860

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

861

# `allServices` is a special value that covers all services.

862

},

863

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

864

"rules": [ # If more than one rule is specified, the rules are applied in the following

865

# manner:

866

# - All matching LOG rules are always applied.

867

# - If any DENY/DENY_WITH_LOG rule matches, permission is denied.

868

# Logging will be applied if one or more matching rule requires logging.

869

# - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is

870

# granted.

871

# Logging will be applied if one or more matching rule requires logging.

872

# - Otherwise, if no rule applies, permission is denied.

873

{ # A rule to be applied in a Policy.

874

"notIn": [ # If one or more 'not_in' clauses are specified, the rule matches

875

# if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.

876

# The format for in and not_in entries is the same as for members in a

877

# Binding (see google/iam/v1/policy.proto).

878

"A String",

879

],

880

"description": "A String", # Human-readable description of the rule.

881

"in": [ # If one or more 'in' clauses are specified, the rule matches if

882

# the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

883

"A String",

884

],

885

"action": "A String", # Required

886

"conditions": [ # Additional restrictions that must be met

887

{ # A condition to be met.

888

"iam": "A String", # Trusted attributes supplied by the IAM system.

889

"svc": "A String", # Trusted attributes discharged by the service.

890

"value": "A String", # DEPRECATED. Use 'values' instead.

891

"sys": "A String", # Trusted attributes supplied by any service that owns resources and uses

892

# the IAM system for access control.

893

"values": [ # The objects of the condition. This is mutually exclusive with 'value'.

894

"A String",

895

],

896

"op": "A String", # An operator to apply the subject with.

897

},

898

],

899

"logConfig": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries

900

# that match the LOG action.

901

{ # Specifies what kind of log the caller must write

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

902

"counter": { # Options for counters # Counter options.

903

"field": "A String", # The field value to attribute.

904

"metric": "A String", # The metric to update.

905

},

906

"dataAccess": { # Write a Data Access (Gin) log # Data access options.

907

},

908

"cloudAudit": { # Write a Cloud Audit log # Cloud audit options.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

909

"logName": "A String", # The log_name to populate in the Cloud Audit Record.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

},

},

],

"permissions": [ # A permission is a string of form '<service>.<resource type>.<verb>'

914

# (e.g., 'storage.buckets.list'). A value of '*' matches all permissions,

915

# and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

"A String",

],

},

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

920

"version": 42, # Version of the `Policy`. The default version is 0.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

921

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

922

# prevent simultaneous updates of a policy from overwriting each other.

923

# It is strongly suggested that systems make use of the `etag` in the

924

# read-modify-write cycle to perform policy updates in order to avoid race

925

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

926

# systems are expected to put that etag in the request to `setIamPolicy` to

927

# ensure that their change will be applied to the same version of the policy.

928

#

929

# If no `etag` is provided in the call to `setIamPolicy`, then the existing

930

# policy is overwritten blindly.

931

"bindings": [ # Associates a list of `members` to a `role`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

932

# `bindings` with no members will result in an error.

933

{ # Associates `members` with a `role`.

934

"role": "A String", # Role that is assigned to `members`.

935

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

936

# Required

937

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

938

# `members` can have the following values:

939

#

940

# * `allUsers`: A special identifier that represents anyone who is

941

# on the internet; with or without a Google account.

942

#

943

# * `allAuthenticatedUsers`: A special identifier that represents anyone

944

# who is authenticated with a Google account or a service account.

945

#

946

# * `user:{emailid}`: An email address that represents a specific Google

947

# account. For example, `alice@gmail.com` or `joe@example.com`.

948

#

949

#

950

# * `serviceAccount:{emailid}`: An email address that represents a service

951

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

952

#

953

# * `group:{emailid}`: An email address that represents a Google group.

954

# For example, `admins@example.com`.

955

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

956

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

957

# * `domain:{domain}`: A Google Apps domain name that represents all the

958

# users of that domain. For example, `google.com` or `example.com`.

959

#

960

"A String",

961

],

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

962

"condition": { # Represents an expression text. Example: # The condition that is associated with this binding.

963

# NOTE: an unsatisfied condition will not allow user access via current

964

# binding. Different bindings, including their conditions, are examined

965

# independently.

966

# This field is GOOGLE_INTERNAL.

967

#

968

# title: "User account presence"

969

# description: "Determines whether the request has a user account"

970

# expression: "size(request.user) > 0"

971

"location": "A String", # An optional string indicating the location of the expression for error

972

# reporting, e.g. a file name and a position in the file.

973

"expression": "A String", # Textual representation of an expression in

974

# [Common Expression Language](http://go/api-expr) syntax.

975

#

976

# The application context of the containing message determines which

977

# well-known feature set of CEL is supported.

978

"description": "A String", # An optional description of the expression. This is a longer text which

979

# describes the expression, e.g. when hovered over it in a UI.

980

"title": "A String", # An optional title for the expression, i.e. a short string describing

981

# its purpose. This can be used e.g. in UIs which allow to enter the

982

# expression.

983

},

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

984

},

985

],

986

"iamOwned": True or False,

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

991

<code class="details" id="testIamPermissions">testIamPermissions(resource, body, x__xgafv=None)</code>

Sai Cheemalapati