Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / c72efbc6b71c963997c5728d471c04ab33d95e4f / . / docs / dyn / cloudresourcemanager_v1.projects.html
blob: 5675bb0222106d2378cc87178d51f8c2fde141f8 [file] [log] [blame]
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]75<h1><a href="cloudresourcemanager_v1.html">Cloud Resource Manager API</a> . <a href="cloudresourcemanager_v1.projects.html">projects</a></h1>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]76<h2>Instance Methods</h2>
77<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]78 <code><a href="#clearOrgPolicy">clearOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]79<p class="firstline">Clears a `Policy` from a resource.</p>
80<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]81 <code><a href="#create">create(body=None, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]82<p class="firstline">Request that a new Project be created. The result is an Operation which</p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]83<p class="toc_element">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]84 <code><a href="#delete">delete(projectId, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]85<p class="firstline">Marks the Project identified by the specified</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]86<p class="toc_element">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]87 <code><a href="#get">get(projectId, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]88<p class="firstline">Retrieves the Project identified by the specified</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]89<p class="toc_element">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]90 <code><a href="#getAncestry">getAncestry(projectId, body=None, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]91<p class="firstline">Gets a list of ancestors in the resource hierarchy for the Project</p>
92<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]93 <code><a href="#getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]94<p class="firstline">Gets the effective `Policy` on a resource. This is the result of merging</p>
95<p class="toc_element">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]96 <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]97<p class="firstline">Returns the IAM access control policy for the specified Project.</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]98<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]99 <code><a href="#getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]100<p class="firstline">Gets a `Policy` on a resource.</p>
101<p class="toc_element">
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]102 <code><a href="#list">list(pageToken=None, pageSize=None, filter=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]103<p class="firstline">Lists Projects that the caller has the `resourcemanager.projects.get`</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]104<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]105 <code><a href="#listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]106<p class="firstline">Lists `Constraints` that could be applied on the specified resource.</p>
107<p class="toc_element">
108 <code><a href="#listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</a></code></p>
109<p class="firstline">Retrieves the next page of results.</p>
110<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]111 <code><a href="#listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]112<p class="firstline">Lists all the `Policies` set for a particular resource.</p>
113<p class="toc_element">
114 <code><a href="#listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</a></code></p>
115<p class="firstline">Retrieves the next page of results.</p>
116<p class="toc_element">
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]117 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
118<p class="firstline">Retrieves the next page of results.</p>
119<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]120 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]121<p class="firstline">Sets the IAM access control policy for the specified Project. Overwrites</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]122<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]123 <code><a href="#setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]124<p class="firstline">Updates the specified `Policy` on the resource. Creates a new `Policy` for</p>
125<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]126 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]127<p class="firstline">Returns permissions that a caller has on the specified Project.</p>
128<p class="toc_element">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]129 <code><a href="#undelete">undelete(projectId, body=None, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]130<p class="firstline">Restores the Project identified by the specified</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]131<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]132 <code><a href="#update">update(projectId, body=None, x__xgafv=None)</a></code></p>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]133<p class="firstline">Updates the attributes of the Project identified by the specified</p>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]134<h3>Method Details</h3>
135<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]136 <code class="details" id="clearOrgPolicy">clearOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]137 <pre>Clears a `Policy` from a resource.
138
139Args:
140 resource: string, Name of the resource for the `Policy` to clear. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]141 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]142 The object takes the form of:
143
144{ # The request sent to the ClearOrgPolicy method.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]145 &quot;constraint&quot;: &quot;A String&quot;, # Name of the `Constraint` of the `Policy` to clear.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]146 &quot;etag&quot;: &quot;A String&quot;, # The current version, for concurrency control. Not sending an `etag`
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]147 # will cause the `Policy` to be cleared blindly.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]148 }
149
150 x__xgafv: string, V1 error format.
151 Allowed values
152 1 - v1 error format
153 2 - v2 error format
154
155Returns:
156 An object of the form:
157
158 { # A generic empty message that you can re-use to avoid defining duplicated
159 # empty messages in your APIs. A typical example is to use it as the request
160 # or the response type of an API method. For instance:
161 #
162 # service Foo {
163 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
164 # }
165 #
166 # The JSON representation for `Empty` is empty JSON object `{}`.
167 }</pre>
168</div>
169
170<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]171 <code class="details" id="create">create(body=None, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]172 <pre>Request that a new Project be created. The result is an Operation which
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]173can be used to track the creation process. This process usually takes a few
174seconds, but can sometimes take much longer. The tracking Operation is
175automatically deleted after a few hours, so there is no need to call
176DeleteOperation.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]177
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]178Authorization requires the Google IAM permission
179`resourcemanager.projects.create` on the specified parent for the new
180project. The parent is identified by a specified ResourceId,
181which must include both an ID and a type, such as organization.
182
183This method does not associate the new project with a billing account.
184You can set or update the billing account associated with a project using
185the [`projects.updateBillingInfo`]
186(/billing/reference/rest/v1/projects/updateBillingInfo) method.
187
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]188Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]189 body: object, The request body.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]190 The object takes the form of:
191
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]192{ # A Project is a high-level Google Cloud Platform entity. It is a
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]193 # container for ACLs, APIs, App Engine Apps, VMs, and other
194 # Google Cloud Platform resources.
195 &quot;name&quot;: &quot;A String&quot;, # The optional user-assigned display name of the Project.
196 # When present it must be between 4 to 30 characters.
197 # Allowed characters are: lowercase and uppercase letters, numbers,
198 # hyphen, single-quote, double-quote, space, and exclamation point.
199 #
200 # Example: &lt;code&gt;My Project&lt;/code&gt;
201 # Read-write.
202 &quot;projectId&quot;: &quot;A String&quot;, # The unique, user-assigned ID of the Project.
203 # It must be 6 to 30 lowercase letters, digits, or hyphens.
204 # It must start with a letter.
205 # Trailing hyphens are prohibited.
206 #
207 # Example: &lt;code&gt;tokyo-rain-123&lt;/code&gt;
208 # Read-only after creation.
209 &quot;lifecycleState&quot;: &quot;A String&quot;, # The Project lifecycle state.
210 #
211 # Read-only.
212 &quot;projectNumber&quot;: &quot;A String&quot;, # The number uniquely identifying the project.
213 #
214 # Example: &lt;code&gt;415104041262&lt;/code&gt;
215 # Read-only.
216 &quot;parent&quot;: { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.
217 #
218 # Supported parent types include &quot;organization&quot; and &quot;folder&quot;. Once set, the
219 # parent cannot be cleared. The `parent` can be set on creation or using the
220 # `UpdateProject` method; the end user must have the
221 # `resourcemanager.projects.create` permission on the parent.
222 #
223 # Read-write.
224 # Cloud Platform is a generic term for something you (a developer) may want to
225 # interact with through one of our API&#x27;s. Some examples are an App Engine app,
226 # a Compute Engine instance, a Cloud SQL database, and so on.
227 &quot;type&quot;: &quot;A String&quot;, # Required field representing the resource type this id is for.
228 # At present, the valid types are: &quot;organization&quot;, &quot;folder&quot;, and &quot;project&quot;.
229 &quot;id&quot;: &quot;A String&quot;, # Required field for the type-specific id. This should correspond to the id
230 # used in the type-specific API&#x27;s.
231 },
232 &quot;createTime&quot;: &quot;A String&quot;, # Creation time.
233 #
234 # Read-only.
235 &quot;labels&quot;: { # The labels associated with this Project.
236 #
237 # Label keys must be between 1 and 63 characters long and must conform
238 # to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.
239 #
240 # Label values must be between 0 and 63 characters long and must conform
241 # to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label
242 # value can be empty.
243 #
244 # No more than 256 labels can be associated with a given resource.
245 #
246 # Clients should store labels in a representation such as JSON that does not
247 # depend on specific characters being disallowed.
248 #
249 # Example: &lt;code&gt;&quot;environment&quot; : &quot;dev&quot;&lt;/code&gt;
250 # Read-write.
251 &quot;a_key&quot;: &quot;A String&quot;,
252 },
253 }
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]254
255 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]256 Allowed values
257 1 - v1 error format
258 2 - v2 error format
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]259
260Returns:
261 An object of the form:
262
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]263 { # This resource represents a long-running operation that is the result of a
264 # network API call.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]265 &quot;metadata&quot;: { # Service-specific metadata associated with the operation. It typically
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]266 # contains progress information and common metadata such as create time.
267 # Some services might not provide such metadata. Any method that returns a
268 # long-running operation should document the metadata type, if any.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]269 &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]270 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]271 &quot;done&quot;: True or False, # If the value is `false`, it means the operation is still in progress.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]272 # If `true`, the operation is completed, and either `error` or `response` is
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]273 # available.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]274 &quot;response&quot;: { # The normal response of the operation in case of success. If the original
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]275 # method returns no data on success, such as `Delete`, the response is
276 # `google.protobuf.Empty`. If the original method is standard
277 # `Get`/`Create`/`Update`, the response should be the resource. For other
278 # methods, the response should have the type `XxxResponse`, where `Xxx`
279 # is the original method name. For example, if the original method name
280 # is `TakeSnapshot()`, the inferred response type is
281 # `TakeSnapshotResponse`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]282 &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]283 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]284 &quot;name&quot;: &quot;A String&quot;, # The server-assigned name, which is only unique within the same service that
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]285 # originally returns it. If you use the default HTTP mapping, the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]286 # `name` should be a resource name ending with `operations/{unique_id}`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]287 &quot;error&quot;: { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
288 # different programming environments, including REST APIs and RPC APIs. It is
289 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
290 # three pieces of data: error code, error message, and error details.
291 #
292 # You can find out more about this error model and how to work with it in the
293 # [API Design Guide](https://cloud.google.com/apis/design/errors).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]294 &quot;message&quot;: &quot;A String&quot;, # A developer-facing error message, which should be in English. Any
295 # user-facing error message should be localized and sent in the
296 # google.rpc.Status.details field, or localized by the client.
297 &quot;details&quot;: [ # A list of messages that carry the error details. There is a common set of
298 # message types for APIs to use.
299 {
300 &quot;a_key&quot;: &quot;&quot;, # Properties of the object. Contains field @type with type URL.
301 },
302 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]303 &quot;code&quot;: 42, # The status code, which should be an enum value of google.rpc.Code.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]304 },
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]305 }</pre>
306</div>
307
308<div class="method">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]309 <code class="details" id="delete">delete(projectId, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]310 <pre>Marks the Project identified by the specified
311`project_id` (for example, `my-project-123`) for deletion.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]312This method will only affect the Project if it has a lifecycle state of
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]313ACTIVE.
314
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]315This method changes the Project&#x27;s lifecycle state from
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]316ACTIVE
317to DELETE_REQUESTED.
318The deletion starts at an unspecified time,
319at which point the Project is no longer accessible.
320
321Until the deletion completes, you can check the lifecycle state
322checked by retrieving the Project with GetProject,
323and the Project remains visible to ListProjects.
324However, you cannot update the project.
325
326After the deletion completes, the Project is not retrievable by
327the GetProject and
328ListProjects methods.
329
330The caller must have modify permissions for this Project.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]331
332Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]333 projectId: string, The Project ID (for example, `foo-bar-123`).
334
335Required. (required)
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]336 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]337 Allowed values
338 1 - v1 error format
339 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]340
341Returns:
342 An object of the form:
343
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]344 { # A generic empty message that you can re-use to avoid defining duplicated
345 # empty messages in your APIs. A typical example is to use it as the request
346 # or the response type of an API method. For instance:
347 #
348 # service Foo {
349 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
350 # }
351 #
352 # The JSON representation for `Empty` is empty JSON object `{}`.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]353 }</pre>
354</div>
355
356<div class="method">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]357 <code class="details" id="get">get(projectId, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]358 <pre>Retrieves the Project identified by the specified
359`project_id` (for example, `my-project-123`).
360
361The caller must have read permissions for this Project.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]362
363Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]364 projectId: string, The Project ID (for example, `my-project-123`).
365
366Required. (required)
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]367 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]368 Allowed values
369 1 - v1 error format
370 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]371
372Returns:
373 An object of the form:
374
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]375 { # A Project is a high-level Google Cloud Platform entity. It is a
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]376 # container for ACLs, APIs, App Engine Apps, VMs, and other
377 # Google Cloud Platform resources.
378 &quot;name&quot;: &quot;A String&quot;, # The optional user-assigned display name of the Project.
379 # When present it must be between 4 to 30 characters.
380 # Allowed characters are: lowercase and uppercase letters, numbers,
381 # hyphen, single-quote, double-quote, space, and exclamation point.
382 #
383 # Example: &lt;code&gt;My Project&lt;/code&gt;
384 # Read-write.
385 &quot;projectId&quot;: &quot;A String&quot;, # The unique, user-assigned ID of the Project.
386 # It must be 6 to 30 lowercase letters, digits, or hyphens.
387 # It must start with a letter.
388 # Trailing hyphens are prohibited.
389 #
390 # Example: &lt;code&gt;tokyo-rain-123&lt;/code&gt;
391 # Read-only after creation.
392 &quot;lifecycleState&quot;: &quot;A String&quot;, # The Project lifecycle state.
393 #
394 # Read-only.
395 &quot;projectNumber&quot;: &quot;A String&quot;, # The number uniquely identifying the project.
396 #
397 # Example: &lt;code&gt;415104041262&lt;/code&gt;
398 # Read-only.
399 &quot;parent&quot;: { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.
400 #
401 # Supported parent types include &quot;organization&quot; and &quot;folder&quot;. Once set, the
402 # parent cannot be cleared. The `parent` can be set on creation or using the
403 # `UpdateProject` method; the end user must have the
404 # `resourcemanager.projects.create` permission on the parent.
405 #
406 # Read-write.
407 # Cloud Platform is a generic term for something you (a developer) may want to
408 # interact with through one of our API&#x27;s. Some examples are an App Engine app,
409 # a Compute Engine instance, a Cloud SQL database, and so on.
