Blame - docs/dyn/iap_v1.v1.html - platform/external/python/google-api-python-client

2020-05-20 12:08:20 -0700

[diff] [blame]

400

"policyName": { # Policy name to be checked

401

"type": "A String", # Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

402

"id": "A String",

403

"region": "A String", # For Cloud IAM:

404

# The location of the Policy.

405

# Must be empty or "global" for Policies owned by global IAM. Must name a

406

# region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see

407

# go/iam-faq#where-is-iam-currently-deployed.

408

#

409

# For Local IAM:

410

# This field should be set to "local".

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

411

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

412

"resource": { # IAM resource to check permission on

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

413

"labels": { # The service defined labels of the resource on which the conditions will be

414

# evaluated. The semantics - including the key names - are vague to IAM.

415

# If the effective condition has a reference to a `resource.labels[foo]`

416

# construct, IAM consults with this map to retrieve the values associated

417

# with `foo` key for Conditions evaluation. If the provided key is not found

418

# in the labels map, the condition would evaluate to false.

419

#

420

# This field is in limited use. If your intended use case is not expected

421

# to express resource.labels attribute in IAM Conditions, leave this field

422

# empty. Before planning on using this attribute please:

423

# * Read go/iam-conditions-labels-comm and ensure your service can meet the

424

# data availability and management requirements.

425

# * Talk to iam-conditions-eng@ about your use case.

426

"a_key": "A String",

427

},

428

"service": "A String", # The name of the service this resource belongs to. It is configured using

429

# the official_service_name of the Service as defined in service

430

# configurations under //configs/cloud/resourcetypes.

431

# For example, the official_service_name of cloud resource manager service

432

# is set as 'cloudresourcemanager.googleapis.com' according to

433

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

434

"name": "A String", # Name of the resource on which conditions will be evaluated.

435

# Must use the Relative Resource Name of the resource, which is the URI

436

# path of the resource without the leading "/". Examples are

437

# "projects/_/buckets/[BUCKET-ID]" for storage buckets or

438

# "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

439

#

440

# This field is required for evaluating conditions with rules on resource

441

# names. For a `list` permission check, the resource.name value must be set

442

# to the parent resource. If the parent resource is a project, this field

443

# should be left unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

444

"type": "A String", # The public resource type name of the resource on which conditions will be

445

# evaluated. It is configured using the official_name of the ResourceType as

446

# defined in service configurations under //configs/cloud/resourcetypes.

447

# For example, the official_name for GCP projects is set as

448

# 'cloudresourcemanager.googleapis.com/Project' according to

449

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

450

# For details see go/iam-conditions-integration-guide.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

451

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

452

"iamServiceName": "A String", # The DNS name of the service (e.g. "resourcemanager.googleapis.com").

453

# This should be the domain name part of the full resource names (see

454

# https://aip.dev/122#full-resource-names), which is usually

455

# the same as IamServiceSpec.service of the service where the resource type

456

# is defined.

457

"iamPermission": "A String", # Permission to check in IAM.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

458

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

459

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

460

"name": "A String", # Required. The resource name of the IAP protected resource.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

461

"applicationSettings": { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP

462

"csmSettings": { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP's behavior for a CSM mesh.

463

# RCTokens are IAP generated JWTs that can be verified at the application. The

464

# RCToken is primarily used for ISTIO deployments, and can be scoped to a

465

# single mesh by configuring the audience field accordingly

466

"rctokenAud": "A String", # Audience claim set in the generated RCToken. This value is not validated by

467

# IAP.

468

},

469

"cookieDomain": "A String", # The Domain value to set for cookies generated by IAP. This value is not

470

# validated by the API, but will be ignored at runtime if invalid.

471

"accessDeniedPageSettings": { # Custom content configuration for access denied page. # Customization for Access Denied page.

472

# IAP allows customers to define a custom URI to use as the error page when

473

# access is denied to users. If IAP prevents access to this page, the default

474

# IAP error page will be displayed instead.

475

"accessDeniedPageUri": "A String", # The URI to be redirected to when access is denied.

