Blame - docs/dyn/cloudiot_v1.projects.locations.registries.groups.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

86

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

87

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

88

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

89

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

90

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

91

<h3>Method Details</h3>

92

93

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

94

<pre>Gets the access control policy for a resource.

95

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

100

See the operation documentation for the appropriate value for this field. (required)

101

body: object, The request body.

102

The object takes the form of:

103

104

{ # Request message for `GetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

105

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

106

# `GetIamPolicy`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

107

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

108

#

109

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

110

# rejected.

111

#

112

# Requests for policies with any conditional bindings must specify version 3.

113

# Policies without any conditional bindings may specify any valid value or

114

# leave the field unset.

115

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

116

}

117

118

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

125

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

126

{ # An Identity and Access Management (IAM) policy, which specifies access

127

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

128

#

129

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

130

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

131

# `members` to a single `role`. Members can be user accounts, service accounts,

132

# Google groups, and domains (such as G Suite). A `role` is a named list of

133

# permissions; each `role` can be an IAM predefined role or a user-created

134

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

135

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

136

# Optionally, a `binding` can specify a `condition`, which is a logical

137

# expression that allows access to a resource only if the expression evaluates

138

# to `true`. A condition can add constraints based on attributes of the

139

# request, the resource, or both.

140

#

141

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

142

#

143

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

144

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

145

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

146

# "role": "roles/resourcemanager.organizationAdmin",

147

# "members": [

148

# "user:mike@example.com",

149

# "group:admins@example.com",

150

# "domain:google.com",

151

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

152

# ]

153

# },

154

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

155

# "role": "roles/resourcemanager.organizationViewer",

156

# "members": ["user:eve@example.com"],

157

# "condition": {

158

# "title": "expirable access",

159

# "description": "Does not grant access after Sep 2020",

160

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

161

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

162

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

163

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

164

# "etag": "BwWWja0YfJA=",

165

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

166

# }

167

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

168

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

173

# - group:admins@example.com

174

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

175

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

176

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

177

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

178

# - user:eve@example.com

179

# role: roles/resourcemanager.organizationViewer

180

# condition:

181

# title: expirable access

182

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

183

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

184

# - etag: BwWWja0YfJA=

185

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

186

#

187

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

188

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

189

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

190

# prevent simultaneous updates of a policy from overwriting each other.

191

# It is strongly suggested that systems make use of the `etag` in the

192

# read-modify-write cycle to perform policy updates in order to avoid race

193

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

194

# systems are expected to put that etag in the request to `setIamPolicy` to

195

# ensure that their change will be applied to the same version of the policy.

196

#

197

# **Important:** If you use IAM Conditions, you must include the `etag` field

198

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

199

# you to overwrite a version `3` policy with a version `1` policy, and all of

200

# the conditions in the version `3` policy are lost.

201

"version": 42, # Specifies the format of the policy.

202

#

203

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

204

# are rejected.

205

#

206

# Any operation that affects conditional role bindings must specify version

207

# `3`. This requirement applies to the following operations:

208

#

209

# * Getting a policy that includes a conditional role binding

210

# * Adding a conditional role binding to a policy

211

# * Changing a conditional role binding in a policy

212

# * Removing any role binding, with or without a condition, from a policy

213

# that includes conditions

214

#

215

# **Important:** If you use IAM Conditions, you must include the `etag` field

216

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

217

# you to overwrite a version `3` policy with a version `1` policy, and all of

218

# the conditions in the version `3` policy are lost.

219

#

220

# If a policy does not include any conditions, operations on that policy may

221

# specify any valid version or leave the field unset.

222

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

223

# `condition` that determines how and when the `bindings` are applied. Each

224

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

225

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

226

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

227

# `members` can have the following values:

228

#

229

# * `allUsers`: A special identifier that represents anyone who is

230

# on the internet; with or without a Google account.

231

#

232

# * `allAuthenticatedUsers`: A special identifier that represents anyone

233

# who is authenticated with a Google account or a service account.

234

#

235

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

236

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

237

#

238

#

239

# * `serviceAccount:{emailid}`: An email address that represents a service

240

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

241

#

242

# * `group:{emailid}`: An email address that represents a Google group.

243

# For example, `admins@example.com`.

244

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

245

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

246

# identifier) representing a user that has been recently deleted. For

247

# example, `alice@example.com?uid=123456789012345678901`. If the user is

248

# recovered, this value reverts to `user:{emailid}` and the recovered user

249

# retains the role in the binding.

250

#

251

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

252

# unique identifier) representing a service account that has been recently

253

# deleted. For example,

254

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

255

# If the service account is undeleted, this value reverts to

256

# `serviceAccount:{emailid}` and the undeleted service account retains the

257

# role in the binding.

258

#

259

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

260

# identifier) representing a Google group that has been recently

261

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

262

# the group is recovered, this value reverts to `group:{emailid}` and the

263

# recovered group retains the role in the binding.

264

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

265

#

266

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

267

# users of that domain. For example, `google.com` or `example.com`.

268

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

269

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

270

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

271

"role": "A String", # Role that is assigned to `members`.