410 &quot;type&quot;: &quot;A String&quot;, # Required field representing the resource type this id is for.
411 # At present, the valid types are: &quot;organization&quot;, &quot;folder&quot;, and &quot;project&quot;.
412 &quot;id&quot;: &quot;A String&quot;, # Required field for the type-specific id. This should correspond to the id
413 # used in the type-specific API&#x27;s.
414 },
415 &quot;createTime&quot;: &quot;A String&quot;, # Creation time.
416 #
417 # Read-only.
418 &quot;labels&quot;: { # The labels associated with this Project.
419 #
420 # Label keys must be between 1 and 63 characters long and must conform
421 # to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.
422 #
423 # Label values must be between 0 and 63 characters long and must conform
424 # to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label
425 # value can be empty.
426 #
427 # No more than 256 labels can be associated with a given resource.
428 #
429 # Clients should store labels in a representation such as JSON that does not
430 # depend on specific characters being disallowed.
431 #
432 # Example: &lt;code&gt;&quot;environment&quot; : &quot;dev&quot;&lt;/code&gt;
433 # Read-write.
434 &quot;a_key&quot;: &quot;A String&quot;,
435 },
436 }</pre>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]437</div>
438
439<div class="method">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]440 <code class="details" id="getAncestry">getAncestry(projectId, body=None, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]441 <pre>Gets a list of ancestors in the resource hierarchy for the Project
442identified by the specified `project_id` (for example, `my-project-123`).
443
444The caller must have read permissions for this Project.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]445
446Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]447 projectId: string, The Project ID (for example, `my-project-123`).
448
449Required. (required)
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]450 body: object, The request body.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]451 The object takes the form of:
452
453{ # The request sent to the
454 # GetAncestry
455 # method.
456 }
457
458 x__xgafv: string, V1 error format.
459 Allowed values
460 1 - v1 error format
461 2 - v2 error format
462
463Returns:
464 An object of the form:
465
466 { # Response from the GetAncestry method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]467 &quot;ancestor&quot;: [ # Ancestors are ordered from bottom to top of the resource hierarchy. The
468 # first ancestor is the project itself, followed by the project&#x27;s parent,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]469 # etc..
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]470 { # Identifying information for a single ancestor of a project.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]471 &quot;resourceId&quot;: { # A container to reference an id for any resource type. A `resource` in Google # Resource id of the ancestor.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]472 # Cloud Platform is a generic term for something you (a developer) may want to
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]473 # interact with through one of our API&#x27;s. Some examples are an App Engine app,
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]474 # a Compute Engine instance, a Cloud SQL database, and so on.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]475 &quot;type&quot;: &quot;A String&quot;, # Required field representing the resource type this id is for.
476 # At present, the valid types are: &quot;organization&quot;, &quot;folder&quot;, and &quot;project&quot;.
477 &quot;id&quot;: &quot;A String&quot;, # Required field for the type-specific id. This should correspond to the id
478 # used in the type-specific API&#x27;s.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]479 },
480 },
481 ],
482 }</pre>
483</div>
484
485<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]486 <code class="details" id="getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]487 <pre>Gets the effective `Policy` on a resource. This is the result of merging
488`Policies` in the resource hierarchy. The returned `Policy` will not have
489an `etag`set because it is a computed `Policy` across multiple resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]490Subtrees of Resource Manager resource hierarchy with &#x27;under:&#x27; prefix will
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]491not be expanded.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]492
493Args:
494 resource: string, The name of the resource to start computing the effective `Policy`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]495 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]496 The object takes the form of:
497
498{ # The request sent to the GetEffectiveOrgPolicy method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]499 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` to compute the effective `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]500 }
501
502 x__xgafv: string, V1 error format.
503 Allowed values
504 1 - v1 error format
505 2 - v2 error format
506
507Returns:
508 An object of the form:
509
510 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
511 # for configurations of Cloud Platform resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]512 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]513 # resource.
514 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]515 # `ListPolicy` can define specific values and subtrees of Cloud Resource
516 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
517 # are allowed or denied by setting the `allowed_values` and `denied_values`
518 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
519 # The `under:` prefix is used to denote resource subtree values.
520 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]521 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]522 # same as values with no prefix.
523 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]524 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
525 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
526 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]527 # The `supports_under` field of the associated `Constraint` defines whether
528 # ancestry prefixes can be used. You can set `allowed_values` and
529 # `denied_values` in the same `Policy` if `all_values` is
530 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
531 # values. If `all_values` is set to either `ALLOW` or `DENY`,
532 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]533 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]534 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]535 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]536 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]537 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]538 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
539 # that matches the value specified in this `Policy`. If `suggested_value`
540 # is not set, it will inherit the value specified higher in the hierarchy,
541 # unless `inherit_from_parent` is `false`.
542 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]543 #
544 # By default, a `ListPolicy` set at a resource supercedes any `Policy` set
545 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
546 # set to `true`, then the values from the effective `Policy` of the parent
547 # resource are inherited, meaning the values set in this `Policy` are
548 # added to the values inherited up the hierarchy.
549 #
550 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]551 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]552 # simple and understandable. However, it is possible to set a `Policy` with
553 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
554 # In this case, the values that are allowed must be in `allowed_values` and
555 # not present in `denied_values`.
556 #
557 # For example, suppose you have a `Constraint`
558 # `constraints/serviceuser.services`, which has a `constraint_type` of
559 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
560 # Suppose that at the Organization level, a `Policy` is applied that
561 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
562 # `Policy` is applied to a project below the Organization that has
563 # `inherit_from_parent` set to `false` and field all_values set to DENY,
564 # then an attempt to activate any API will be denied.
565 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]566 # The following examples demonstrate different possible layerings for
567 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]568 #
569 # Example 1 (no inherited values):
570 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]571 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]572 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]573 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]574 # The accepted values at `organizations/foo` are `E1`, `E2`.
575 # The accepted values at `projects/bar` are `E3`, and `E4`.
576 #
577 # Example 2 (inherited values):
578 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]579 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]580 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]581 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]582 # The accepted values at `organizations/foo` are `E1`, `E2`.
583 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
584 #
585 # Example 3 (inheriting both allowed and denied values):
586 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]587 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]588 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]589 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]590 # The accepted values at `organizations/foo` are `E1`, `E2`.
591 # The value accepted at `projects/bar` is `E2`.
592 #
593 # Example 4 (RestoreDefault):
594 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]595 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]596 # `projects/bar` has a `Policy` with values:
597 # {RestoreDefault: {}}
598 # The accepted values at `organizations/foo` are `E1`, `E2`.
599 # The accepted values at `projects/bar` are either all or none depending on
600 # the value of `constraint_default` (if `ALLOW`, all; if
601 # `DENY`, none).
602 #
603 # Example 5 (no policy inherits parent policy):
604 # `organizations/foo` has no `Policy` set.
605 # `projects/bar` has no `Policy` set.
606 # The accepted values at both levels are either all or none depending on
607 # the value of `constraint_default` (if `ALLOW`, all; if
608 # `DENY`, none).
609 #
610 # Example 6 (ListConstraint allowing all):
611 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]612 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]613 # `projects/bar` has a `Policy` with:
614 # {all: ALLOW}
615 # The accepted values at `organizations/foo` are `E1`, E2`.
616 # Any value is accepted at `projects/bar`.
617 #
618 # Example 7 (ListConstraint allowing none):
619 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]620 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]621 # `projects/bar` has a `Policy` with:
622 # {all: DENY}
623 # The accepted values at `organizations/foo` are `E1`, E2`.
624 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]625 #
626 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
627 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]628 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]629 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]630 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]631 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]632 # {allowed_values: &quot;under:projects/P3&quot;}
633 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]634 # The accepted values at `organizations/foo` are `organizations/O1`,
635 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
636 # `projects/P3`.
637 # The accepted values at `projects/bar` are `organizations/O1`,
638 # `folders/F1`, `projects/P1`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]639 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]640 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]641 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]642 ],
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]643 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]644 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
645 # concurrency control.
646 #
647 # When the `Policy` is returned from either a `GetPolicy` or a
648 # `ListOrgPolicy` request, this `etag` indicates the version of the current
649 # `Policy` to use when executing a read-modify-write loop.
650 #
651 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
652 # `etag` will be unset.
653 #
654 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
655 # that was returned from a `GetOrgPolicy` request as part of a
656 # read-modify-write loop for concurrency control. Not setting the `etag`in a
657 # `SetOrgPolicy` request will result in an unconditional write of the
658 # `Policy`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]659 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]660 # resource.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]661 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]662 # configuration is acceptable.
663 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]664 # Suppose you have a `Constraint`
665 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
666 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
667 # behavior:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]668 # - If the `Policy` at this resource has enforced set to `false`, serial
669 # port connection attempts will be allowed.
670 # - If the `Policy` at this resource has enforced set to `true`, serial
671 # port connection attempts will be refused.
672 # - If the `Policy` at this resource is `RestoreDefault`, serial port
673 # connection attempts will be allowed.
674 # - If no `Policy` is set at this resource or anywhere higher in the
675 # resource hierarchy, serial port connection attempts will be allowed.
676 # - If no `Policy` is set at this resource, but one exists higher in the
677 # resource hierarchy, the behavior is as if the`Policy` were set at
678 # this resource.
679 #
680 # The following examples demonstrate the different possible layerings:
681 #
682 # Example 1 (nearest `Constraint` wins):
683 # `organizations/foo` has a `Policy` with:
684 # {enforced: false}
685 # `projects/bar` has no `Policy` set.
686 # The constraint at `projects/bar` and `organizations/foo` will not be
687 # enforced.
688 #
689 # Example 2 (enforcement gets replaced):
690 # `organizations/foo` has a `Policy` with:
691 # {enforced: false}
692 # `projects/bar` has a `Policy` with:
693 # {enforced: true}
694 # The constraint at `organizations/foo` is not enforced.
695 # The constraint at `projects/bar` is enforced.
696 #
697 # Example 3 (RestoreDefault):
698 # `organizations/foo` has a `Policy` with:
699 # {enforced: true}
700 # `projects/bar` has a `Policy` with:
701 # {RestoreDefault: {}}
702 # The constraint at `organizations/foo` is enforced.
703 # The constraint at `projects/bar` is not enforced, because
704 # `constraint_default` for the `Constraint` is `ALLOW`.
705 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]706 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
707 # `constraints/serviceuser.services`.
708 #
709 # Immutable after creation.
710 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
711 # server, not specified by the caller, and represents the last time a call to
712 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
713 # be ignored.
714 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
715 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
716 # `Constraint` type.
717 # `constraint_default` enforcement behavior of the specific `Constraint` at
718 # this resource.
719 #
720 # Suppose that `constraint_default` is set to `ALLOW` for the
721 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
722 # foo.com sets a `Policy` at their Organization resource node that restricts
723 # the allowed service activations to deny all service activations. They
724 # could then set a `Policy` with the `policy_type` `restore_default` on
725 # several experimental projects, restoring the `constraint_default`
726 # enforcement of the `Constraint` for only those projects, allowing those
727 # projects to have all services activated.
728 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]729 }</pre>
730</div>
731
732<div class="method">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]733 <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]734 <pre>Returns the IAM access control policy for the specified Project.
735Permission is denied if the policy or the resource does not exist.
736
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]737Authorization requires the Google IAM permission
738`resourcemanager.projects.getIamPolicy` on the project.
739
740For additional information about resource structure and identification,
741see [Resource Names](/apis/design/resource_names).
742
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]743Args:
744 resource: string, REQUIRED: The resource for which the policy is being requested.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]745See the operation documentation for the appropriate value for this field. (required)
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]746 body: object, The request body.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]747 The object takes the form of:
748
749{ # Request message for `GetIamPolicy` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]750 &quot;options&quot;: { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]751 # `GetIamPolicy`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]752 &quot;requestedPolicyVersion&quot;: 42, # Optional. The policy format version to be returned.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]753 #
754 # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
755 # rejected.
756 #
757 # Requests for policies with any conditional bindings must specify version 3.
758 # Policies without any conditional bindings may specify any valid value or
759 # leave the field unset.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]760 #
761 # To learn which resources support conditions in their IAM policies, see the
762 # [IAM
763 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]764 },
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]765 }
766
767 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]768 Allowed values
769 1 - v1 error format
770 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]771
772Returns:
773 An object of the form:
774
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]775 { # An Identity and Access Management (IAM) policy, which specifies access
776 # controls for Google Cloud resources.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]777 #
778 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]779 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
780 # `members` to a single `role`. Members can be user accounts, service accounts,
781 # Google groups, and domains (such as G Suite). A `role` is a named list of
782 # permissions; each `role` can be an IAM predefined role or a user-created
783 # custom role.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]784 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]785 # For some types of Google Cloud resources, a `binding` can also specify a
786 # `condition`, which is a logical expression that allows access to a resource
787 # only if the expression evaluates to `true`. A condition can add constraints
788 # based on attributes of the request, the resource, or both. To learn which
789 # resources support conditions in their IAM policies, see the
790 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]791 #
792 # **JSON example:**
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]793 #
794 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]795 # &quot;bindings&quot;: [
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]796 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]797 # &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;,
798 # &quot;members&quot;: [
799 # &quot;user:mike@example.com&quot;,
800 # &quot;group:admins@example.com&quot;,
801 # &quot;domain:google.com&quot;,
802 # &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot;
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]803 # ]
804 # },
805 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]806 # &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;,
807 # &quot;members&quot;: [
808 # &quot;user:eve@example.com&quot;
809 # ],
810 # &quot;condition&quot;: {
811 # &quot;title&quot;: &quot;expirable access&quot;,
812 # &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;,
813 # &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;,
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]814 # }
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]815 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]816 # ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]817 # &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;,
818 # &quot;version&quot;: 3
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]819 # }
820 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]821 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]822 #
823 # bindings:
824 # - members:
825 # - user:mike@example.com
826 # - group:admins@example.com
827 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]828 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
829 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]830 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]831 # - user:eve@example.com
832 # role: roles/resourcemanager.organizationViewer
833 # condition:
834 # title: expirable access
835 # description: Does not grant access after Sep 2020
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]836 # expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]837 # - etag: BwWWja0YfJA=
838 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]839 #
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]840 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]841 # [IAM documentation](https://cloud.google.com/iam/docs/).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]842 &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
843 # prevent simultaneous updates of a policy from overwriting each other.
