Blame - docs/dyn/bigtableadmin_v2.projects.instances.clusters.backups.html - platform/external/python/google-api-python-client

<h1><a href="bigtableadmin_v2.html">Cloud Bigtable Admin API</a> . <a href="bigtableadmin_v2.projects.html">projects</a> . <a href="bigtableadmin_v2.projects.instances.html">instances</a> . <a href="bigtableadmin_v2.projects.instances.clusters.html">clusters</a> . <a href="bigtableadmin_v2.projects.instances.clusters.backups.html">backups</a></h1>

76

<h2>Instance Methods</h2>

77

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

78

<code><a href="#create">create(parent, body=None, backupId=None, x__xgafv=None)</a></code></p>

79

<p class="firstline">Starts creating a new Cloud Bigtable Backup. The returned backup</p>

80

81

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

82

<p class="firstline">Deletes a pending or completed Cloud Bigtable backup.</p>

83

84

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

85

<p class="firstline">Gets metadata on a pending or completed Cloud Bigtable Backup.</p>

86

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

87

<code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

88

<p class="firstline">Gets the access control policy for a Table resource.</p>

89

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

90

<code><a href="#list">list(parent, pageSize=None, pageToken=None, filter=None, orderBy=None, x__xgafv=None)</a></code></p>

91

<p class="firstline">Lists Cloud Bigtable backups. Returns both completed and pending</p>

92

93

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

94

<p class="firstline">Retrieves the next page of results.</p>

95

96

<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>

97

<p class="firstline">Updates a pending or completed Cloud Bigtable Backup.</p>

98

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

99

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

100

<p class="firstline">Sets the access control policy on a Table resource.</p>

101

102

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

103

<p class="firstline">Returns permissions that the caller has on the specified table resource.</p>

104

<h3>Method Details</h3>

105

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

106

<code class="details" id="create">create(parent, body=None, backupId=None, x__xgafv=None)</code>

107

<pre>Starts creating a new Cloud Bigtable Backup. The returned backup

108

long-running operation can be used to

109

track creation of the backup. The

110

metadata field type is

111

CreateBackupMetadata. The

112

response field type is

113

Backup, if successful. Cancelling the returned operation will stop the

114

creation and delete the backup.

115

116

Args:

117

parent: string, Required. This must be one of the clusters in the instance in which this

118

table is located. The backup will be stored in this cluster. Values are

119

of the form `projects/{project}/instances/{instance}/clusters/{cluster}`. (required)

120

body: object, The request body.

121

The object takes the form of:

122

123

{ # A backup of a Cloud Bigtable table.

124

"startTime": "A String", # Output only. `start_time` is the time that the backup was started

125

# (i.e. approximately the time the

126

# CreateBackup request is received). The

127

# row data in this backup will be no older than this timestamp.

128

"state": "A String", # Output only. The current state of the backup.

129

"sizeBytes": "A String", # Output only. Size of the backup in bytes.

130

"name": "A String", # A globally unique identifier for the backup which cannot be

131

# changed. Values are of the form

132

# `projects/{project}/instances/{instance}/clusters/{cluster}/

133

# backups/_a-zA-Z0-9*`

134

# The final segment of the name must be between 1 and 50 characters

135

# in length.

136

#

137

# The backup is stored in the cluster identified by the prefix of the backup

138

# name of the form

139

# `projects/{project}/instances/{instance}/clusters/{cluster}`.

140

"endTime": "A String", # Output only. `end_time` is the time that the backup was finished. The row

141

# data in the backup will be no newer than this timestamp.

142

"sourceTable": "A String", # Required. Immutable. Name of the table from which this backup was created. This needs

143

# to be in the same instance as the backup. Values are of the form

144

# `projects/{project}/instances/{instance}/tables/{source_table}`.

145

"expireTime": "A String", # Required. The expiration time of the backup, with microseconds

146

# granularity that must be at least 6 hours and at most 30 days

147

# from the time the request is received. Once the `expire_time`

148

# has passed, Cloud Bigtable will delete the backup and free the

149

# resources used by the backup.

150

}

151

152

backupId: string, Required. The id of the backup to be created. The `backup_id` along with

153

the parent `parent` are combined as {parent}/backups/{backup_id} to create

154

the full backup name, of the form:

155

`projects/{project}/instances/{instance}/clusters/{cluster}/backups/{backup_id}`.