476

},

477

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

478

}</pre>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

</div>

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

483

<pre>Sets the access control policy for an Identity-Aware Proxy protected

484

resource. Replaces any existing policy.

485

More information about managing access via IAP can be found at:

486

https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api

487

488

Args:

489

resource: string, REQUIRED: The resource for which the policy is being specified.

490

See the operation documentation for the appropriate value for this field. (required)

491

body: object, The request body.

492

The object takes the form of:

493

494

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

495

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

496

# the policy is limited to a few 10s of KB. An empty policy is a

497

# valid policy but certain Cloud Platform services (such as Projects)

498

# might reject them.

499

# controls for Google Cloud resources.

500

#

501

#

502

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

503

# `members` to a single `role`. Members can be user accounts, service accounts,

504

# Google groups, and domains (such as G Suite). A `role` is a named list of

505

# permissions; each `role` can be an IAM predefined role or a user-created

506

# custom role.

507

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

508

# For some types of Google Cloud resources, a `binding` can also specify a

509

# `condition`, which is a logical expression that allows access to a resource

510

# only if the expression evaluates to `true`. A condition can add constraints

511

# based on attributes of the request, the resource, or both. To learn which

512

# resources support conditions in their IAM policies, see the

513

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

#

# **JSON example:**

#

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

518

# "bindings": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

519

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

520

# "role": "roles/resourcemanager.organizationAdmin",

521

# "members": [

522

# "user:mike@example.com",

523

# "group:admins@example.com",

524

# "domain:google.com",

525

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

526

# ]

527

# },

528

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

529

# "role": "roles/resourcemanager.organizationViewer",

530

# "members": [

531

# "user:eve@example.com"

532

# ],

533

# "condition": {

534

# "title": "expirable access",

535

# "description": "Does not grant access after Sep 2020",

536

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

537

# }

538

# }

539

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

540

# "etag": "BwWWja0YfJA=",

541

# "version": 3

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

549

# - group:admins@example.com

550

# - domain:google.com

551

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

552

# role: roles/resourcemanager.organizationAdmin

553

# - members:

554

# - user:eve@example.com

555

# role: roles/resourcemanager.organizationViewer

556

# condition:

557

# title: expirable access

558

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

559

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

560

# - etag: BwWWja0YfJA=

561

# - version: 3

562

#

563

# For a description of IAM and its features, see the

564

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

565

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

566

# prevent simultaneous updates of a policy from overwriting each other.

567

# It is strongly suggested that systems make use of the `etag` in the

568

# read-modify-write cycle to perform policy updates in order to avoid race

569

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

570

# systems are expected to put that etag in the request to `setIamPolicy` to

571

# ensure that their change will be applied to the same version of the policy.

572

#

573

# **Important:** If you use IAM Conditions, you must include the `etag` field

574

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

575

# you to overwrite a version `3` policy with a version `1` policy, and all of

576

# the conditions in the version `3` policy are lost.

577

"version": 42, # Specifies the format of the policy.