844 # It is strongly suggested that systems make use of the `etag` in the
845 # read-modify-write cycle to perform policy updates in order to avoid race
846 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
847 # systems are expected to put that etag in the request to `setIamPolicy` to
848 # ensure that their change will be applied to the same version of the policy.
849 #
850 # **Important:** If you use IAM Conditions, you must include the `etag` field
851 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
852 # you to overwrite a version `3` policy with a version `1` policy, and all of
853 # the conditions in the version `3` policy are lost.
854 &quot;version&quot;: 42, # Specifies the format of the policy.
855 #
856 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
857 # are rejected.
858 #
859 # Any operation that affects conditional role bindings must specify version
860 # `3`. This requirement applies to the following operations:
861 #
862 # * Getting a policy that includes a conditional role binding
863 # * Adding a conditional role binding to a policy
864 # * Changing a conditional role binding in a policy
865 # * Removing any role binding, with or without a condition, from a policy
866 # that includes conditions
867 #
868 # **Important:** If you use IAM Conditions, you must include the `etag` field
869 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
870 # you to overwrite a version `3` policy with a version `1` policy, and all of
871 # the conditions in the version `3` policy are lost.
872 #
873 # If a policy does not include any conditions, operations on that policy may
874 # specify any valid version or leave the field unset.
875 #
876 # To learn which resources support conditions in their IAM policies, see the
877 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
878 &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
879 { # Specifies the audit configuration for a service.
880 # The configuration determines which permission types are logged, and what
881 # identities, if any, are exempted from logging.
882 # An AuditConfig must have one or more AuditLogConfigs.
883 #
884 # If there are AuditConfigs for both `allServices` and a specific service,
885 # the union of the two AuditConfigs is used for that service: the log_types
886 # specified in each AuditConfig are enabled, and the exempted_members in each
887 # AuditLogConfig are exempted.
888 #
889 # Example Policy with multiple AuditConfigs:
890 #
891 # {
892 # &quot;audit_configs&quot;: [
893 # {
894 # &quot;service&quot;: &quot;allServices&quot;
895 # &quot;audit_log_configs&quot;: [
896 # {
897 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
898 # &quot;exempted_members&quot;: [
899 # &quot;user:jose@example.com&quot;
900 # ]
901 # },
902 # {
903 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
904 # },
905 # {
906 # &quot;log_type&quot;: &quot;ADMIN_READ&quot;,
907 # }
908 # ]
909 # },
910 # {
911 # &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;
912 # &quot;audit_log_configs&quot;: [
913 # {
914 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
915 # },
916 # {
917 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
918 # &quot;exempted_members&quot;: [
919 # &quot;user:aliya@example.com&quot;
920 # ]
921 # }
922 # ]
923 # }
924 # ]
925 # }
926 #
927 # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
928 # logging. It also exempts jose@example.com from DATA_READ logging, and
929 # aliya@example.com from DATA_WRITE logging.
930 &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging.
931 # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
932 # `allServices` is a special value that covers all services.
933 &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
934 { # Provides the configuration for logging a type of permissions.
935 # Example:
936 #
937 # {
938 # &quot;audit_log_configs&quot;: [
939 # {
940 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
941 # &quot;exempted_members&quot;: [
942 # &quot;user:jose@example.com&quot;
943 # ]
944 # },
945 # {
946 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
947 # }
948 # ]
949 # }
950 #
951 # This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting
952 # jose@example.com from DATA_READ logging.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]953 &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of
954 # permission.
955 # Follows the same format of Binding.members.
956 &quot;A String&quot;,
957 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]958 &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]959 },
960 ],
961 },
962 ],
963 &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]964 # `condition` that determines how and when the `bindings` are applied. Each
965 # of the `bindings` must contain at least one member.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]966 { # Associates `members` with a `role`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]967 &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
968 #
969 # If the condition evaluates to `true`, then this binding applies to the
970 # current request.
971 #
972 # If the condition evaluates to `false`, then this binding does not apply to
973 # the current request. However, a different role binding might grant the same
974 # role to one or more of the members in this binding.
975 #
976 # To learn which resources support conditions in their IAM policies, see the
977 # [IAM
978 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
979 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
980 # are documented at https://github.com/google/cel-spec.
981 #
982 # Example (Comparison):
983 #
984 # title: &quot;Summary size limit&quot;
985 # description: &quot;Determines if a summary is less than 100 chars&quot;
986 # expression: &quot;document.summary.size() &lt; 100&quot;
987 #
988 # Example (Equality):
989 #
990 # title: &quot;Requestor is owner&quot;
991 # description: &quot;Determines if requestor is the document owner&quot;
992 # expression: &quot;document.owner == request.auth.claims.email&quot;
993 #
994 # Example (Logic):
995 #
996 # title: &quot;Public documents&quot;
997 # description: &quot;Determine whether the document should be publicly visible&quot;
998 # expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
999 #
1000 # Example (Data Manipulation):
1001 #
1002 # title: &quot;Notification string&quot;
1003 # description: &quot;Create a notification string with a timestamp.&quot;
1004 # expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
1005 #
1006 # The exact variables and functions that may be referenced within an expression
1007 # are determined by the service that evaluates it. See the service
1008 # documentation for additional information.
1009 &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
1010 # its purpose. This can be used e.g. in UIs which allow to enter the
1011 # expression.
1012 &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
1013 # reporting, e.g. a file name and a position in the file.
1014 &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
1015 # describes the expression, e.g. when hovered over it in a UI.
1016 &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
1017 # syntax.
1018 },
1019 &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1020 # `members` can have the following values:
1021 #
1022 # * `allUsers`: A special identifier that represents anyone who is
1023 # on the internet; with or without a Google account.
1024 #
1025 # * `allAuthenticatedUsers`: A special identifier that represents anyone
1026 # who is authenticated with a Google account or a service account.
1027 #
1028 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1029 # account. For example, `alice@example.com` .
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1030 #
1031 #
1032 # * `serviceAccount:{emailid}`: An email address that represents a service
1033 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
1034 #
1035 # * `group:{emailid}`: An email address that represents a Google group.
1036 # For example, `admins@example.com`.
1037 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1038 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
1039 # identifier) representing a user that has been recently deleted. For
1040 # example, `alice@example.com?uid=123456789012345678901`. If the user is
1041 # recovered, this value reverts to `user:{emailid}` and the recovered user
1042 # retains the role in the binding.
1043 #
1044 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
1045 # unique identifier) representing a service account that has been recently
1046 # deleted. For example,
1047 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
1048 # If the service account is undeleted, this value reverts to
1049 # `serviceAccount:{emailid}` and the undeleted service account retains the
1050 # role in the binding.
1051 #
1052 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
1053 # identifier) representing a Google group that has been recently
1054 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
1055 # the group is recovered, this value reverts to `group:{emailid}` and the
1056 # recovered group retains the role in the binding.
1057 #
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1058 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1059 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1060 # users of that domain. For example, `google.com` or `example.com`.
1061 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1062 &quot;A String&quot;,
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1063 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1064 &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
1065 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1066 },
1067 ],
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1068 }</pre>
1069</div>
1070
1071<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1072 <code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1073 <pre>Gets a `Policy` on a resource.
1074
1075If no `Policy` is set on the resource, a `Policy` is returned with default
1076values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The
1077`etag` value can be used with `SetOrgPolicy()` to create or update a
1078`Policy` during read-modify-write.
1079
1080Args:
1081 resource: string, Name of the resource the `Policy` is set on. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1082 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1083 The object takes the form of:
1084
1085{ # The request sent to the GetOrgPolicy method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1086 &quot;constraint&quot;: &quot;A String&quot;, # Name of the `Constraint` to get the `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1087 }
1088
1089 x__xgafv: string, V1 error format.
1090 Allowed values
1091 1 - v1 error format
1092 2 - v2 error format
1093
1094Returns:
1095 An object of the form:
1096
1097 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
1098 # for configurations of Cloud Platform resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1099 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1100 # resource.
1101 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1102 # `ListPolicy` can define specific values and subtrees of Cloud Resource
1103 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
1104 # are allowed or denied by setting the `allowed_values` and `denied_values`
1105 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
1106 # The `under:` prefix is used to denote resource subtree values.
1107 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1108 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1109 # same as values with no prefix.
1110 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1111 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
1112 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
1113 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1114 # The `supports_under` field of the associated `Constraint` defines whether
1115 # ancestry prefixes can be used. You can set `allowed_values` and
1116 # `denied_values` in the same `Policy` if `all_values` is
1117 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
1118 # values. If `all_values` is set to either `ALLOW` or `DENY`,
1119 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1120 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1121 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1122 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1123 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1124 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1125 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
1126 # that matches the value specified in this `Policy`. If `suggested_value`
1127 # is not set, it will inherit the value specified higher in the hierarchy,
1128 # unless `inherit_from_parent` is `false`.
1129 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1130 #
1131 # By default, a `ListPolicy` set at a resource supercedes any `Policy` set
1132 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
1133 # set to `true`, then the values from the effective `Policy` of the parent
1134 # resource are inherited, meaning the values set in this `Policy` are
1135 # added to the values inherited up the hierarchy.
1136 #
1137 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1138 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1139 # simple and understandable. However, it is possible to set a `Policy` with
1140 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
1141 # In this case, the values that are allowed must be in `allowed_values` and
1142 # not present in `denied_values`.
1143 #
1144 # For example, suppose you have a `Constraint`
1145 # `constraints/serviceuser.services`, which has a `constraint_type` of
1146 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
1147 # Suppose that at the Organization level, a `Policy` is applied that
1148 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
1149 # `Policy` is applied to a project below the Organization that has
1150 # `inherit_from_parent` set to `false` and field all_values set to DENY,
1151 # then an attempt to activate any API will be denied.
1152 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1153 # The following examples demonstrate different possible layerings for
1154 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1155 #
1156 # Example 1 (no inherited values):
1157 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1158 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1159 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1160 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1161 # The accepted values at `organizations/foo` are `E1`, `E2`.
1162 # The accepted values at `projects/bar` are `E3`, and `E4`.
1163 #
1164 # Example 2 (inherited values):
1165 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1166 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1167 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1168 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1169 # The accepted values at `organizations/foo` are `E1`, `E2`.
1170 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
1171 #
1172 # Example 3 (inheriting both allowed and denied values):
1173 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1174 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1175 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1176 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1177 # The accepted values at `organizations/foo` are `E1`, `E2`.
1178 # The value accepted at `projects/bar` is `E2`.
1179 #
1180 # Example 4 (RestoreDefault):
1181 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1182 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1183 # `projects/bar` has a `Policy` with values:
1184 # {RestoreDefault: {}}
1185 # The accepted values at `organizations/foo` are `E1`, `E2`.
1186 # The accepted values at `projects/bar` are either all or none depending on
1187 # the value of `constraint_default` (if `ALLOW`, all; if
1188 # `DENY`, none).
1189 #
1190 # Example 5 (no policy inherits parent policy):
1191 # `organizations/foo` has no `Policy` set.
1192 # `projects/bar` has no `Policy` set.
1193 # The accepted values at both levels are either all or none depending on
1194 # the value of `constraint_default` (if `ALLOW`, all; if
1195 # `DENY`, none).
1196 #
1197 # Example 6 (ListConstraint allowing all):
1198 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1199 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1200 # `projects/bar` has a `Policy` with:
1201 # {all: ALLOW}
1202 # The accepted values at `organizations/foo` are `E1`, E2`.
1203 # Any value is accepted at `projects/bar`.
1204 #
1205 # Example 7 (ListConstraint allowing none):
1206 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1207 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1208 # `projects/bar` has a `Policy` with:
1209 # {all: DENY}
1210 # The accepted values at `organizations/foo` are `E1`, E2`.
1211 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1212 #
1213 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
1214 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1215 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1216 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1217 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1218 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1219 # {allowed_values: &quot;under:projects/P3&quot;}
1220 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1221 # The accepted values at `organizations/foo` are `organizations/O1`,
1222 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
1223 # `projects/P3`.
1224 # The accepted values at `projects/bar` are `organizations/O1`,
1225 # `folders/F1`, `projects/P1`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1226 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1227 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1228 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1229 ],
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1230 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1231 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
1232 # concurrency control.
1233 #
1234 # When the `Policy` is returned from either a `GetPolicy` or a
1235 # `ListOrgPolicy` request, this `etag` indicates the version of the current
1236 # `Policy` to use when executing a read-modify-write loop.
1237 #
1238 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
1239 # `etag` will be unset.
1240 #
1241 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
1242 # that was returned from a `GetOrgPolicy` request as part of a
1243 # read-modify-write loop for concurrency control. Not setting the `etag`in a
1244 # `SetOrgPolicy` request will result in an unconditional write of the
1245 # `Policy`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1246 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1247 # resource.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1248 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1249 # configuration is acceptable.
1250 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1251 # Suppose you have a `Constraint`
1252 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
1253 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
1254 # behavior:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1255 # - If the `Policy` at this resource has enforced set to `false`, serial
1256 # port connection attempts will be allowed.
1257 # - If the `Policy` at this resource has enforced set to `true`, serial
1258 # port connection attempts will be refused.
1259 # - If the `Policy` at this resource is `RestoreDefault`, serial port
1260 # connection attempts will be allowed.
1261 # - If no `Policy` is set at this resource or anywhere higher in the
1262 # resource hierarchy, serial port connection attempts will be allowed.
1263 # - If no `Policy` is set at this resource, but one exists higher in the
1264 # resource hierarchy, the behavior is as if the`Policy` were set at
1265 # this resource.
1266 #
1267 # The following examples demonstrate the different possible layerings:
1268 #
1269 # Example 1 (nearest `Constraint` wins):
1270 # `organizations/foo` has a `Policy` with:
1271 # {enforced: false}
1272 # `projects/bar` has no `Policy` set.