156

This string must be between 1 and 50 characters in length and match the

157

regex _a-zA-Z0-9*.

158

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

165

166

{ # This resource represents a long-running operation that is the result of a

167

# network API call.

168

"metadata": { # Service-specific metadata associated with the operation. It typically

169

# contains progress information and common metadata such as create time.

170

# Some services might not provide such metadata. Any method that returns a

171

# long-running operation should document the metadata type, if any.

172

"a_key": "", # Properties of the object. Contains field @type with type URL.

173

},

174

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

175

# different programming environments, including REST APIs and RPC APIs. It is

176

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

177

# three pieces of data: error code, error message, and error details.

178

#

179

# You can find out more about this error model and how to work with it in the

180

# [API Design Guide](https://cloud.google.com/apis/design/errors).

181

"details": [ # A list of messages that carry the error details. There is a common set of

182

# message types for APIs to use.

183

{

184

"a_key": "", # Properties of the object. Contains field @type with type URL.

185

},

186

],

187

"message": "A String", # A developer-facing error message, which should be in English. Any

188

# user-facing error message should be localized and sent in the

189

# google.rpc.Status.details field, or localized by the client.

190

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

191

},

192

"response": { # The normal response of the operation in case of success. If the original

193

# method returns no data on success, such as `Delete`, the response is

194

# `google.protobuf.Empty`. If the original method is standard

195

# `Get`/`Create`/`Update`, the response should be the resource. For other

196

# methods, the response should have the type `XxxResponse`, where `Xxx`

197

# is the original method name. For example, if the original method name

198

# is `TakeSnapshot()`, the inferred response type is

199

# `TakeSnapshotResponse`.

200

"a_key": "", # Properties of the object. Contains field @type with type URL.

201

},

202

"name": "A String", # The server-assigned name, which is only unique within the same service that

203

# originally returns it. If you use the default HTTP mapping, the

204

# `name` should be a resource name ending with `operations/{unique_id}`.

205

"done": True or False, # If the value is `false`, it means the operation is still in progress.

206

# If `true`, the operation is completed, and either `error` or `response` is

# available.

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

213

<pre>Deletes a pending or completed Cloud Bigtable backup.

Args:

Values are of the form

218

`projects/{project}/instances/{instance}/clusters/{cluster}/backups/{backup}`. (required)

219

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

226

227

{ # A generic empty message that you can re-use to avoid defining duplicated

228

# empty messages in your APIs. A typical example is to use it as the request

229

# or the response type of an API method. For instance:

230

#

231

# service Foo {

232

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

233

# }

234

#

235

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

241

<pre>Gets metadata on a pending or completed Cloud Bigtable Backup.

Args:

Values are of the form

246

`projects/{project}/instances/{instance}/clusters/{cluster}/backups/{backup}`. (required)

247

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

254

255

{ # A backup of a Cloud Bigtable table.

256

"startTime": "A String", # Output only. `start_time` is the time that the backup was started

257

# (i.e. approximately the time the

258

# CreateBackup request is received). The

259

# row data in this backup will be no older than this timestamp.

260

"state": "A String", # Output only. The current state of the backup.

261

"sizeBytes": "A String", # Output only. Size of the backup in bytes.

262

"name": "A String", # A globally unique identifier for the backup which cannot be

263

# changed. Values are of the form

264

# `projects/{project}/instances/{instance}/clusters/{cluster}/

265

# backups/_a-zA-Z0-9*`

266

# The final segment of the name must be between 1 and 50 characters

267

# in length.

268

#

269

# The backup is stored in the cluster identified by the prefix of the backup

270

# name of the form

271

# `projects/{project}/instances/{instance}/clusters/{cluster}`.

272

"endTime": "A String", # Output only. `end_time` is the time that the backup was finished. The row

273

# data in the backup will be no newer than this timestamp.

274

"sourceTable": "A String", # Required. Immutable. Name of the table from which this backup was created. This needs

275

# to be in the same instance as the backup. Values are of the form

276

# `projects/{project}/instances/{instance}/tables/{source_table}`.

277

"expireTime": "A String", # Required. The expiration time of the backup, with microseconds

278

# granularity that must be at least 6 hours and at most 30 days

279

# from the time the request is received. Once the `expire_time`

280

# has passed, Cloud Bigtable will delete the backup and free the

281

# resources used by the backup.

}</pre>

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

286

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

287

<pre>Gets the access control policy for a Table resource.