578

#

579

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

580

# are rejected.

581

#

582

# Any operation that affects conditional role bindings must specify version

583

# `3`. This requirement applies to the following operations:

584

#

585

# * Getting a policy that includes a conditional role binding

586

# * Adding a conditional role binding to a policy

587

# * Changing a conditional role binding in a policy

588

# * Removing any role binding, with or without a condition, from a policy

589

# that includes conditions

590

#

591

# **Important:** If you use IAM Conditions, you must include the `etag` field

592

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

593

# you to overwrite a version `3` policy with a version `1` policy, and all of

594

# the conditions in the version `3` policy are lost.

595

#

596

# If a policy does not include any conditions, operations on that policy may

597

# specify any valid version or leave the field unset.

598

#

599

# To learn which resources support conditions in their IAM policies, see the

600

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

601

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

602

# `condition` that determines how and when the `bindings` are applied. Each

603

# of the `bindings` must contain at least one member.

604

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

605

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

606

# `members` can have the following values:

607

#

608

# * `allUsers`: A special identifier that represents anyone who is

609

# on the internet; with or without a Google account.

610

#

611

# * `allAuthenticatedUsers`: A special identifier that represents anyone

612

# who is authenticated with a Google account or a service account.

613

#

614

# * `user:{emailid}`: An email address that represents a specific Google

615

# account. For example, `alice@example.com` .

616

#

617

#

618

# * `serviceAccount:{emailid}`: An email address that represents a service

619

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

620

#

621

# * `group:{emailid}`: An email address that represents a Google group.

622

# For example, `admins@example.com`.

623

#

624

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

625

# identifier) representing a user that has been recently deleted. For

626

# example, `alice@example.com?uid=123456789012345678901`. If the user is

627

# recovered, this value reverts to `user:{emailid}` and the recovered user

628

# retains the role in the binding.

629

#

630

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

631

# unique identifier) representing a service account that has been recently

632

# deleted. For example,

633

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

634

# If the service account is undeleted, this value reverts to

635

# `serviceAccount:{emailid}` and the undeleted service account retains the

636

# role in the binding.

637

#

638

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

639

# identifier) representing a Google group that has been recently

640

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

641

# the group is recovered, this value reverts to `group:{emailid}` and the

642

# recovered group retains the role in the binding.

643

#

644

#

645

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

646

# users of that domain. For example, `google.com` or `example.com`.

647

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

648

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

649

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

650

"role": "A String", # Role that is assigned to `members`.

651

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

652

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

653

#

654

# If the condition evaluates to `true`, then this binding applies to the

655

# current request.

656

#

657

# If the condition evaluates to `false`, then this binding does not apply to

658

# the current request. However, a different role binding might grant the same

659

# role to one or more of the members in this binding.

660

#

661

# To learn which resources support conditions in their IAM policies, see the

662

# [IAM

663

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

664

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

665

# are documented at https://github.com/google/cel-spec.

666

#

667

# Example (Comparison):

668

#

669

# title: "Summary size limit"

670

# description: "Determines if a summary is less than 100 chars"

671

# expression: "document.summary.size() < 100"

672

#

673

# Example (Equality):

674

#

675

# title: "Requestor is owner"

676

# description: "Determines if requestor is the document owner"

677

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

682

# description: "Determine whether the document should be publicly visible"

683

# expression: "document.type != 'private' && document.type != 'internal'"

684

#

685

# Example (Data Manipulation):

686

#

687

# title: "Notification string"

688

# description: "Create a notification string with a timestamp."

689

# expression: "'New message received at ' + string(document.create_time)"

690

#

691

# The exact variables and functions that may be referenced within an expression

692

# are determined by the service that evaluates it. See the service

693

# documentation for additional information.

694

"description": "A String", # Optional. Description of the expression. This is a longer text which

695

# describes the expression, e.g. when hovered over it in a UI.

696

"expression": "A String", # Textual representation of an expression in Common Expression Language

697

# syntax.

698

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

699

# its purpose. This can be used e.g. in UIs which allow to enter the

700

# expression.

701

"location": "A String", # Optional. String indicating the location of the expression for error