272

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

273

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

274

# NOTE: An unsatisfied condition will not allow user access via current

275

# binding. Different bindings, including their conditions, are examined

276

# independently.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

277

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

278

# are documented at https://github.com/google/cel-spec.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

279

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

280

# Example (Comparison):

281

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

282

# title: "Summary size limit"

283

# description: "Determines if a summary is less than 100 chars"

284

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

285

#

286

# Example (Equality):

287

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

288

# title: "Requestor is owner"

289

# description: "Determines if requestor is the document owner"

290

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

291

#

292

# Example (Logic):

293

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

294

# title: "Public documents"

295

# description: "Determine whether the document should be publicly visible"

296

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

297

#

298

# Example (Data Manipulation):

299

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

300

# title: "Notification string"

301

# description: "Create a notification string with a timestamp."

302

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

303

#

304

# The exact variables and functions that may be referenced within an expression

305

# are determined by the service that evaluates it. See the service

306

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

307

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

308

# its purpose. This can be used e.g. in UIs which allow to enter the

309

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

310

"location": "A String", # Optional. String indicating the location of the expression for error

311

# reporting, e.g. a file name and a position in the file.

312

"description": "A String", # Optional. Description of the expression. This is a longer text which

313

# describes the expression, e.g. when hovered over it in a UI.

314

"expression": "A String", # Textual representation of an expression in Common Expression Language

315

# syntax.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

316

},

317

},

318

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

323

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

324

<pre>Sets the access control policy on the specified resource. Replaces any

existing policy.

Args:

resource: string, REQUIRED: The resource for which the policy is being specified.

329

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

330

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

331

The object takes the form of:

332

333

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

334

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

335

# the policy is limited to a few 10s of KB. An empty policy is a

336

# valid policy but certain Cloud Platform services (such as Projects)

337

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

338

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

339

#

340

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

341

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

342

# `members` to a single `role`. Members can be user accounts, service accounts,

343

# Google groups, and domains (such as G Suite). A `role` is a named list of

344

# permissions; each `role` can be an IAM predefined role or a user-created

345

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

346

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

347

# Optionally, a `binding` can specify a `condition`, which is a logical

348

# expression that allows access to a resource only if the expression evaluates

349

# to `true`. A condition can add constraints based on attributes of the

350

# request, the resource, or both.

351

#

352

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

353

#

354

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

355

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

356

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

357

# "role": "roles/resourcemanager.organizationAdmin",

358

# "members": [

359

# "user:mike@example.com",

360

# "group:admins@example.com",

361

# "domain:google.com",

362

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

363

# ]

364

# },

365

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

366

# "role": "roles/resourcemanager.organizationViewer",

367

# "members": ["user:eve@example.com"],

368

# "condition": {

369

# "title": "expirable access",

370

# "description": "Does not grant access after Sep 2020",

371

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

372

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

373

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

374

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

375

# "etag": "BwWWja0YfJA=",

376

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

377

# }

378

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

379

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

384

# - group:admins@example.com

385

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

386

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

387

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

388

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

389

# - user:eve@example.com

390

# role: roles/resourcemanager.organizationViewer

391

# condition:

392

# title: expirable access

393

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

394

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

# - etag: BwWWja0YfJA=

396

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

397

#

398

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

399

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

400

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

401

# prevent simultaneous updates of a policy from overwriting each other.

402

# It is strongly suggested that systems make use of the `etag` in the

403

# read-modify-write cycle to perform policy updates in order to avoid race

404

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

405

# systems are expected to put that etag in the request to `setIamPolicy` to

406

# ensure that their change will be applied to the same version of the policy.

407

#

408

# **Important:** If you use IAM Conditions, you must include the `etag` field

409

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

410

# you to overwrite a version `3` policy with a version `1` policy, and all of

411

# the conditions in the version `3` policy are lost.

412

"version": 42, # Specifies the format of the policy.