1273 # The constraint at `projects/bar` and `organizations/foo` will not be
1274 # enforced.
1275 #
1276 # Example 2 (enforcement gets replaced):
1277 # `organizations/foo` has a `Policy` with:
1278 # {enforced: false}
1279 # `projects/bar` has a `Policy` with:
1280 # {enforced: true}
1281 # The constraint at `organizations/foo` is not enforced.
1282 # The constraint at `projects/bar` is enforced.
1283 #
1284 # Example 3 (RestoreDefault):
1285 # `organizations/foo` has a `Policy` with:
1286 # {enforced: true}
1287 # `projects/bar` has a `Policy` with:
1288 # {RestoreDefault: {}}
1289 # The constraint at `organizations/foo` is enforced.
1290 # The constraint at `projects/bar` is not enforced, because
1291 # `constraint_default` for the `Constraint` is `ALLOW`.
1292 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1293 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
1294 # `constraints/serviceuser.services`.
1295 #
1296 # Immutable after creation.
1297 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
1298 # server, not specified by the caller, and represents the last time a call to
1299 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
1300 # be ignored.
1301 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
1302 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
1303 # `Constraint` type.
1304 # `constraint_default` enforcement behavior of the specific `Constraint` at
1305 # this resource.
1306 #
1307 # Suppose that `constraint_default` is set to `ALLOW` for the
1308 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
1309 # foo.com sets a `Policy` at their Organization resource node that restricts
1310 # the allowed service activations to deny all service activations. They
1311 # could then set a `Policy` with the `policy_type` `restore_default` on
1312 # several experimental projects, restoring the `constraint_default`
1313 # enforcement of the `Constraint` for only those projects, allowing those
1314 # projects to have all services activated.
1315 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1316 }</pre>
1317</div>
1318
1319<div class="method">
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1320 <code class="details" id="list">list(pageToken=None, pageSize=None, filter=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1321 <pre>Lists Projects that the caller has the `resourcemanager.projects.get`
1322permission on and satisfy the specified filter.
1323
1324This method returns Projects in an unspecified order.
1325This method is eventually consistent with project mutations; this means
1326that a newly created project may not appear in the results or recent
1327updates to an existing project may not be reflected in the results. To
1328retrieve the latest state of a project, use the
1329GetProject method.
1330
1331NOTE: If the request filter contains a `parent.type` and `parent.id` and
1332the caller has the `resourcemanager.projects.list` permission on the
1333parent, the results will be drawn from an alternate index which provides
1334more consistent results. In future versions of this API, this List method
1335will be split into List and Search to properly capture the behavorial
1336difference.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1337
1338Args:
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1339 pageToken: string, A pagination token returned from a previous call to ListProjects
1340that indicates from where listing should continue.
1341
1342Optional.
1343 pageSize: integer, The maximum number of Projects to return in the response.
1344The server can return fewer Projects than requested.
1345If unspecified, server picks an appropriate default.
1346
1347Optional.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1348 filter: string, An expression for filtering the results of the request. Filter rules are
1349case insensitive. The fields eligible for filtering are:
1350
1351+ `name`
1352+ `id`
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1353+ `labels.&lt;key&gt;` (where *key* is the name of a label)
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1354+ `parent.type`
1355+ `parent.id`
1356
1357Some examples of using labels as filters:
1358
1359| Filter | Description |
1360|------------------|-----------------------------------------------------|
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1361| name:how* | The project&#x27;s name starts with &quot;how&quot;. |
1362| name:Howl | The project&#x27;s name is `Howl` or `howl`. |
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1363| name:HOWL | Equivalent to above. |
1364| NAME:howl | Equivalent to above. |
1365| labels.color:* | The project has the label `color`. |
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1366| labels.color:red | The project&#x27;s label `color` has the value `red`. |
1367| labels.color:red&amp;nbsp;labels.size:big |The project&#x27;s label `color` has
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1368 the value `red` and its label `size` has the value `big`. |
1369
1370If no filter is specified, the call will return projects for which the user
1371has the `resourcemanager.projects.get` permission.
1372
1373NOTE: To perform a by-parent query (eg., what projects are directly in a
1374Folder), the caller must have the `resourcemanager.projects.list`
1375permission on the parent and the filter must contain both a `parent.type`
1376and a `parent.id` restriction
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1377(example: &quot;parent.type:folder parent.id:123&quot;). In this case an alternate
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1378search index is used which provides more consistent results.
1379
1380Optional.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1381 x__xgafv: string, V1 error format.
1382 Allowed values
1383 1 - v1 error format
1384 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1385
1386Returns:
1387 An object of the form:
1388
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1389 { # A page of the response received from the
1390 # ListProjects
1391 # method.
1392 #
1393 # A paginated response where more pages are available has
1394 # `next_page_token` set. This token can be used in a subsequent request to
1395 # retrieve the next request page.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1396 &quot;projects&quot;: [ # The list of Projects that matched the list filter. This list can
1397 # be paginated.
1398 { # A Project is a high-level Google Cloud Platform entity. It is a
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1399 # container for ACLs, APIs, App Engine Apps, VMs, and other
1400 # Google Cloud Platform resources.
1401 &quot;name&quot;: &quot;A String&quot;, # The optional user-assigned display name of the Project.
1402 # When present it must be between 4 to 30 characters.
1403 # Allowed characters are: lowercase and uppercase letters, numbers,
1404 # hyphen, single-quote, double-quote, space, and exclamation point.
1405 #
1406 # Example: &lt;code&gt;My Project&lt;/code&gt;
1407 # Read-write.
1408 &quot;projectId&quot;: &quot;A String&quot;, # The unique, user-assigned ID of the Project.
1409 # It must be 6 to 30 lowercase letters, digits, or hyphens.
1410 # It must start with a letter.
1411 # Trailing hyphens are prohibited.
1412 #
1413 # Example: &lt;code&gt;tokyo-rain-123&lt;/code&gt;
1414 # Read-only after creation.
1415 &quot;lifecycleState&quot;: &quot;A String&quot;, # The Project lifecycle state.
1416 #
1417 # Read-only.
1418 &quot;projectNumber&quot;: &quot;A String&quot;, # The number uniquely identifying the project.
1419 #
1420 # Example: &lt;code&gt;415104041262&lt;/code&gt;
1421 # Read-only.
1422 &quot;parent&quot;: { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.
1423 #
1424 # Supported parent types include &quot;organization&quot; and &quot;folder&quot;. Once set, the
1425 # parent cannot be cleared. The `parent` can be set on creation or using the
1426 # `UpdateProject` method; the end user must have the
1427 # `resourcemanager.projects.create` permission on the parent.
1428 #
1429 # Read-write.
1430 # Cloud Platform is a generic term for something you (a developer) may want to
1431 # interact with through one of our API&#x27;s. Some examples are an App Engine app,
1432 # a Compute Engine instance, a Cloud SQL database, and so on.
1433 &quot;type&quot;: &quot;A String&quot;, # Required field representing the resource type this id is for.
1434 # At present, the valid types are: &quot;organization&quot;, &quot;folder&quot;, and &quot;project&quot;.
1435 &quot;id&quot;: &quot;A String&quot;, # Required field for the type-specific id. This should correspond to the id
1436 # used in the type-specific API&#x27;s.
1437 },
1438 &quot;createTime&quot;: &quot;A String&quot;, # Creation time.
1439 #
1440 # Read-only.
1441 &quot;labels&quot;: { # The labels associated with this Project.
1442 #
1443 # Label keys must be between 1 and 63 characters long and must conform
1444 # to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.
1445 #
1446 # Label values must be between 0 and 63 characters long and must conform
1447 # to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label
1448 # value can be empty.
1449 #
1450 # No more than 256 labels can be associated with a given resource.
1451 #
1452 # Clients should store labels in a representation such as JSON that does not
1453 # depend on specific characters being disallowed.
1454 #
1455 # Example: &lt;code&gt;&quot;environment&quot; : &quot;dev&quot;&lt;/code&gt;
1456 # Read-write.
1457 &quot;a_key&quot;: &quot;A String&quot;,
1458 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1459 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1460 ],
1461 &quot;nextPageToken&quot;: &quot;A String&quot;, # Pagination token.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1462 #
1463 # If the result set is too large to fit in a single response, this token
1464 # is returned. It encodes the position of the current result cursor.
1465 # Feeding this value into a new list request with the `page_token` parameter
1466 # gives the next page of the results.
1467 #
1468 # When `next_page_token` is not filled in, there is no next page and
1469 # the list returned is the last page in the result set.
1470 #
1471 # Pagination tokens have a limited lifetime.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1472 }</pre>
1473</div>
1474
1475<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1476 <code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1477 <pre>Lists `Constraints` that could be applied on the specified resource.
1478
1479Args:
1480 resource: string, Name of the resource to list `Constraints` for. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1481 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1482 The object takes the form of:
1483
1484{ # The request sent to the [ListAvailableOrgPolicyConstraints]
1485 # google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1486 &quot;pageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently unsupported
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1487 # and will be ignored. The server may at any point start using this field.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1488 &quot;pageSize&quot;: 42, # Size of the pages to be returned. This is currently unsupported and will
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1489 # be ignored. The server may at any point start using this field to limit
1490 # page size.
1491 }
1492
1493 x__xgafv: string, V1 error format.
1494 Allowed values
1495 1 - v1 error format
1496 2 - v2 error format
1497
1498Returns:
1499 An object of the form:
1500
1501 { # The response returned from the ListAvailableOrgPolicyConstraints method.
1502 # Returns all `Constraints` that could be set at this level of the hierarchy
1503 # (contrast with the response from `ListPolicies`, which returns all policies
1504 # which are set).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1505 &quot;constraints&quot;: [ # The collection of constraints that are settable on the request resource.
1506 { # A `Constraint` describes a way in which a resource&#x27;s configuration can be
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1507 # restricted. For example, it controls which cloud services can be activated
1508 # across an organization, or whether a Compute Engine instance can have
1509 # serial port connections established. `Constraints` can be configured by the
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1510 # organization&#x27;s policy adminstrator to fit the needs of the organzation by
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1511 # setting Policies for `Constraints` at different locations in the
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1512 # organization&#x27;s resource hierarchy. Policies are inherited down the resource
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1513 # hierarchy from higher levels, but can also be overridden. For details about
1514 # the inheritance rules please read about
1515 # Policies.
1516 #
1517 # `Constraints` have a default behavior determined by the `constraint_default`
1518 # field, which is the enforcement behavior that is used in the absence of a
1519 # `Policy` being defined or inherited for the resource in question.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1520 &quot;name&quot;: &quot;A String&quot;, # Immutable value, required to globally be unique. For example,
1521 # `constraints/serviceuser.services`
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1522 &quot;listConstraint&quot;: { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.
1523 # configured by an Organization&#x27;s policy administrator with a `Policy`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1524 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
1525 # that matches the value specified in this `Constraint`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1526 &quot;supportsUnder&quot;: True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy
1527 # can be used in `Policy.allowed_values` and `Policy.denied_values`. For
1528 # example, `&quot;under:folders/123&quot;` would match any resource under the
1529 # &#x27;folders/123&#x27; folder.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1530 },
1531 &quot;version&quot;: 42, # Version of the `Constraint`. Default version is 0;
1532 &quot;description&quot;: &quot;A String&quot;, # Detailed description of what this `Constraint` controls as well as how and
1533 # where it is enforced.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1534 #
1535 # Mutable.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1536 &quot;displayName&quot;: &quot;A String&quot;, # The human readable name.
1537 #
1538 # Mutable.
1539 &quot;booleanConstraint&quot;: { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1540 #
1541 # For example a constraint `constraints/compute.disableSerialPortAccess`.
1542 # If it is enforced on a VM instance, serial port connections will not be
1543 # opened to that instance.
1544 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1545 &quot;constraintDefault&quot;: &quot;A String&quot;, # The evaluation behavior of this constraint in the absense of &#x27;Policy&#x27;.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1546 },
1547 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1548 &quot;nextPageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently not used.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1549 }</pre>
1550</div>
1551
1552<div class="method">
1553 <code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>
1554 <pre>Retrieves the next page of results.
1555
1556Args:
1557 previous_request: The request for the previous page. (required)
1558 previous_response: The response from the request for the previous page. (required)
1559
1560Returns:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1561 A request object that you can call &#x27;execute()&#x27; on to request the next
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1562 page. Returns None if there are no more items in the collection.
1563 </pre>
1564</div>
1565
1566<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1567 <code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1568 <pre>Lists all the `Policies` set for a particular resource.
1569
1570Args:
1571 resource: string, Name of the resource to list Policies for. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1572 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1573 The object takes the form of:
1574
1575{ # The request sent to the ListOrgPolicies method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1576 &quot;pageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently unsupported
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1577 # and will be ignored. The server may at any point start using this field.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1578 &quot;pageSize&quot;: 42, # Size of the pages to be returned. This is currently unsupported and will
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1579 # be ignored. The server may at any point start using this field to limit
1580 # page size.
1581 }
1582
1583 x__xgafv: string, V1 error format.
1584 Allowed values
1585 1 - v1 error format
1586 2 - v2 error format
1587
1588Returns:
1589 An object of the form:
1590
1591 { # The response returned from the ListOrgPolicies method. It will be empty
1592 # if no `Policies` are set on the resource.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1593 &quot;nextPageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently not used, but
1594 # the server may at any point start supplying a valid token.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1595 &quot;policies&quot;: [ # The `Policies` that are set on the resource. It will be empty if no
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1596 # `Policies` are set.
1597 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
1598 # for configurations of Cloud Platform resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1599 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1600 # resource.
1601 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1602 # `ListPolicy` can define specific values and subtrees of Cloud Resource
1603 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
1604 # are allowed or denied by setting the `allowed_values` and `denied_values`
1605 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
1606 # The `under:` prefix is used to denote resource subtree values.
1607 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1608 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1609 # same as values with no prefix.