702

# reporting, e.g. a file name and a position in the file.

703

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

704

},

705

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

716

717

{ # An Identity and Access Management (IAM) policy, which specifies access

718

# controls for Google Cloud resources.

719

#

720

#

721

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

722

# `members` to a single `role`. Members can be user accounts, service accounts,

723

# Google groups, and domains (such as G Suite). A `role` is a named list of

724

# permissions; each `role` can be an IAM predefined role or a user-created

725

# custom role.

726

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

727

# For some types of Google Cloud resources, a `binding` can also specify a

728

# `condition`, which is a logical expression that allows access to a resource

729

# only if the expression evaluates to `true`. A condition can add constraints

730

# based on attributes of the request, the resource, or both. To learn which

731

# resources support conditions in their IAM policies, see the

732

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

#

# **JSON example:**

#

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

737

# "bindings": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

738

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

739

# "role": "roles/resourcemanager.organizationAdmin",

740

# "members": [

741

# "user:mike@example.com",

742

# "group:admins@example.com",

743

# "domain:google.com",

744

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

745

# ]

746

# },

747

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

748

# "role": "roles/resourcemanager.organizationViewer",

749

# "members": [

750

# "user:eve@example.com"

751

# ],

752

# "condition": {

753

# "title": "expirable access",

754

# "description": "Does not grant access after Sep 2020",

755

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

756

# }

757

# }

758

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

759

# "etag": "BwWWja0YfJA=",

760

# "version": 3

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

768

# - group:admins@example.com

769

# - domain:google.com

770

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

771

# role: roles/resourcemanager.organizationAdmin

772

# - members:

773

# - user:eve@example.com

774

# role: roles/resourcemanager.organizationViewer

775

# condition:

776

# title: expirable access

777

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

778

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

779

# - etag: BwWWja0YfJA=

780

# - version: 3

781

#

782

# For a description of IAM and its features, see the

783

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

784

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

785

# prevent simultaneous updates of a policy from overwriting each other.

786

# It is strongly suggested that systems make use of the `etag` in the

787

# read-modify-write cycle to perform policy updates in order to avoid race

788

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

789

# systems are expected to put that etag in the request to `setIamPolicy` to

790

# ensure that their change will be applied to the same version of the policy.

791

#

792

# **Important:** If you use IAM Conditions, you must include the `etag` field

793

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

794

# you to overwrite a version `3` policy with a version `1` policy, and all of

795

# the conditions in the version `3` policy are lost.

796

"version": 42, # Specifies the format of the policy.

797

#

798

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

799

# are rejected.

800

#

801

# Any operation that affects conditional role bindings must specify version

802

# `3`. This requirement applies to the following operations:

803

#

804

# * Getting a policy that includes a conditional role binding

805

# * Adding a conditional role binding to a policy

806

# * Changing a conditional role binding in a policy

807

# * Removing any role binding, with or without a condition, from a policy

808

# that includes conditions

809

#

810

# **Important:** If you use IAM Conditions, you must include the `etag` field

811

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

812

# you to overwrite a version `3` policy with a version `1` policy, and all of

813

# the conditions in the version `3` policy are lost.

814

#

815

# If a policy does not include any conditions, operations on that policy may

816

# specify any valid version or leave the field unset.

817

#

818

# To learn which resources support conditions in their IAM policies, see the

819

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

820

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

821

# `condition` that determines how and when the `bindings` are applied. Each

822

# of the `bindings` must contain at least one member.

823

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

824

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

825

# `members` can have the following values:

826

#

827

# * `allUsers`: A special identifier that represents anyone who is

828

# on the internet; with or without a Google account.

829

#

830

# * `allAuthenticatedUsers`: A special identifier that represents anyone

831

# who is authenticated with a Google account or a service account.

832

#

833

# * `user:{emailid}`: An email address that represents a specific Google

834

# account. For example, `alice@example.com` .

835

#

836

#

837

# * `serviceAccount:{emailid}`: An email address that represents a service

838

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

839

#

840

# * `group:{emailid}`: An email address that represents a Google group.

841

# For example, `admins@example.com`.

842

#

843

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

844

# identifier) representing a user that has been recently deleted. For

845

# example, `alice@example.com?uid=123456789012345678901`. If the user is

846

# recovered, this value reverts to `user:{emailid}` and the recovered user

847

# retains the role in the binding.

848

#

849

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

850

# unique identifier) representing a service account that has been recently

851

# deleted. For example,

852

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

853

# If the service account is undeleted, this value reverts to

854

# `serviceAccount:{emailid}` and the undeleted service account retains the

855

# role in the binding.

856

#

857

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

858

# identifier) representing a Google group that has been recently

859

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

860

# the group is recovered, this value reverts to `group:{emailid}` and the

861

# recovered group retains the role in the binding.

862

#

863

#

864

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

865

# users of that domain. For example, `google.com` or `example.com`.

866

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

867

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

868

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

869

"role": "A String", # Role that is assigned to `members`.