413

#

414

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

415

# are rejected.

416

#

417

# Any operation that affects conditional role bindings must specify version

418

# `3`. This requirement applies to the following operations:

419

#

420

# * Getting a policy that includes a conditional role binding

421

# * Adding a conditional role binding to a policy

422

# * Changing a conditional role binding in a policy

423

# * Removing any role binding, with or without a condition, from a policy

424

# that includes conditions

425

#

426

# **Important:** If you use IAM Conditions, you must include the `etag` field

427

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

428

# you to overwrite a version `3` policy with a version `1` policy, and all of

429

# the conditions in the version `3` policy are lost.

430

#

431

# If a policy does not include any conditions, operations on that policy may

432

# specify any valid version or leave the field unset.

433

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

434

# `condition` that determines how and when the `bindings` are applied. Each

435

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

436

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

437

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

438

# `members` can have the following values:

439

#

440

# * `allUsers`: A special identifier that represents anyone who is

441

# on the internet; with or without a Google account.

442

#

443

# * `allAuthenticatedUsers`: A special identifier that represents anyone

444

# who is authenticated with a Google account or a service account.

445

#

446

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

447

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

448

#

449

#

450

# * `serviceAccount:{emailid}`: An email address that represents a service

451

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

452

#

453

# * `group:{emailid}`: An email address that represents a Google group.

454

# For example, `admins@example.com`.

455

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

456

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

457

# identifier) representing a user that has been recently deleted. For

458

# example, `alice@example.com?uid=123456789012345678901`. If the user is

459

# recovered, this value reverts to `user:{emailid}` and the recovered user

460

# retains the role in the binding.

461

#

462

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

463

# unique identifier) representing a service account that has been recently

464

# deleted. For example,

465

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

466

# If the service account is undeleted, this value reverts to

467

# `serviceAccount:{emailid}` and the undeleted service account retains the

468

# role in the binding.

469

#

470

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

471

# identifier) representing a Google group that has been recently

472

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

473

# the group is recovered, this value reverts to `group:{emailid}` and the

474

# recovered group retains the role in the binding.

475

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

476

#

477

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

478

# users of that domain. For example, `google.com` or `example.com`.

479

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

480

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

481

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

482

"role": "A String", # Role that is assigned to `members`.

483

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

484

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

485

# NOTE: An unsatisfied condition will not allow user access via current

486

# binding. Different bindings, including their conditions, are examined

487

# independently.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

488

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

489

# are documented at https://github.com/google/cel-spec.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

490

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

491

# Example (Comparison):

492

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

493

# title: "Summary size limit"

494

# description: "Determines if a summary is less than 100 chars"

495

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

496

#

497

# Example (Equality):

498

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

499

# title: "Requestor is owner"

500

# description: "Determines if requestor is the document owner"

501

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

502

#

503

# Example (Logic):

504

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

505

# title: "Public documents"

506

# description: "Determine whether the document should be publicly visible"

507

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

508

#

509

# Example (Data Manipulation):

510

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

511

# title: "Notification string"

512

# description: "Create a notification string with a timestamp."

513

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

514

#

515

# The exact variables and functions that may be referenced within an expression

516

# are determined by the service that evaluates it. See the service

517

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

518

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

519

# its purpose. This can be used e.g. in UIs which allow to enter the

520

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

521

"location": "A String", # Optional. String indicating the location of the expression for error

522

# reporting, e.g. a file name and a position in the file.

523

"description": "A String", # Optional. Description of the expression. This is a longer text which

524

# describes the expression, e.g. when hovered over it in a UI.

525

"expression": "A String", # Textual representation of an expression in Common Expression Language

526

# syntax.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

527

},

528

},

529

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

540

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

541

{ # An Identity and Access Management (IAM) policy, which specifies access

542

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

543

#

544

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

545

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

546

# `members` to a single `role`. Members can be user accounts, service accounts,

547

# Google groups, and domains (such as G Suite). A `role` is a named list of

548

# permissions; each `role` can be an IAM predefined role or a user-created

549

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

550

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

551

# Optionally, a `binding` can specify a `condition`, which is a logical

552

# expression that allows access to a resource only if the expression evaluates

553

# to `true`. A condition can add constraints based on attributes of the

554

# request, the resource, or both.

555

#

556

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

557

#

558

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

559

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

560

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

561

# "role": "roles/resourcemanager.organizationAdmin",

562

# "members": [

563

# "user:mike@example.com",

564

# "group:admins@example.com",

565

# "domain:google.com",

566

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

567

# ]

568

# },

569

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

570

# "role": "roles/resourcemanager.organizationViewer",

571

# "members": ["user:eve@example.com"],

572

# "condition": {

573

# "title": "expirable access",

574

# "description": "Does not grant access after Sep 2020",

575

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

576

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

577

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

578

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

579

# "etag": "BwWWja0YfJA=",

580

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

581

# }

582

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

583

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

588

# - group:admins@example.com

589

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

590

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

591

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

592

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

593

# - user:eve@example.com

594

# role: roles/resourcemanager.organizationViewer

595

# condition:

596

# title: expirable access

597

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

598

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

599

# - etag: BwWWja0YfJA=

600

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

601

#

602

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

603

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

604

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

605

# prevent simultaneous updates of a policy from overwriting each other.

606

# It is strongly suggested that systems make use of the `etag` in the

607

# read-modify-write cycle to perform policy updates in order to avoid race

608

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

609

# systems are expected to put that etag in the request to `setIamPolicy` to

610

# ensure that their change will be applied to the same version of the policy.

611

#

612

# **Important:** If you use IAM Conditions, you must include the `etag` field

613

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

614

# you to overwrite a version `3` policy with a version `1` policy, and all of

615

# the conditions in the version `3` policy are lost.

616

"version": 42, # Specifies the format of the policy.