288

Returns an empty policy if the resource exists but does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

293

See the operation documentation for the appropriate value for this field. (required)

294

body: object, The request body.

295

The object takes the form of:

296

297

{ # Request message for `GetIamPolicy` method.

298

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

299

# `GetIamPolicy`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

300

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

301

#

302

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

303

# rejected.

304

#

305

# Requests for policies with any conditional bindings must specify version 3.

306

# Policies without any conditional bindings may specify any valid value or

307

# leave the field unset.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

308

#

309

# To learn which resources support conditions in their IAM policies, see the

310

# [IAM

311

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

322

323

{ # An Identity and Access Management (IAM) policy, which specifies access

324

# controls for Google Cloud resources.

325

#

326

#

327

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

328

# `members` to a single `role`. Members can be user accounts, service accounts,

329

# Google groups, and domains (such as G Suite). A `role` is a named list of

330

# permissions; each `role` can be an IAM predefined role or a user-created

331

# custom role.

332

#

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

333

# For some types of Google Cloud resources, a `binding` can also specify a

334

# `condition`, which is a logical expression that allows access to a resource

335

# only if the expression evaluates to `true`. A condition can add constraints

336

# based on attributes of the request, the resource, or both. To learn which

337

# resources support conditions in their IAM policies, see the

338

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

#

# **JSON example:**

#

# {

# "bindings": [

# {

# "role": "roles/resourcemanager.organizationAdmin",

346

# "members": [

347

# "user:mike@example.com",

348

# "group:admins@example.com",

349

# "domain:google.com",

350

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

# ]

# },

# {

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

355

# "members": [

356

# "user:eve@example.com"

357

# ],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

358

# "condition": {

359

# "title": "expirable access",

360

# "description": "Does not grant access after Sep 2020",

361

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

# }

# }

# ],

# "etag": "BwWWja0YfJA=",

# "version": 3

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

374

# - group:admins@example.com

375

# - domain:google.com

376

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

377

# role: roles/resourcemanager.organizationAdmin

378

# - members:

379

# - user:eve@example.com

380

# role: roles/resourcemanager.organizationViewer

381

# condition:

382

# title: expirable access

383

# description: Does not grant access after Sep 2020

384

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

385

# - etag: BwWWja0YfJA=

386

# - version: 3

387

#

388

# For a description of IAM and its features, see the

389

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

390

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

391

# `condition` that determines how and when the `bindings` are applied. Each

392

# of the `bindings` must contain at least one member.

393

{ # Associates `members` with a `role`.

394

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

395

#

396

# If the condition evaluates to `true`, then this binding applies to the

397

# current request.

398

#

399

# If the condition evaluates to `false`, then this binding does not apply to

400

# the current request. However, a different role binding might grant the same

401

# role to one or more of the members in this binding.

402

#

403

# To learn which resources support conditions in their IAM policies, see the

404

# [IAM

405

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

406

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

407

# are documented at https://github.com/google/cel-spec.

408

#

409

# Example (Comparison):

410

#

411

# title: "Summary size limit"

412

# description: "Determines if a summary is less than 100 chars"

413

# expression: "document.summary.size() < 100"

414

#

415

# Example (Equality):

416

#

417

# title: "Requestor is owner"

418

# description: "Determines if requestor is the document owner"

419

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

424

# description: "Determine whether the document should be publicly visible"

425

# expression: "document.type != 'private' && document.type != 'internal'"

426

#

427

# Example (Data Manipulation):

428

#

429

# title: "Notification string"

430

# description: "Create a notification string with a timestamp."

431

# expression: "'New message received at ' + string(document.create_time)"

432

#

433

# The exact variables and functions that may be referenced within an expression

434

# are determined by the service that evaluates it. See the service

435

# documentation for additional information.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

436

"expression": "A String", # Textual representation of an expression in Common Expression Language

437

# syntax.

438

"description": "A String", # Optional. Description of the expression. This is a longer text which

439

# describes the expression, e.g. when hovered over it in a UI.

440

"location": "A String", # Optional. String indicating the location of the expression for error