870

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

871

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

872

#

873

# If the condition evaluates to `true`, then this binding applies to the

874

# current request.

875

#

876

# If the condition evaluates to `false`, then this binding does not apply to

877

# the current request. However, a different role binding might grant the same

878

# role to one or more of the members in this binding.

879

#

880

# To learn which resources support conditions in their IAM policies, see the

881

# [IAM

882

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

883

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

884

# are documented at https://github.com/google/cel-spec.

885

#

886

# Example (Comparison):

887

#

888

# title: "Summary size limit"

889

# description: "Determines if a summary is less than 100 chars"

890

# expression: "document.summary.size() < 100"

891

#

892

# Example (Equality):

893

#

894

# title: "Requestor is owner"

895

# description: "Determines if requestor is the document owner"

896

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

901

# description: "Determine whether the document should be publicly visible"

902

# expression: "document.type != 'private' && document.type != 'internal'"

903

#

904

# Example (Data Manipulation):

905

#

906

# title: "Notification string"

907

# description: "Create a notification string with a timestamp."

908

# expression: "'New message received at ' + string(document.create_time)"

909

#

910

# The exact variables and functions that may be referenced within an expression

911

# are determined by the service that evaluates it. See the service

912

# documentation for additional information.

913

"description": "A String", # Optional. Description of the expression. This is a longer text which

914

# describes the expression, e.g. when hovered over it in a UI.

915

"expression": "A String", # Textual representation of an expression in Common Expression Language

916

# syntax.

917

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

918

# its purpose. This can be used e.g. in UIs which allow to enter the

919

# expression.

920

"location": "A String", # Optional. String indicating the location of the expression for error

921

# reporting, e.g. a file name and a position in the file.

922

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

923

},

924

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

930

<pre>Returns permissions that a caller has on the Identity-Aware Proxy protected

931

resource.

932

More information about managing access via IAP can be found at:

933

https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api

934

935

Args:

936

resource: string, REQUIRED: The resource for which the policy detail is being requested.

937

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

938

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

939

The object takes the form of:

940

941

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

942

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

943

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

944

# information see

945

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

946

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

957

958

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

959

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

960

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

961

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

966

967

<code class="details" id="updateIapSettings">updateIapSettings(name, body=None, updateMask=None, x__xgafv=None)</code>

968

<pre>Updates the IAP settings on a particular IAP protected resource. It

969

replaces all fields unless the `update_mask` is set.

970

971

Args:

972

name: string, Required. The resource name of the IAP protected resource. (required)

973

body: object, The request body.

974

The object takes the form of:

975

976

{ # The IAP configurable settings.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

977

"accessSettings": { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

978

"oauthSettings": { # Configuration for OAuth login&consent flow behavior as well as for OAuth # Settings to configure IAP's OAuth behavior.

979

# Credentials.

980

"clientId": "A String", # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If

981

# this field is set, you can skip obtaining the OAuth credentials in this

982

# step:

983

# https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.

984

# However, this could allow for client sharing. The risks of client sharing

985

# are outlined here:

986

# https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.

987

"loginHint": "A String", # Domain hint to send as hd=? parameter in OAuth request flow. Enables

988

# redirect to primary IDP by skipping Google's login screen.

989

# https://developers.google.com/identity/protocols/OpenIDConnect#hd-param

990

# Note: IAP does not verify that the id token's hd claim matches this value

991

# since access behavior is managed by IAM policies.

992

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

993

"corsSettings": { # Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.

994

# call to bypass authentication and authorization.

995

"allowHttpOptions": True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If

996

# undefined, IAP will not apply any special logic to OPTIONS requests.

997

},

998

"gcipSettings": { # Allows customers to configure tenant_id for GCIP instance per-app. # GCIP claims and endpoint configurations for 3p identity providers.