1610 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1611 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
1612 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
1613 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1614 # The `supports_under` field of the associated `Constraint` defines whether
1615 # ancestry prefixes can be used. You can set `allowed_values` and
1616 # `denied_values` in the same `Policy` if `all_values` is
1617 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
1618 # values. If `all_values` is set to either `ALLOW` or `DENY`,
1619 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1620 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1621 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1622 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1623 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1624 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1625 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
1626 # that matches the value specified in this `Policy`. If `suggested_value`
1627 # is not set, it will inherit the value specified higher in the hierarchy,
1628 # unless `inherit_from_parent` is `false`.
1629 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1630 #
1631 # By default, a `ListPolicy` set at a resource supercedes any `Policy` set
1632 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
1633 # set to `true`, then the values from the effective `Policy` of the parent
1634 # resource are inherited, meaning the values set in this `Policy` are
1635 # added to the values inherited up the hierarchy.
1636 #
1637 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1638 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1639 # simple and understandable. However, it is possible to set a `Policy` with
1640 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
1641 # In this case, the values that are allowed must be in `allowed_values` and
1642 # not present in `denied_values`.
1643 #
1644 # For example, suppose you have a `Constraint`
1645 # `constraints/serviceuser.services`, which has a `constraint_type` of
1646 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
1647 # Suppose that at the Organization level, a `Policy` is applied that
1648 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
1649 # `Policy` is applied to a project below the Organization that has
1650 # `inherit_from_parent` set to `false` and field all_values set to DENY,
1651 # then an attempt to activate any API will be denied.
1652 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1653 # The following examples demonstrate different possible layerings for
1654 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1655 #
1656 # Example 1 (no inherited values):
1657 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1658 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1659 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1660 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1661 # The accepted values at `organizations/foo` are `E1`, `E2`.
1662 # The accepted values at `projects/bar` are `E3`, and `E4`.
1663 #
1664 # Example 2 (inherited values):
1665 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1666 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1667 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1668 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1669 # The accepted values at `organizations/foo` are `E1`, `E2`.
1670 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
1671 #
1672 # Example 3 (inheriting both allowed and denied values):
1673 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1674 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1675 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1676 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1677 # The accepted values at `organizations/foo` are `E1`, `E2`.
1678 # The value accepted at `projects/bar` is `E2`.
1679 #
1680 # Example 4 (RestoreDefault):
1681 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1682 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1683 # `projects/bar` has a `Policy` with values:
1684 # {RestoreDefault: {}}
1685 # The accepted values at `organizations/foo` are `E1`, `E2`.
1686 # The accepted values at `projects/bar` are either all or none depending on
1687 # the value of `constraint_default` (if `ALLOW`, all; if
1688 # `DENY`, none).
1689 #
1690 # Example 5 (no policy inherits parent policy):
1691 # `organizations/foo` has no `Policy` set.
1692 # `projects/bar` has no `Policy` set.
1693 # The accepted values at both levels are either all or none depending on
1694 # the value of `constraint_default` (if `ALLOW`, all; if
1695 # `DENY`, none).
1696 #
1697 # Example 6 (ListConstraint allowing all):
1698 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1699 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1700 # `projects/bar` has a `Policy` with:
1701 # {all: ALLOW}
1702 # The accepted values at `organizations/foo` are `E1`, E2`.
1703 # Any value is accepted at `projects/bar`.
1704 #
1705 # Example 7 (ListConstraint allowing none):
1706 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1707 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1708 # `projects/bar` has a `Policy` with:
1709 # {all: DENY}
1710 # The accepted values at `organizations/foo` are `E1`, E2`.
1711 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1712 #
1713 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
1714 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1715 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1716 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1717 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1718 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1719 # {allowed_values: &quot;under:projects/P3&quot;}
1720 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1721 # The accepted values at `organizations/foo` are `organizations/O1`,
1722 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
1723 # `projects/P3`.
1724 # The accepted values at `projects/bar` are `organizations/O1`,
1725 # `folders/F1`, `projects/P1`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1726 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1727 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1728 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1729 ],
1730 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1731 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
1732 # concurrency control.
1733 #
1734 # When the `Policy` is returned from either a `GetPolicy` or a
1735 # `ListOrgPolicy` request, this `etag` indicates the version of the current
1736 # `Policy` to use when executing a read-modify-write loop.
1737 #
1738 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
1739 # `etag` will be unset.
1740 #
1741 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
1742 # that was returned from a `GetOrgPolicy` request as part of a
1743 # read-modify-write loop for concurrency control. Not setting the `etag`in a
1744 # `SetOrgPolicy` request will result in an unconditional write of the
1745 # `Policy`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1746 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1747 # resource.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1748 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1749 # configuration is acceptable.
1750 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1751 # Suppose you have a `Constraint`
1752 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
1753 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
1754 # behavior:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1755 # - If the `Policy` at this resource has enforced set to `false`, serial
1756 # port connection attempts will be allowed.
1757 # - If the `Policy` at this resource has enforced set to `true`, serial
1758 # port connection attempts will be refused.
1759 # - If the `Policy` at this resource is `RestoreDefault`, serial port
1760 # connection attempts will be allowed.
1761 # - If no `Policy` is set at this resource or anywhere higher in the
1762 # resource hierarchy, serial port connection attempts will be allowed.
1763 # - If no `Policy` is set at this resource, but one exists higher in the
1764 # resource hierarchy, the behavior is as if the`Policy` were set at
1765 # this resource.
1766 #
1767 # The following examples demonstrate the different possible layerings:
1768 #
1769 # Example 1 (nearest `Constraint` wins):
1770 # `organizations/foo` has a `Policy` with:
1771 # {enforced: false}
1772 # `projects/bar` has no `Policy` set.
1773 # The constraint at `projects/bar` and `organizations/foo` will not be
1774 # enforced.
1775 #
1776 # Example 2 (enforcement gets replaced):
1777 # `organizations/foo` has a `Policy` with:
1778 # {enforced: false}
1779 # `projects/bar` has a `Policy` with:
1780 # {enforced: true}
1781 # The constraint at `organizations/foo` is not enforced.
1782 # The constraint at `projects/bar` is enforced.
1783 #
1784 # Example 3 (RestoreDefault):
1785 # `organizations/foo` has a `Policy` with:
1786 # {enforced: true}
1787 # `projects/bar` has a `Policy` with:
1788 # {RestoreDefault: {}}
1789 # The constraint at `organizations/foo` is enforced.
1790 # The constraint at `projects/bar` is not enforced, because
1791 # `constraint_default` for the `Constraint` is `ALLOW`.
1792 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1793 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
1794 # `constraints/serviceuser.services`.
1795 #
1796 # Immutable after creation.
1797 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
1798 # server, not specified by the caller, and represents the last time a call to
1799 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
1800 # be ignored.
1801 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
1802 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
1803 # `Constraint` type.
1804 # `constraint_default` enforcement behavior of the specific `Constraint` at
1805 # this resource.
1806 #
1807 # Suppose that `constraint_default` is set to `ALLOW` for the
1808 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
1809 # foo.com sets a `Policy` at their Organization resource node that restricts
1810 # the allowed service activations to deny all service activations. They
1811 # could then set a `Policy` with the `policy_type` `restore_default` on
1812 # several experimental projects, restoring the `constraint_default`
1813 # enforcement of the `Constraint` for only those projects, allowing those
1814 # projects to have all services activated.
1815 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1816 },
1817 ],
1818 }</pre>
1819</div>
1820
1821<div class="method">
1822 <code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>
1823 <pre>Retrieves the next page of results.
1824
1825Args:
1826 previous_request: The request for the previous page. (required)
1827 previous_response: The response from the request for the previous page. (required)
1828
1829Returns:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1830 A request object that you can call &#x27;execute()&#x27; on to request the next
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1831 page. Returns None if there are no more items in the collection.
1832 </pre>
1833</div>
1834
1835<div class="method">
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1836 <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
1837 <pre>Retrieves the next page of results.
1838
1839Args:
1840 previous_request: The request for the previous page. (required)
1841 previous_response: The response from the request for the previous page. (required)
1842
1843Returns:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1844 A request object that you can call &#x27;execute()&#x27; on to request the next
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1845 page. Returns None if there are no more items in the collection.
1846 </pre>
1847</div>
1848
1849<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1850 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1851 <pre>Sets the IAM access control policy for the specified Project. Overwrites
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1852any existing policy.
1853
1854The following constraints apply when using `setIamPolicy()`:
1855
1856+ Project does not support `allUsers` and `allAuthenticatedUsers` as
1857`members` in a `Binding` of a `Policy`.
1858
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1859+ The owner role can be granted to a `user`, `serviceAccount`, or a group
1860that is part of an organization. For example,
1861group@myownpersonaldomain.com could be added as an owner to a project in
1862the myownpersonaldomain.com organization, but not the examplepetstore.com
1863organization.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1864
1865+ Service accounts can be made owners of a project directly
1866without any restrictions. However, to be added as an owner, a user must be
1867invited via Cloud Platform console and must accept the invitation.
1868
1869+ A user cannot be granted the owner role using `setIamPolicy()`. The user
1870must be granted the owner role using the Cloud Platform Console and must
1871explicitly accept the invitation.
1872
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1873+ You can only grant ownership of a project to a member by using the
1874GCP Console. Inviting a member will deliver an invitation email that
1875they must accept. An invitation email is not generated if you are
1876granting a role other than owner, or if both the member you are inviting
1877and the project are part of your organization.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1878
1879+ Membership changes that leave the project without any owners that have
1880accepted the Terms of Service (ToS) will be rejected.
1881
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1882+ If the project is not part of an organization, there must be at least
1883one owner who has accepted the Terms of Service (ToS) agreement in the
1884policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner
1885from the policy will fail. This restriction also applies to legacy
1886projects that no longer have owners who have accepted the ToS. Edits to
1887IAM policies will be rejected until the lack of a ToS-accepting owner is
1888rectified.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1889
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1890+ This method will replace the existing policy, and cannot be used to
1891append additional IAM settings.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1892
1893Note: Removing service accounts from policies or changing their roles
1894can render services completely inoperable. It is important to understand
1895how the service account is being used before removing or updating its
1896roles.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1897
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1898Authorization requires the Google IAM permission
1899`resourcemanager.projects.setIamPolicy` on the project
1900
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1901Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1902 resource: string, REQUIRED: The resource for which the policy is being specified.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1903See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1904 body: object, The request body.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]1905 The object takes the form of:
1906
1907{ # Request message for `SetIamPolicy` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1908 &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1909 # the policy is limited to a few 10s of KB. An empty policy is a
1910 # valid policy but certain Cloud Platform services (such as Projects)
1911 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1912 # controls for Google Cloud resources.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1913 #
1914 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1915 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
1916 # `members` to a single `role`. Members can be user accounts, service accounts,
1917 # Google groups, and domains (such as G Suite). A `role` is a named list of
1918 # permissions; each `role` can be an IAM predefined role or a user-created
1919 # custom role.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1920 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1921 # For some types of Google Cloud resources, a `binding` can also specify a
1922 # `condition`, which is a logical expression that allows access to a resource
1923 # only if the expression evaluates to `true`. A condition can add constraints
1924 # based on attributes of the request, the resource, or both. To learn which
1925 # resources support conditions in their IAM policies, see the
1926 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1927 #
1928 # **JSON example:**
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1929 #
1930 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1931 # &quot;bindings&quot;: [
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1932 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1933 # &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;,
1934 # &quot;members&quot;: [
1935 # &quot;user:mike@example.com&quot;,
1936 # &quot;group:admins@example.com&quot;,
1937 # &quot;domain:google.com&quot;,
1938 # &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot;
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1939 # ]
1940 # },
1941 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1942 # &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;,
1943 # &quot;members&quot;: [
1944 # &quot;user:eve@example.com&quot;
1945 # ],
1946 # &quot;condition&quot;: {
1947 # &quot;title&quot;: &quot;expirable access&quot;,
1948 # &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;,
1949 # &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;,
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1950 # }
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1951 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1952 # ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1953 # &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;,
1954 # &quot;version&quot;: 3
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1955 # }
1956 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1957 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1958 #
1959 # bindings:
1960 # - members:
1961 # - user:mike@example.com
1962 # - group:admins@example.com
1963 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1964 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
1965 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1966 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1967 # - user:eve@example.com
1968 # role: roles/resourcemanager.organizationViewer
1969 # condition:
1970 # title: expirable access
1971 # description: Does not grant access after Sep 2020
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1972 # expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1973 # - etag: BwWWja0YfJA=
1974 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1975 #
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]1976 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1977 # [IAM documentation](https://cloud.google.com/iam/docs/).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1978 &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
1979 # prevent simultaneous updates of a policy from overwriting each other.
1980 # It is strongly suggested that systems make use of the `etag` in the
1981 # read-modify-write cycle to perform policy updates in order to avoid race
1982 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
1983 # systems are expected to put that etag in the request to `setIamPolicy` to
1984 # ensure that their change will be applied to the same version of the policy.
1985 #
1986 # **Important:** If you use IAM Conditions, you must include the `etag` field
1987 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1988 # you to overwrite a version `3` policy with a version `1` policy, and all of
1989 # the conditions in the version `3` policy are lost.
1990 &quot;version&quot;: 42, # Specifies the format of the policy.
1991 #
1992 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
1993 # are rejected.
1994 #
1995 # Any operation that affects conditional role bindings must specify version
1996 # `3`. This requirement applies to the following operations:
1997 #
1998 # * Getting a policy that includes a conditional role binding
1999 # * Adding a conditional role binding to a policy
2000 # * Changing a conditional role binding in a policy
2001 # * Removing any role binding, with or without a condition, from a policy
2002 # that includes conditions
2003 #
2004 # **Important:** If you use IAM Conditions, you must include the `etag` field
2005 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
2006 # you to overwrite a version `3` policy with a version `1` policy, and all of
2007 # the conditions in the version `3` policy are lost.
2008 #
2009 # If a policy does not include any conditions, operations on that policy may
2010 # specify any valid version or leave the field unset.