617

#

618

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

619

# are rejected.

620

#

621

# Any operation that affects conditional role bindings must specify version

622

# `3`. This requirement applies to the following operations:

623

#

624

# * Getting a policy that includes a conditional role binding

625

# * Adding a conditional role binding to a policy

626

# * Changing a conditional role binding in a policy

627

# * Removing any role binding, with or without a condition, from a policy

628

# that includes conditions

629

#

630

# **Important:** If you use IAM Conditions, you must include the `etag` field

631

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

632

# you to overwrite a version `3` policy with a version `1` policy, and all of

633

# the conditions in the version `3` policy are lost.

634

#

635

# If a policy does not include any conditions, operations on that policy may

636

# specify any valid version or leave the field unset.

637

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

638

# `condition` that determines how and when the `bindings` are applied. Each

639

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

640

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

641

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

642

# `members` can have the following values:

643

#

644

# * `allUsers`: A special identifier that represents anyone who is

645

# on the internet; with or without a Google account.

646

#

647

# * `allAuthenticatedUsers`: A special identifier that represents anyone

648

# who is authenticated with a Google account or a service account.

649

#

650

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

651

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

652

#

653

#

654

# * `serviceAccount:{emailid}`: An email address that represents a service

655

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

656

#

657

# * `group:{emailid}`: An email address that represents a Google group.

658

# For example, `admins@example.com`.

659

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

660

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

661

# identifier) representing a user that has been recently deleted. For

662

# example, `alice@example.com?uid=123456789012345678901`. If the user is

663

# recovered, this value reverts to `user:{emailid}` and the recovered user

664

# retains the role in the binding.

665

#

666

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

667

# unique identifier) representing a service account that has been recently

668

# deleted. For example,

669

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

670

# If the service account is undeleted, this value reverts to

671

# `serviceAccount:{emailid}` and the undeleted service account retains the

672

# role in the binding.

673

#

674

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

675

# identifier) representing a Google group that has been recently

676

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

677

# the group is recovered, this value reverts to `group:{emailid}` and the

678

# recovered group retains the role in the binding.

679

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

680

#

681

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

682

# users of that domain. For example, `google.com` or `example.com`.

683

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

684

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

685

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

686

"role": "A String", # Role that is assigned to `members`.

687

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

688

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

689

# NOTE: An unsatisfied condition will not allow user access via current

690

# binding. Different bindings, including their conditions, are examined

691

# independently.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

692

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

693

# are documented at https://github.com/google/cel-spec.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

694

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

695

# Example (Comparison):

696

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

697

# title: "Summary size limit"

698

# description: "Determines if a summary is less than 100 chars"

699

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

700

#

701

# Example (Equality):

702

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

703

# title: "Requestor is owner"

704

# description: "Determines if requestor is the document owner"

705

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

706

#

707

# Example (Logic):

708

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

709

# title: "Public documents"

710

# description: "Determine whether the document should be publicly visible"

711

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

712

#

713

# Example (Data Manipulation):

714

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

715

# title: "Notification string"

716

# description: "Create a notification string with a timestamp."

717

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

718

#

719

# The exact variables and functions that may be referenced within an expression

720

# are determined by the service that evaluates it. See the service

721

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

722

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

723

# its purpose. This can be used e.g. in UIs which allow to enter the

724

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

725

"location": "A String", # Optional. String indicating the location of the expression for error

726

# reporting, e.g. a file name and a position in the file.

727

"description": "A String", # Optional. Description of the expression. This is a longer text which

728

# describes the expression, e.g. when hovered over it in a UI.

729

"expression": "A String", # Textual representation of an expression in Common Expression Language

730

# syntax.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

731

},

732

},

733

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

738

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

739

<pre>Returns permissions that a caller has on the specified resource.

740

If the resource does not exist, this will return an empty set of

741

permissions, not a NOT_FOUND error.

742

743

Args:

744

resource: string, REQUIRED: The resource for which the policy detail is being requested.

745

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

746

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

747

The object takes the form of:

748

749

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

750

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

751

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

752

# information see

753

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

754

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

765

766

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

767

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

768

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

769

"A String",

Bu Sun Kim