999

"loginPageUri": "A String", # Login page URI associated with the GCIP tenants.

1000

# Typically, all resources within the same project share the same login page,

1001

# though it could be overridden at the sub resource level.

1002

"tenantIds": [ # GCIP tenant ids that are linked to the IAP resource.

1003

# tenant_ids could be a string beginning with a number character to indicate

1004

# authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>

1005

# to indicate authenticating with GCIP agent flow.

1006

# If agent flow is used, tenant_ids should only contain one single element,

1007

# while for tenant flow, tenant_ids can contain multiple elements.

"A String",

],

},

"policyDelegationSettings": { # PolicyDelegationConfig allows google-internal teams to use IAP for apps # Settings to configure Policy delegation for apps hosted in tenant projects.

1012

# INTERNAL_ONLY.

1013

# hosted in a tenant project. Using these settings, the app can delegate

1014

# permission check to happen against the linked customer project.

1015

# This is only ever supposed to be used by google internal teams, hence the

1016

# restriction on the proto.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1017

"policyName": { # Policy name to be checked

1018

"type": "A String", # Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

1019

"id": "A String",

1020

"region": "A String", # For Cloud IAM:

1021

# The location of the Policy.

1022

# Must be empty or "global" for Policies owned by global IAM. Must name a

1023

# region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see

1024

# go/iam-faq#where-is-iam-currently-deployed.

1025

#

1026

# For Local IAM:

1027

# This field should be set to "local".

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1028

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1029

"resource": { # IAM resource to check permission on

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1030

"labels": { # The service defined labels of the resource on which the conditions will be

1031

# evaluated. The semantics - including the key names - are vague to IAM.

1032

# If the effective condition has a reference to a `resource.labels[foo]`

1033

# construct, IAM consults with this map to retrieve the values associated

1034

# with `foo` key for Conditions evaluation. If the provided key is not found

1035

# in the labels map, the condition would evaluate to false.

1036

#

1037

# This field is in limited use. If your intended use case is not expected

1038

# to express resource.labels attribute in IAM Conditions, leave this field

1039

# empty. Before planning on using this attribute please:

1040

# * Read go/iam-conditions-labels-comm and ensure your service can meet the

1041

# data availability and management requirements.

1042

# * Talk to iam-conditions-eng@ about your use case.

1043

"a_key": "A String",

1044

},

1045

"service": "A String", # The name of the service this resource belongs to. It is configured using

1046

# the official_service_name of the Service as defined in service

1047

# configurations under //configs/cloud/resourcetypes.

1048

# For example, the official_service_name of cloud resource manager service

1049

# is set as 'cloudresourcemanager.googleapis.com' according to

1050

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1051

"name": "A String", # Name of the resource on which conditions will be evaluated.

1052

# Must use the Relative Resource Name of the resource, which is the URI

1053

# path of the resource without the leading "/". Examples are

1054

# "projects/_/buckets/[BUCKET-ID]" for storage buckets or

1055

# "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

1056

#

1057

# This field is required for evaluating conditions with rules on resource

1058

# names. For a `list` permission check, the resource.name value must be set

1059

# to the parent resource. If the parent resource is a project, this field

1060

# should be left unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1061

"type": "A String", # The public resource type name of the resource on which conditions will be

1062

# evaluated. It is configured using the official_name of the ResourceType as

1063

# defined in service configurations under //configs/cloud/resourcetypes.

1064

# For example, the official_name for GCP projects is set as

1065

# 'cloudresourcemanager.googleapis.com/Project' according to

1066

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1067

# For details see go/iam-conditions-integration-guide.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1068

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1069

"iamServiceName": "A String", # The DNS name of the service (e.g. "resourcemanager.googleapis.com").