2011 #
2012 # To learn which resources support conditions in their IAM policies, see the
2013 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
2014 &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
2015 { # Specifies the audit configuration for a service.
2016 # The configuration determines which permission types are logged, and what
2017 # identities, if any, are exempted from logging.
2018 # An AuditConfig must have one or more AuditLogConfigs.
2019 #
2020 # If there are AuditConfigs for both `allServices` and a specific service,
2021 # the union of the two AuditConfigs is used for that service: the log_types
2022 # specified in each AuditConfig are enabled, and the exempted_members in each
2023 # AuditLogConfig are exempted.
2024 #
2025 # Example Policy with multiple AuditConfigs:
2026 #
2027 # {
2028 # &quot;audit_configs&quot;: [
2029 # {
2030 # &quot;service&quot;: &quot;allServices&quot;
2031 # &quot;audit_log_configs&quot;: [
2032 # {
2033 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
2034 # &quot;exempted_members&quot;: [
2035 # &quot;user:jose@example.com&quot;
2036 # ]
2037 # },
2038 # {
2039 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
2040 # },
2041 # {
2042 # &quot;log_type&quot;: &quot;ADMIN_READ&quot;,
2043 # }
2044 # ]
2045 # },
2046 # {
2047 # &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;
2048 # &quot;audit_log_configs&quot;: [
2049 # {
2050 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
2051 # },
2052 # {
2053 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
2054 # &quot;exempted_members&quot;: [
2055 # &quot;user:aliya@example.com&quot;
2056 # ]
2057 # }
2058 # ]
2059 # }
2060 # ]
2061 # }
2062 #
2063 # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
2064 # logging. It also exempts jose@example.com from DATA_READ logging, and
2065 # aliya@example.com from DATA_WRITE logging.
2066 &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging.
2067 # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
2068 # `allServices` is a special value that covers all services.
2069 &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
2070 { # Provides the configuration for logging a type of permissions.
2071 # Example:
2072 #
2073 # {
2074 # &quot;audit_log_configs&quot;: [
2075 # {
2076 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
2077 # &quot;exempted_members&quot;: [
2078 # &quot;user:jose@example.com&quot;
2079 # ]
2080 # },
2081 # {
2082 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
2083 # }
2084 # ]
2085 # }
2086 #
2087 # This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting
2088 # jose@example.com from DATA_READ logging.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2089 &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of
2090 # permission.
2091 # Follows the same format of Binding.members.
2092 &quot;A String&quot;,
2093 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2094 &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2095 },
2096 ],
2097 },
2098 ],
2099 &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2100 # `condition` that determines how and when the `bindings` are applied. Each
2101 # of the `bindings` must contain at least one member.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2102 { # Associates `members` with a `role`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2103 &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
2104 #
2105 # If the condition evaluates to `true`, then this binding applies to the
2106 # current request.
2107 #
2108 # If the condition evaluates to `false`, then this binding does not apply to
2109 # the current request. However, a different role binding might grant the same
2110 # role to one or more of the members in this binding.
2111 #
2112 # To learn which resources support conditions in their IAM policies, see the
2113 # [IAM
2114 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
2115 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
2116 # are documented at https://github.com/google/cel-spec.
2117 #
2118 # Example (Comparison):
2119 #
2120 # title: &quot;Summary size limit&quot;
2121 # description: &quot;Determines if a summary is less than 100 chars&quot;
2122 # expression: &quot;document.summary.size() &lt; 100&quot;
2123 #
2124 # Example (Equality):
2125 #
2126 # title: &quot;Requestor is owner&quot;
2127 # description: &quot;Determines if requestor is the document owner&quot;
2128 # expression: &quot;document.owner == request.auth.claims.email&quot;
2129 #
2130 # Example (Logic):
2131 #
2132 # title: &quot;Public documents&quot;
2133 # description: &quot;Determine whether the document should be publicly visible&quot;
2134 # expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
2135 #
2136 # Example (Data Manipulation):
2137 #
2138 # title: &quot;Notification string&quot;
2139 # description: &quot;Create a notification string with a timestamp.&quot;
2140 # expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
2141 #
2142 # The exact variables and functions that may be referenced within an expression
2143 # are determined by the service that evaluates it. See the service
2144 # documentation for additional information.
2145 &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
2146 # its purpose. This can be used e.g. in UIs which allow to enter the
2147 # expression.
2148 &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
2149 # reporting, e.g. a file name and a position in the file.
2150 &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
2151 # describes the expression, e.g. when hovered over it in a UI.
2152 &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
2153 # syntax.
2154 },
2155 &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2156 # `members` can have the following values:
2157 #
2158 # * `allUsers`: A special identifier that represents anyone who is
2159 # on the internet; with or without a Google account.
2160 #
2161 # * `allAuthenticatedUsers`: A special identifier that represents anyone
2162 # who is authenticated with a Google account or a service account.
2163 #
2164 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2165 # account. For example, `alice@example.com` .
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2166 #
2167 #
2168 # * `serviceAccount:{emailid}`: An email address that represents a service
2169 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
2170 #
2171 # * `group:{emailid}`: An email address that represents a Google group.
2172 # For example, `admins@example.com`.
2173 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2174 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
2175 # identifier) representing a user that has been recently deleted. For
2176 # example, `alice@example.com?uid=123456789012345678901`. If the user is
2177 # recovered, this value reverts to `user:{emailid}` and the recovered user
2178 # retains the role in the binding.
2179 #
2180 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
2181 # unique identifier) representing a service account that has been recently
2182 # deleted. For example,
2183 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
2184 # If the service account is undeleted, this value reverts to
2185 # `serviceAccount:{emailid}` and the undeleted service account retains the
2186 # role in the binding.
2187 #
2188 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
2189 # identifier) representing a Google group that has been recently
2190 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
2191 # the group is recovered, this value reverts to `group:{emailid}` and the
2192 # recovered group retains the role in the binding.
2193 #
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2194 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2195 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2196 # users of that domain. For example, `google.com` or `example.com`.
2197 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2198 &quot;A String&quot;,
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2199 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2200 &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
2201 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2202 },
2203 ],
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2204 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2205 &quot;updateMask&quot;: &quot;A String&quot;, # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2206 # the fields in the mask will be modified. If no mask is provided, the
2207 # following default mask is used:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2208 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2209 # `paths: &quot;bindings, etag&quot;`
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2210 }
2211
2212 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2213 Allowed values
2214 1 - v1 error format
2215 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2216
2217Returns:
2218 An object of the form:
2219
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2220 { # An Identity and Access Management (IAM) policy, which specifies access
2221 # controls for Google Cloud resources.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2222 #
2223 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2224 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
2225 # `members` to a single `role`. Members can be user accounts, service accounts,
2226 # Google groups, and domains (such as G Suite). A `role` is a named list of
2227 # permissions; each `role` can be an IAM predefined role or a user-created
2228 # custom role.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2229 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2230 # For some types of Google Cloud resources, a `binding` can also specify a
2231 # `condition`, which is a logical expression that allows access to a resource
2232 # only if the expression evaluates to `true`. A condition can add constraints
2233 # based on attributes of the request, the resource, or both. To learn which
2234 # resources support conditions in their IAM policies, see the
2235 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2236 #
2237 # **JSON example:**
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2238 #
2239 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2240 # &quot;bindings&quot;: [
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2241 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2242 # &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;,
2243 # &quot;members&quot;: [
2244 # &quot;user:mike@example.com&quot;,
2245 # &quot;group:admins@example.com&quot;,
2246 # &quot;domain:google.com&quot;,
2247 # &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot;
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2248 # ]
2249 # },
2250 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2251 # &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;,
2252 # &quot;members&quot;: [
2253 # &quot;user:eve@example.com&quot;
2254 # ],
2255 # &quot;condition&quot;: {
2256 # &quot;title&quot;: &quot;expirable access&quot;,
2257 # &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;,
2258 # &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;,
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2259 # }
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2260 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2261 # ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2262 # &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;,
2263 # &quot;version&quot;: 3
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2264 # }
2265 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2266 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2267 #
2268 # bindings:
2269 # - members:
2270 # - user:mike@example.com
2271 # - group:admins@example.com
2272 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2273 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
2274 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2275 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2276 # - user:eve@example.com
2277 # role: roles/resourcemanager.organizationViewer
2278 # condition:
2279 # title: expirable access
2280 # description: Does not grant access after Sep 2020
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2281 # expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2282 # - etag: BwWWja0YfJA=
2283 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2284 #
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2285 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2286 # [IAM documentation](https://cloud.google.com/iam/docs/).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2287 &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
2288 # prevent simultaneous updates of a policy from overwriting each other.
2289 # It is strongly suggested that systems make use of the `etag` in the
2290 # read-modify-write cycle to perform policy updates in order to avoid race
2291 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
2292 # systems are expected to put that etag in the request to `setIamPolicy` to
2293 # ensure that their change will be applied to the same version of the policy.
2294 #
2295 # **Important:** If you use IAM Conditions, you must include the `etag` field
2296 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
2297 # you to overwrite a version `3` policy with a version `1` policy, and all of
2298 # the conditions in the version `3` policy are lost.
2299 &quot;version&quot;: 42, # Specifies the format of the policy.
2300 #
2301 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
2302 # are rejected.
2303 #
2304 # Any operation that affects conditional role bindings must specify version
2305 # `3`. This requirement applies to the following operations:
2306 #
2307 # * Getting a policy that includes a conditional role binding
2308 # * Adding a conditional role binding to a policy
2309 # * Changing a conditional role binding in a policy
2310 # * Removing any role binding, with or without a condition, from a policy
2311 # that includes conditions
2312 #
2313 # **Important:** If you use IAM Conditions, you must include the `etag` field
2314 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
2315 # you to overwrite a version `3` policy with a version `1` policy, and all of
2316 # the conditions in the version `3` policy are lost.
2317 #
2318 # If a policy does not include any conditions, operations on that policy may
2319 # specify any valid version or leave the field unset.
2320 #
2321 # To learn which resources support conditions in their IAM policies, see the
2322 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
2323 &quot;auditConfigs&quot;: [ # Specifies cloud audit logging configuration for this policy.
2324 { # Specifies the audit configuration for a service.
2325 # The configuration determines which permission types are logged, and what
2326 # identities, if any, are exempted from logging.
2327 # An AuditConfig must have one or more AuditLogConfigs.
2328 #
2329 # If there are AuditConfigs for both `allServices` and a specific service,
2330 # the union of the two AuditConfigs is used for that service: the log_types
2331 # specified in each AuditConfig are enabled, and the exempted_members in each
2332 # AuditLogConfig are exempted.
2333 #
2334 # Example Policy with multiple AuditConfigs:
2335 #
2336 # {
2337 # &quot;audit_configs&quot;: [
2338 # {
2339 # &quot;service&quot;: &quot;allServices&quot;
2340 # &quot;audit_log_configs&quot;: [
2341 # {
2342 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
2343 # &quot;exempted_members&quot;: [
2344 # &quot;user:jose@example.com&quot;
2345 # ]
2346 # },
2347 # {
2348 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
2349 # },
2350 # {
2351 # &quot;log_type&quot;: &quot;ADMIN_READ&quot;,
2352 # }
2353 # ]
2354 # },
2355 # {
2356 # &quot;service&quot;: &quot;sampleservice.googleapis.com&quot;
2357 # &quot;audit_log_configs&quot;: [
2358 # {
2359 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
2360 # },
2361 # {
2362 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
2363 # &quot;exempted_members&quot;: [
2364 # &quot;user:aliya@example.com&quot;
2365 # ]
2366 # }
2367 # ]
2368 # }
2369 # ]
2370 # }
2371 #
2372 # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
2373 # logging. It also exempts jose@example.com from DATA_READ logging, and
2374 # aliya@example.com from DATA_WRITE logging.
2375 &quot;service&quot;: &quot;A String&quot;, # Specifies a service that will be enabled for audit logging.
2376 # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
2377 # `allServices` is a special value that covers all services.
2378 &quot;auditLogConfigs&quot;: [ # The configuration for logging of each type of permission.
2379 { # Provides the configuration for logging a type of permissions.
2380 # Example:
2381 #
2382 # {
2383 # &quot;audit_log_configs&quot;: [
2384 # {
2385 # &quot;log_type&quot;: &quot;DATA_READ&quot;,
2386 # &quot;exempted_members&quot;: [
2387 # &quot;user:jose@example.com&quot;
2388 # ]
2389 # },
2390 # {
2391 # &quot;log_type&quot;: &quot;DATA_WRITE&quot;,
2392 # }
2393 # ]
2394 # }
2395 #
2396 # This enables &#x27;DATA_READ&#x27; and &#x27;DATA_WRITE&#x27; logging, while exempting
2397 # jose@example.com from DATA_READ logging.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2398 &quot;exemptedMembers&quot;: [ # Specifies the identities that do not cause logging for this type of
2399 # permission.
2400 # Follows the same format of Binding.members.
2401 &quot;A String&quot;,
2402 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2403 &quot;logType&quot;: &quot;A String&quot;, # The log type that this config enables.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2404 },
2405 ],
2406 },
2407 ],
2408 &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2409 # `condition` that determines how and when the `bindings` are applied. Each
2410 # of the `bindings` must contain at least one member.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2411 { # Associates `members` with a `role`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2412 &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
2413 #
2414 # If the condition evaluates to `true`, then this binding applies to the
2415 # current request.
2416 #
2417 # If the condition evaluates to `false`, then this binding does not apply to
2418 # the current request. However, a different role binding might grant the same
2419 # role to one or more of the members in this binding.
2420 #
2421 # To learn which resources support conditions in their IAM policies, see the
2422 # [IAM
2423 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
2424 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
2425 # are documented at https://github.com/google/cel-spec.
2426 #
2427 # Example (Comparison):
2428 #
2429 # title: &quot;Summary size limit&quot;
2430 # description: &quot;Determines if a summary is less than 100 chars&quot;
2431 # expression: &quot;document.summary.size() &lt; 100&quot;
2432 #
2433 # Example (Equality):
2434 #
2435 # title: &quot;Requestor is owner&quot;
2436 # description: &quot;Determines if requestor is the document owner&quot;
2437 # expression: &quot;document.owner == request.auth.claims.email&quot;
2438 #
2439 # Example (Logic):
2440 #
2441 # title: &quot;Public documents&quot;
2442 # description: &quot;Determine whether the document should be publicly visible&quot;
2443 # expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
2444 #
2445 # Example (Data Manipulation):
2446 #
2447 # title: &quot;Notification string&quot;
2448 # description: &quot;Create a notification string with a timestamp.&quot;
2449 # expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
2450 #
2451 # The exact variables and functions that may be referenced within an expression
2452 # are determined by the service that evaluates it. See the service
2453 # documentation for additional information.
2454 &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
2455 # its purpose. This can be used e.g. in UIs which allow to enter the
2456 # expression.
2457 &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
2458 # reporting, e.g. a file name and a position in the file.
2459 &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
2460 # describes the expression, e.g. when hovered over it in a UI.
2461 &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
2462 # syntax.
2463 },
2464 &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2465 # `members` can have the following values:
2466 #
2467 # * `allUsers`: A special identifier that represents anyone who is
2468 # on the internet; with or without a Google account.
2469 #
2470 # * `allAuthenticatedUsers`: A special identifier that represents anyone
2471 # who is authenticated with a Google account or a service account.
2472 #
2473 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2474 # account. For example, `alice@example.com` .
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2475 #
2476 #
2477 # * `serviceAccount:{emailid}`: An email address that represents a service
2478 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
2479 #
2480 # * `group:{emailid}`: An email address that represents a Google group.
2481 # For example, `admins@example.com`.
2482 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2483 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
2484 # identifier) representing a user that has been recently deleted. For
2485 # example, `alice@example.com?uid=123456789012345678901`. If the user is
2486 # recovered, this value reverts to `user:{emailid}` and the recovered user
2487 # retains the role in the binding.
2488 #
2489 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
2490 # unique identifier) representing a service account that has been recently
2491 # deleted. For example,
2492 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
2493 # If the service account is undeleted, this value reverts to
2494 # `serviceAccount:{emailid}` and the undeleted service account retains the
2495 # role in the binding.
2496 #
2497 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
2498 # identifier) representing a Google group that has been recently
2499 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
2500 # the group is recovered, this value reverts to `group:{emailid}` and the
2501 # recovered group retains the role in the binding.
2502 #
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2503 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2504 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2505 # users of that domain. For example, `google.com` or `example.com`.
2506 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2507 &quot;A String&quot;,
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2508 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2509 &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
2510 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]2511 },
2512 ],
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2513 }</pre>
2514</div>
2515
2516<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2517 <code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2518 <pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for
2519that `Constraint` on the resource if one does not exist.
2520
2521Not supplying an `etag` on the request `Policy` results in an unconditional
2522write of the `Policy`.
2523
2524Args:
2525 resource: string, Resource name of the resource to attach the `Policy`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2526 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2527 The object takes the form of:
2528
2529{ # The request sent to the SetOrgPolicyRequest method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2530 &quot;policy&quot;: { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2531 # for configurations of Cloud Platform resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2532 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2533 # resource.
2534 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2535 # `ListPolicy` can define specific values and subtrees of Cloud Resource
2536 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
2537 # are allowed or denied by setting the `allowed_values` and `denied_values`
2538 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
2539 # The `under:` prefix is used to denote resource subtree values.
2540 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2541 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2542 # same as values with no prefix.
2543 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2544 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
2545 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
2546 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2547 # The `supports_under` field of the associated `Constraint` defines whether
2548 # ancestry prefixes can be used. You can set `allowed_values` and
2549 # `denied_values` in the same `Policy` if `all_values` is
2550 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
2551 # values. If `all_values` is set to either `ALLOW` or `DENY`,
2552 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2553 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2554 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2555 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2556 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2557 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2558 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
2559 # that matches the value specified in this `Policy`. If `suggested_value`
2560 # is not set, it will inherit the value specified higher in the hierarchy,
2561 # unless `inherit_from_parent` is `false`.
2562 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2563 #
2564 # By default, a `ListPolicy` set at a resource supercedes any `Policy` set
2565 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
2566 # set to `true`, then the values from the effective `Policy` of the parent
2567 # resource are inherited, meaning the values set in this `Policy` are
2568 # added to the values inherited up the hierarchy.
2569 #
2570 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2571 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2572 # simple and understandable. However, it is possible to set a `Policy` with
2573 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
2574 # In this case, the values that are allowed must be in `allowed_values` and
2575 # not present in `denied_values`.
2576 #
2577 # For example, suppose you have a `Constraint`
2578 # `constraints/serviceuser.services`, which has a `constraint_type` of
2579 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
2580 # Suppose that at the Organization level, a `Policy` is applied that
2581 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
2582 # `Policy` is applied to a project below the Organization that has
2583 # `inherit_from_parent` set to `false` and field all_values set to DENY,
2584 # then an attempt to activate any API will be denied.
2585 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2586 # The following examples demonstrate different possible layerings for
2587 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2588 #
2589 # Example 1 (no inherited values):
2590 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2591 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2592 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2593 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2594 # The accepted values at `organizations/foo` are `E1`, `E2`.
2595 # The accepted values at `projects/bar` are `E3`, and `E4`.
2596 #
2597 # Example 2 (inherited values):
2598 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2599 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2600 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2601 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2602 # The accepted values at `organizations/foo` are `E1`, `E2`.
2603 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
2604 #
2605 # Example 3 (inheriting both allowed and denied values):
2606 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2607 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2608 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2609 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2610 # The accepted values at `organizations/foo` are `E1`, `E2`.
2611 # The value accepted at `projects/bar` is `E2`.
2612 #
2613 # Example 4 (RestoreDefault):
2614 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2615 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2616 # `projects/bar` has a `Policy` with values:
2617 # {RestoreDefault: {}}
2618 # The accepted values at `organizations/foo` are `E1`, `E2`.
2619 # The accepted values at `projects/bar` are either all or none depending on
2620 # the value of `constraint_default` (if `ALLOW`, all; if
2621 # `DENY`, none).
2622 #
2623 # Example 5 (no policy inherits parent policy):
2624 # `organizations/foo` has no `Policy` set.
2625 # `projects/bar` has no `Policy` set.
2626 # The accepted values at both levels are either all or none depending on
2627 # the value of `constraint_default` (if `ALLOW`, all; if
2628 # `DENY`, none).
2629 #
2630 # Example 6 (ListConstraint allowing all):
2631 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2632 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2633 # `projects/bar` has a `Policy` with:
2634 # {all: ALLOW}
2635 # The accepted values at `organizations/foo` are `E1`, E2`.
2636 # Any value is accepted at `projects/bar`.
2637 #
2638 # Example 7 (ListConstraint allowing none):
2639 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2640 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2641 # `projects/bar` has a `Policy` with:
2642 # {all: DENY}
2643 # The accepted values at `organizations/foo` are `E1`, E2`.
2644 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2645 #
2646 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
2647 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2648 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2649 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2650 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2651 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2652 # {allowed_values: &quot;under:projects/P3&quot;}
2653 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2654 # The accepted values at `organizations/foo` are `organizations/O1`,
2655 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
2656 # `projects/P3`.
2657 # The accepted values at `projects/bar` are `organizations/O1`,
2658 # `folders/F1`, `projects/P1`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2659 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2660 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2661 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2662 ],
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2663 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2664 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
2665 # concurrency control.
2666 #
2667 # When the `Policy` is returned from either a `GetPolicy` or a
2668 # `ListOrgPolicy` request, this `etag` indicates the version of the current
2669 # `Policy` to use when executing a read-modify-write loop.
2670 #
2671 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
2672 # `etag` will be unset.
2673 #
2674 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
2675 # that was returned from a `GetOrgPolicy` request as part of a
2676 # read-modify-write loop for concurrency control. Not setting the `etag`in a
2677 # `SetOrgPolicy` request will result in an unconditional write of the
2678 # `Policy`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2679 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2680 # resource.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2681 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2682 # configuration is acceptable.
2683 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2684 # Suppose you have a `Constraint`
2685 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
2686 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
2687 # behavior:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2688 # - If the `Policy` at this resource has enforced set to `false`, serial
2689 # port connection attempts will be allowed.
2690 # - If the `Policy` at this resource has enforced set to `true`, serial
2691 # port connection attempts will be refused.
2692 # - If the `Policy` at this resource is `RestoreDefault`, serial port
2693 # connection attempts will be allowed.
2694 # - If no `Policy` is set at this resource or anywhere higher in the
2695 # resource hierarchy, serial port connection attempts will be allowed.
2696 # - If no `Policy` is set at this resource, but one exists higher in the
2697 # resource hierarchy, the behavior is as if the`Policy` were set at
2698 # this resource.
2699 #
2700 # The following examples demonstrate the different possible layerings:
2701 #
2702 # Example 1 (nearest `Constraint` wins):
2703 # `organizations/foo` has a `Policy` with:
2704 # {enforced: false}
2705 # `projects/bar` has no `Policy` set.
2706 # The constraint at `projects/bar` and `organizations/foo` will not be
2707 # enforced.
2708 #
2709 # Example 2 (enforcement gets replaced):
2710 # `organizations/foo` has a `Policy` with:
2711 # {enforced: false}
2712 # `projects/bar` has a `Policy` with:
2713 # {enforced: true}
2714 # The constraint at `organizations/foo` is not enforced.
2715 # The constraint at `projects/bar` is enforced.
2716 #
2717 # Example 3 (RestoreDefault):
2718 # `organizations/foo` has a `Policy` with:
2719 # {enforced: true}
2720 # `projects/bar` has a `Policy` with:
2721 # {RestoreDefault: {}}
2722 # The constraint at `organizations/foo` is enforced.
2723 # The constraint at `projects/bar` is not enforced, because
2724 # `constraint_default` for the `Constraint` is `ALLOW`.
2725 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2726 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
2727 # `constraints/serviceuser.services`.
2728 #
2729 # Immutable after creation.
2730 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
2731 # server, not specified by the caller, and represents the last time a call to
2732 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
2733 # be ignored.
2734 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
2735 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
2736 # `Constraint` type.
2737 # `constraint_default` enforcement behavior of the specific `Constraint` at
2738 # this resource.
2739 #
2740 # Suppose that `constraint_default` is set to `ALLOW` for the
2741 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
2742 # foo.com sets a `Policy` at their Organization resource node that restricts
2743 # the allowed service activations to deny all service activations. They
2744 # could then set a `Policy` with the `policy_type` `restore_default` on
2745 # several experimental projects, restoring the `constraint_default`
2746 # enforcement of the `Constraint` for only those projects, allowing those
2747 # projects to have all services activated.
2748 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2749 },
2750 }
2751
2752 x__xgafv: string, V1 error format.
2753 Allowed values
2754 1 - v1 error format
2755 2 - v2 error format
2756
2757Returns:
2758 An object of the form:
2759
2760 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
2761 # for configurations of Cloud Platform resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2762 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2763 # resource.
2764 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2765 # `ListPolicy` can define specific values and subtrees of Cloud Resource
2766 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
2767 # are allowed or denied by setting the `allowed_values` and `denied_values`
2768 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
2769 # The `under:` prefix is used to denote resource subtree values.
2770 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2771 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2772 # same as values with no prefix.
2773 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2774 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
2775 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
2776 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2777 # The `supports_under` field of the associated `Constraint` defines whether
2778 # ancestry prefixes can be used. You can set `allowed_values` and
2779 # `denied_values` in the same `Policy` if `all_values` is
2780 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
2781 # values. If `all_values` is set to either `ALLOW` or `DENY`,
2782 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2783 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2784 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2785 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2786 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2787 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2788 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
2789 # that matches the value specified in this `Policy`. If `suggested_value`
2790 # is not set, it will inherit the value specified higher in the hierarchy,
2791 # unless `inherit_from_parent` is `false`.
2792 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2793 #
2794 # By default, a `ListPolicy` set at a resource supercedes any `Policy` set
2795 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
2796 # set to `true`, then the values from the effective `Policy` of the parent
2797 # resource are inherited, meaning the values set in this `Policy` are
2798 # added to the values inherited up the hierarchy.
2799 #
2800 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2801 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2802 # simple and understandable. However, it is possible to set a `Policy` with
2803 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
2804 # In this case, the values that are allowed must be in `allowed_values` and
2805 # not present in `denied_values`.
2806 #
2807 # For example, suppose you have a `Constraint`
2808 # `constraints/serviceuser.services`, which has a `constraint_type` of
2809 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
2810 # Suppose that at the Organization level, a `Policy` is applied that
2811 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
2812 # `Policy` is applied to a project below the Organization that has
2813 # `inherit_from_parent` set to `false` and field all_values set to DENY,
2814 # then an attempt to activate any API will be denied.
2815 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2816 # The following examples demonstrate different possible layerings for
2817 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2818 #
2819 # Example 1 (no inherited values):
2820 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2821 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2822 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2823 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2824 # The accepted values at `organizations/foo` are `E1`, `E2`.
2825 # The accepted values at `projects/bar` are `E3`, and `E4`.
2826 #
2827 # Example 2 (inherited values):
2828 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2829 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2830 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2831 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2832 # The accepted values at `organizations/foo` are `E1`, `E2`.
2833 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
2834 #
2835 # Example 3 (inheriting both allowed and denied values):
2836 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2837 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2838 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2839 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2840 # The accepted values at `organizations/foo` are `E1`, `E2`.
2841 # The value accepted at `projects/bar` is `E2`.
2842 #
2843 # Example 4 (RestoreDefault):
2844 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2845 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2846 # `projects/bar` has a `Policy` with values:
2847 # {RestoreDefault: {}}
2848 # The accepted values at `organizations/foo` are `E1`, `E2`.
2849 # The accepted values at `projects/bar` are either all or none depending on
2850 # the value of `constraint_default` (if `ALLOW`, all; if
2851 # `DENY`, none).