1070

# This should be the domain name part of the full resource names (see

1071

# https://aip.dev/122#full-resource-names), which is usually

1072

# the same as IamServiceSpec.service of the service where the resource type

1073

# is defined.

1074

"iamPermission": "A String", # Permission to check in IAM.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1075

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1076

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1077

"name": "A String", # Required. The resource name of the IAP protected resource.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1078

"applicationSettings": { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP

1079

"csmSettings": { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP's behavior for a CSM mesh.

1080

# RCTokens are IAP generated JWTs that can be verified at the application. The

1081

# RCToken is primarily used for ISTIO deployments, and can be scoped to a

1082

# single mesh by configuring the audience field accordingly

1083

"rctokenAud": "A String", # Audience claim set in the generated RCToken. This value is not validated by

1084

# IAP.

1085

},

1086

"cookieDomain": "A String", # The Domain value to set for cookies generated by IAP. This value is not

1087

# validated by the API, but will be ignored at runtime if invalid.

1088

"accessDeniedPageSettings": { # Custom content configuration for access denied page. # Customization for Access Denied page.

1089

# IAP allows customers to define a custom URI to use as the error page when

1090

# access is denied to users. If IAP prevents access to this page, the default

1091

# IAP error page will be displayed instead.

1092

"accessDeniedPageUri": "A String", # The URI to be redirected to when access is denied.

1093

},

1094

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1095

}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1096

1097

updateMask: string, The field mask specifying which IAP settings should be updated.

1098

If omitted, the all of the settings are updated. See

1099

https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask

1100

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1107

1108

{ # The IAP configurable settings.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1109

"accessSettings": { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1110

"oauthSettings": { # Configuration for OAuth login&consent flow behavior as well as for OAuth # Settings to configure IAP's OAuth behavior.

1111

# Credentials.

1112

"clientId": "A String", # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If

1113

# this field is set, you can skip obtaining the OAuth credentials in this

1114

# step:

1115

# https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.

1116

# However, this could allow for client sharing. The risks of client sharing

1117

# are outlined here:

1118

# https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.

1119

"loginHint": "A String", # Domain hint to send as hd=? parameter in OAuth request flow. Enables

1120

# redirect to primary IDP by skipping Google's login screen.

1121

# https://developers.google.com/identity/protocols/OpenIDConnect#hd-param

1122

# Note: IAP does not verify that the id token's hd claim matches this value

1123

# since access behavior is managed by IAM policies.

1124

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1125

"corsSettings": { # Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.

1126

# call to bypass authentication and authorization.

1127

"allowHttpOptions": True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If

1128

# undefined, IAP will not apply any special logic to OPTIONS requests.

1129

},

1130

"gcipSettings": { # Allows customers to configure tenant_id for GCIP instance per-app. # GCIP claims and endpoint configurations for 3p identity providers.

1131

"loginPageUri": "A String", # Login page URI associated with the GCIP tenants.

1132

# Typically, all resources within the same project share the same login page,

1133

# though it could be overridden at the sub resource level.

1134

"tenantIds": [ # GCIP tenant ids that are linked to the IAP resource.

1135

# tenant_ids could be a string beginning with a number character to indicate

1136

# authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>

1137

# to indicate authenticating with GCIP agent flow.

1138

# If agent flow is used, tenant_ids should only contain one single element,

1139

# while for tenant flow, tenant_ids can contain multiple elements.

"A String",

],

},

"policyDelegationSettings": { # PolicyDelegationConfig allows google-internal teams to use IAP for apps # Settings to configure Policy delegation for apps hosted in tenant projects.