2852 #
2853 # Example 5 (no policy inherits parent policy):
2854 # `organizations/foo` has no `Policy` set.
2855 # `projects/bar` has no `Policy` set.
2856 # The accepted values at both levels are either all or none depending on
2857 # the value of `constraint_default` (if `ALLOW`, all; if
2858 # `DENY`, none).
2859 #
2860 # Example 6 (ListConstraint allowing all):
2861 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2862 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2863 # `projects/bar` has a `Policy` with:
2864 # {all: ALLOW}
2865 # The accepted values at `organizations/foo` are `E1`, E2`.
2866 # Any value is accepted at `projects/bar`.
2867 #
2868 # Example 7 (ListConstraint allowing none):
2869 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2870 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2871 # `projects/bar` has a `Policy` with:
2872 # {all: DENY}
2873 # The accepted values at `organizations/foo` are `E1`, E2`.
2874 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2875 #
2876 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
2877 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2878 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2879 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2880 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2881 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2882 # {allowed_values: &quot;under:projects/P3&quot;}
2883 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2884 # The accepted values at `organizations/foo` are `organizations/O1`,
2885 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
2886 # `projects/P3`.
2887 # The accepted values at `projects/bar` are `organizations/O1`,
2888 # `folders/F1`, `projects/P1`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2889 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2890 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2891 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2892 ],
2893 },
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2894 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
2895 # concurrency control.
2896 #
2897 # When the `Policy` is returned from either a `GetPolicy` or a
2898 # `ListOrgPolicy` request, this `etag` indicates the version of the current
2899 # `Policy` to use when executing a read-modify-write loop.
2900 #
2901 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
2902 # `etag` will be unset.
2903 #
2904 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
2905 # that was returned from a `GetOrgPolicy` request as part of a
2906 # read-modify-write loop for concurrency control. Not setting the `etag`in a
2907 # `SetOrgPolicy` request will result in an unconditional write of the
2908 # `Policy`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2909 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2910 # resource.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2911 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2912 # configuration is acceptable.
2913 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2914 # Suppose you have a `Constraint`
2915 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
2916 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
2917 # behavior:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2918 # - If the `Policy` at this resource has enforced set to `false`, serial
2919 # port connection attempts will be allowed.
2920 # - If the `Policy` at this resource has enforced set to `true`, serial
2921 # port connection attempts will be refused.
2922 # - If the `Policy` at this resource is `RestoreDefault`, serial port
2923 # connection attempts will be allowed.
2924 # - If no `Policy` is set at this resource or anywhere higher in the
2925 # resource hierarchy, serial port connection attempts will be allowed.
2926 # - If no `Policy` is set at this resource, but one exists higher in the
2927 # resource hierarchy, the behavior is as if the`Policy` were set at
2928 # this resource.
2929 #
2930 # The following examples demonstrate the different possible layerings:
2931 #
2932 # Example 1 (nearest `Constraint` wins):
2933 # `organizations/foo` has a `Policy` with:
2934 # {enforced: false}
2935 # `projects/bar` has no `Policy` set.
2936 # The constraint at `projects/bar` and `organizations/foo` will not be
2937 # enforced.
2938 #
2939 # Example 2 (enforcement gets replaced):
2940 # `organizations/foo` has a `Policy` with:
2941 # {enforced: false}
2942 # `projects/bar` has a `Policy` with:
2943 # {enforced: true}
2944 # The constraint at `organizations/foo` is not enforced.
2945 # The constraint at `projects/bar` is enforced.
2946 #
2947 # Example 3 (RestoreDefault):
2948 # `organizations/foo` has a `Policy` with:
2949 # {enforced: true}
2950 # `projects/bar` has a `Policy` with:
2951 # {RestoreDefault: {}}
2952 # The constraint at `organizations/foo` is enforced.
2953 # The constraint at `projects/bar` is not enforced, because
2954 # `constraint_default` for the `Constraint` is `ALLOW`.
2955 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]2956 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
2957 # `constraints/serviceuser.services`.
2958 #
2959 # Immutable after creation.
2960 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
2961 # server, not specified by the caller, and represents the last time a call to
2962 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
2963 # be ignored.
2964 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
2965 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
2966 # `Constraint` type.
2967 # `constraint_default` enforcement behavior of the specific `Constraint` at
2968 # this resource.
2969 #
2970 # Suppose that `constraint_default` is set to `ALLOW` for the
2971 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
2972 # foo.com sets a `Policy` at their Organization resource node that restricts
2973 # the allowed service activations to deny all service activations. They
2974 # could then set a `Policy` with the `policy_type` `restore_default` on
2975 # several experimental projects, restoring the `constraint_default`
2976 # enforcement of the `Constraint` for only those projects, allowing those
2977 # projects to have all services activated.
2978 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]2979 }</pre>
2980</div>
2981
2982<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2983 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2984 <pre>Returns permissions that a caller has on the specified Project.
2985
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]2986There are no permissions required for making this API call.
2987
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2988Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2989 resource: string, REQUIRED: The resource for which the policy detail is being requested.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]2990See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]2991 body: object, The request body.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]2992 The object takes the form of:
2993
2994{ # Request message for `TestIamPermissions` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2995 &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with
2996 # wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]2997 # information see
2998 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]2999 &quot;A String&quot;,
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3000 ],
3001 }
3002
3003 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3004 Allowed values
3005 1 - v1 error format
3006 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3007
3008Returns:
3009 An object of the form:
3010
3011 { # Response message for `TestIamPermissions` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]3012 &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3013 # allowed.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]3014 &quot;A String&quot;,
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3015 ],
3016 }</pre>
3017</div>
3018
3019<div class="method">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3020 <code class="details" id="undelete">undelete(projectId, body=None, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3021 <pre>Restores the Project identified by the specified
3022`project_id` (for example, `my-project-123`).
3023You can only use this method for a Project that has a lifecycle state of
3024DELETE_REQUESTED.
3025After deletion starts, the Project cannot be restored.
3026
3027The caller must have modify permissions for this Project.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3028
3029Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3030 projectId: string, The project ID (for example, `foo-bar-123`).
3031
3032Required. (required)
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]3033 body: object, The request body.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3034 The object takes the form of:
3035
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3036{ # The request sent to the UndeleteProject
3037 # method.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3038 }
3039
3040 x__xgafv: string, V1 error format.
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3041 Allowed values
3042 1 - v1 error format
3043 2 - v2 error format
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3044
3045Returns:
3046 An object of the form:
3047
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3048 { # A generic empty message that you can re-use to avoid defining duplicated
3049 # empty messages in your APIs. A typical example is to use it as the request
3050 # or the response type of an API method. For instance:
3051 #
3052 # service Foo {
3053 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
3054 # }
3055 #
3056 # The JSON representation for `Empty` is empty JSON object `{}`.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3057 }</pre>
3058</div>
3059
3060<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]3061 <code class="details" id="update">update(projectId, body=None, x__xgafv=None)</code>
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3062 <pre>Updates the attributes of the Project identified by the specified
3063`project_id` (for example, `my-project-123`).
3064
3065The caller must have modify permissions for this Project.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3066
3067Args:
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3068 projectId: string, The project ID (for example, `my-project-123`).
3069
3070Required. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]3071 body: object, The request body.
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3072 The object takes the form of:
3073
Jon Wayne Parrott692617a2017-01-06 09:58:29 -0800[diff] [blame]3074{ # A Project is a high-level Google Cloud Platform entity. It is a
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]3075 # container for ACLs, APIs, App Engine Apps, VMs, and other
3076 # Google Cloud Platform resources.
3077 &quot;name&quot;: &quot;A String&quot;, # The optional user-assigned display name of the Project.
3078 # When present it must be between 4 to 30 characters.
3079 # Allowed characters are: lowercase and uppercase letters, numbers,
3080 # hyphen, single-quote, double-quote, space, and exclamation point.
3081 #
3082 # Example: &lt;code&gt;My Project&lt;/code&gt;
3083 # Read-write.
3084 &quot;projectId&quot;: &quot;A String&quot;, # The unique, user-assigned ID of the Project.
3085 # It must be 6 to 30 lowercase letters, digits, or hyphens.
3086 # It must start with a letter.
3087 # Trailing hyphens are prohibited.
3088 #
3089 # Example: &lt;code&gt;tokyo-rain-123&lt;/code&gt;
3090 # Read-only after creation.
3091 &quot;lifecycleState&quot;: &quot;A String&quot;, # The Project lifecycle state.
3092 #
3093 # Read-only.
3094 &quot;projectNumber&quot;: &quot;A String&quot;, # The number uniquely identifying the project.
3095 #
3096 # Example: &lt;code&gt;415104041262&lt;/code&gt;
3097 # Read-only.
3098 &quot;parent&quot;: { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.
3099 #
3100 # Supported parent types include &quot;organization&quot; and &quot;folder&quot;. Once set, the
3101 # parent cannot be cleared. The `parent` can be set on creation or using the
3102 # `UpdateProject` method; the end user must have the
3103 # `resourcemanager.projects.create` permission on the parent.
3104 #
3105 # Read-write.
3106 # Cloud Platform is a generic term for something you (a developer) may want to
3107 # interact with through one of our API&#x27;s. Some examples are an App Engine app,
3108 # a Compute Engine instance, a Cloud SQL database, and so on.
3109 &quot;type&quot;: &quot;A String&quot;, # Required field representing the resource type this id is for.
3110 # At present, the valid types are: &quot;organization&quot;, &quot;folder&quot;, and &quot;project&quot;.
3111 &quot;id&quot;: &quot;A String&quot;, # Required field for the type-specific id. This should correspond to the id
3112 # used in the type-specific API&#x27;s.
3113 },
3114 &quot;createTime&quot;: &quot;A String&quot;, # Creation time.
3115 #
3116 # Read-only.
3117 &quot;labels&quot;: { # The labels associated with this Project.
3118 #
3119 # Label keys must be between 1 and 63 characters long and must conform
3120 # to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.
3121 #
3122 # Label values must be between 0 and 63 characters long and must conform
3123 # to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label
3124 # value can be empty.
3125 #
3126 # No more than 256 labels can be associated with a given resource.
3127 #
3128 # Clients should store labels in a representation such as JSON that does not
3129 # depend on specific characters being disallowed.
3130 #
3131 # Example: &lt;code&gt;&quot;environment&quot; : &quot;dev&quot;&lt;/code&gt;
3132 # Read-write.
3133 &quot;a_key&quot;: &quot;A String&quot;,
3134 },
3135 }
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]3136
3137 x__xgafv: string, V1 error format.
3138 Allowed values
3139 1 - v1 error format
3140 2 - v2 error format
3141
3142Returns:
3143 An object of the form:
3144
3145 { # A Project is a high-level Google Cloud Platform entity. It is a
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]3146 # container for ACLs, APIs, App Engine Apps, VMs, and other
3147 # Google Cloud Platform resources.
3148 &quot;name&quot;: &quot;A String&quot;, # The optional user-assigned display name of the Project.
3149 # When present it must be between 4 to 30 characters.
3150 # Allowed characters are: lowercase and uppercase letters, numbers,
3151 # hyphen, single-quote, double-quote, space, and exclamation point.
3152 #
3153 # Example: &lt;code&gt;My Project&lt;/code&gt;
3154 # Read-write.
3155 &quot;projectId&quot;: &quot;A String&quot;, # The unique, user-assigned ID of the Project.
3156 # It must be 6 to 30 lowercase letters, digits, or hyphens.
3157 # It must start with a letter.
3158 # Trailing hyphens are prohibited.
3159 #
3160 # Example: &lt;code&gt;tokyo-rain-123&lt;/code&gt;
3161 # Read-only after creation.
3162 &quot;lifecycleState&quot;: &quot;A String&quot;, # The Project lifecycle state.
3163 #
3164 # Read-only.
3165 &quot;projectNumber&quot;: &quot;A String&quot;, # The number uniquely identifying the project.
3166 #
3167 # Example: &lt;code&gt;415104041262&lt;/code&gt;
3168 # Read-only.
3169 &quot;parent&quot;: { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.
3170 #
3171 # Supported parent types include &quot;organization&quot; and &quot;folder&quot;. Once set, the
3172 # parent cannot be cleared. The `parent` can be set on creation or using the
3173 # `UpdateProject` method; the end user must have the
3174 # `resourcemanager.projects.create` permission on the parent.
3175 #
3176 # Read-write.
3177 # Cloud Platform is a generic term for something you (a developer) may want to
3178 # interact with through one of our API&#x27;s. Some examples are an App Engine app,
3179 # a Compute Engine instance, a Cloud SQL database, and so on.
3180 &quot;type&quot;: &quot;A String&quot;, # Required field representing the resource type this id is for.
3181 # At present, the valid types are: &quot;organization&quot;, &quot;folder&quot;, and &quot;project&quot;.
3182 &quot;id&quot;: &quot;A String&quot;, # Required field for the type-specific id. This should correspond to the id
3183 # used in the type-specific API&#x27;s.
3184 },
3185 &quot;createTime&quot;: &quot;A String&quot;, # Creation time.
3186 #
3187 # Read-only.
3188 &quot;labels&quot;: { # The labels associated with this Project.
3189 #
3190 # Label keys must be between 1 and 63 characters long and must conform
3191 # to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.
3192 #
3193 # Label values must be between 0 and 63 characters long and must conform
3194 # to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label
3195 # value can be empty.
3196 #
3197 # No more than 256 labels can be associated with a given resource.
3198 #
3199 # Clients should store labels in a representation such as JSON that does not
3200 # depend on specific characters being disallowed.
3201 #
3202 # Example: &lt;code&gt;&quot;environment&quot; : &quot;dev&quot;&lt;/code&gt;
3203 # Read-write.
3204 &quot;a_key&quot;: &quot;A String&quot;,
3205 },
3206 }</pre>
Jon Wayne Parrott0a471d32016-05-19 10:54:38 -0700[diff] [blame]3207</div>
3208
3209</body></html>