1144

# INTERNAL_ONLY.

1145

# hosted in a tenant project. Using these settings, the app can delegate

1146

# permission check to happen against the linked customer project.

1147

# This is only ever supposed to be used by google internal teams, hence the

1148

# restriction on the proto.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1149

"policyName": { # Policy name to be checked

1150

"type": "A String", # Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

1151

"id": "A String",

1152

"region": "A String", # For Cloud IAM:

1153

# The location of the Policy.

1154

# Must be empty or "global" for Policies owned by global IAM. Must name a

1155

# region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see

1156

# go/iam-faq#where-is-iam-currently-deployed.

1157

#

1158

# For Local IAM:

1159

# This field should be set to "local".

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1160

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1161

"resource": { # IAM resource to check permission on

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1162

"labels": { # The service defined labels of the resource on which the conditions will be

1163

# evaluated. The semantics - including the key names - are vague to IAM.

1164

# If the effective condition has a reference to a `resource.labels[foo]`

1165

# construct, IAM consults with this map to retrieve the values associated

1166

# with `foo` key for Conditions evaluation. If the provided key is not found

1167

# in the labels map, the condition would evaluate to false.

1168

#

1169

# This field is in limited use. If your intended use case is not expected

1170

# to express resource.labels attribute in IAM Conditions, leave this field

1171

# empty. Before planning on using this attribute please:

1172

# * Read go/iam-conditions-labels-comm and ensure your service can meet the

1173

# data availability and management requirements.

1174

# * Talk to iam-conditions-eng@ about your use case.

1175

"a_key": "A String",

1176

},

1177

"service": "A String", # The name of the service this resource belongs to. It is configured using

1178

# the official_service_name of the Service as defined in service

1179

# configurations under //configs/cloud/resourcetypes.

1180

# For example, the official_service_name of cloud resource manager service

1181

# is set as 'cloudresourcemanager.googleapis.com' according to

1182

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1183

"name": "A String", # Name of the resource on which conditions will be evaluated.

1184

# Must use the Relative Resource Name of the resource, which is the URI

1185

# path of the resource without the leading "/". Examples are

1186

# "projects/_/buckets/[BUCKET-ID]" for storage buckets or

1187

# "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

1188

#

1189

# This field is required for evaluating conditions with rules on resource

1190

# names. For a `list` permission check, the resource.name value must be set

1191

# to the parent resource. If the parent resource is a project, this field

1192

# should be left unset.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1193

"type": "A String", # The public resource type name of the resource on which conditions will be

1194

# evaluated. It is configured using the official_name of the ResourceType as

1195

# defined in service configurations under //configs/cloud/resourcetypes.

1196

# For example, the official_name for GCP projects is set as

1197

# 'cloudresourcemanager.googleapis.com/Project' according to

1198

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1199

# For details see go/iam-conditions-integration-guide.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1200

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1201

"iamServiceName": "A String", # The DNS name of the service (e.g. "resourcemanager.googleapis.com").

1202

# This should be the domain name part of the full resource names (see

1203

# https://aip.dev/122#full-resource-names), which is usually

1204

# the same as IamServiceSpec.service of the service where the resource type

1205

# is defined.

1206

"iamPermission": "A String", # Permission to check in IAM.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1207

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1208

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1209

"name": "A String", # Required. The resource name of the IAP protected resource.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1210

"applicationSettings": { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP

1211

"csmSettings": { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP's behavior for a CSM mesh.

1212

# RCTokens are IAP generated JWTs that can be verified at the application. The

1213

# RCToken is primarily used for ISTIO deployments, and can be scoped to a

1214

# single mesh by configuring the audience field accordingly

1215

"rctokenAud": "A String", # Audience claim set in the generated RCToken. This value is not validated by

1216

# IAP.

1217

},

1218

"cookieDomain": "A String", # The Domain value to set for cookies generated by IAP. This value is not

1219

# validated by the API, but will be ignored at runtime if invalid.

1220

"accessDeniedPageSettings": { # Custom content configuration for access denied page. # Customization for Access Denied page.

1221

# IAP allows customers to define a custom URI to use as the error page when

1222

# access is denied to users. If IAP prevents access to this page, the default

1223

# IAP error page will be displayed instead.

1224

"accessDeniedPageUri": "A String", # The URI to be redirected to when access is denied.

1225

},

1226

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1227

}</pre>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1228

</div>

1229

Bu Sun Kim