441

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

442

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

443

# its purpose. This can be used e.g. in UIs which allow to enter the

444

# expression.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

445

},

446

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

447

# `members` can have the following values:

448

#

449

# * `allUsers`: A special identifier that represents anyone who is

450

# on the internet; with or without a Google account.

451

#

452

# * `allAuthenticatedUsers`: A special identifier that represents anyone

453

# who is authenticated with a Google account or a service account.

454

#

455

# * `user:{emailid}`: An email address that represents a specific Google

456

# account. For example, `alice@example.com` .

457

#

458

#

459

# * `serviceAccount:{emailid}`: An email address that represents a service

460

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

461

#

462

# * `group:{emailid}`: An email address that represents a Google group.

463

# For example, `admins@example.com`.

464

#

465

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

466

# identifier) representing a user that has been recently deleted. For

467

# example, `alice@example.com?uid=123456789012345678901`. If the user is

468

# recovered, this value reverts to `user:{emailid}` and the recovered user

469

# retains the role in the binding.

470

#

471

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

472

# unique identifier) representing a service account that has been recently

473

# deleted. For example,

474

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

475

# If the service account is undeleted, this value reverts to

476

# `serviceAccount:{emailid}` and the undeleted service account retains the

477

# role in the binding.

478

#

479

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

480

# identifier) representing a Google group that has been recently

481

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

482

# the group is recovered, this value reverts to `group:{emailid}` and the

483

# recovered group retains the role in the binding.

484

#

485

#

486

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

487

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"role": "A String", # Role that is assigned to `members`.

492

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

493

},

494

],

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

495

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

496

{ # Specifies the audit configuration for a service.

497

# The configuration determines which permission types are logged, and what

498

# identities, if any, are exempted from logging.

499

# An AuditConfig must have one or more AuditLogConfigs.

500

#

501

# If there are AuditConfigs for both `allServices` and a specific service,

502

# the union of the two AuditConfigs is used for that service: the log_types

503

# specified in each AuditConfig are enabled, and the exempted_members in each

504

# AuditLogConfig are exempted.

505

#

506

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

512

# "audit_log_configs": [

513

# {

514

# "log_type": "DATA_READ",

515

# "exempted_members": [

516

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

521

# },

522

# {

523

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

529

# "audit_log_configs": [

530

# {

531

# "log_type": "DATA_READ"

532

# },

533

# {

534

# "log_type": "DATA_WRITE",

535

# "exempted_members": [

536

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

545

# logging. It also exempts jose@example.com from DATA_READ logging, and

546

# aliya@example.com from DATA_WRITE logging.

547

"auditLogConfigs": [ # The configuration for logging of each type of permission.

548

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

553

# {

554

# "log_type": "DATA_READ",

555

# "exempted_members": [

556

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

566

# jose@example.com from DATA_READ logging.

567

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

568

# permission.

569

# Follows the same format of Binding.members.

570

"A String",

571

],

572

"logType": "A String", # The log type that this config enables.

573

},

574

],

575

"service": "A String", # Specifies a service that will be enabled for audit logging.

576

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

577

# `allServices` is a special value that covers all services.

578

},

579

],

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame]

580

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

581

# prevent simultaneous updates of a policy from overwriting each other.

582

# It is strongly suggested that systems make use of the `etag` in the

583

# read-modify-write cycle to perform policy updates in order to avoid race

584

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

585

# systems are expected to put that etag in the request to `setIamPolicy` to

586

# ensure that their change will be applied to the same version of the policy.

587

#

588

# **Important:** If you use IAM Conditions, you must include the `etag` field

589

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

590

# you to overwrite a version `3` policy with a version `1` policy, and all of

591

# the conditions in the version `3` policy are lost.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

592

"version": 42, # Specifies the format of the policy.

593

#

594

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

595

# are rejected.

596

#

597

# Any operation that affects conditional role bindings must specify version

598

# `3`. This requirement applies to the following operations:

599

#

600

# * Getting a policy that includes a conditional role binding

601

# * Adding a conditional role binding to a policy

602

# * Changing a conditional role binding in a policy

603

# * Removing any role binding, with or without a condition, from a policy

604

# that includes conditions

605

#

606

# **Important:** If you use IAM Conditions, you must include the `etag` field

607

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

608

# you to overwrite a version `3` policy with a version `1` policy, and all of

609

# the conditions in the version `3` policy are lost.

610

#

611

# If a policy does not include any conditions, operations on that policy may

612

# specify any valid version or leave the field unset.

613

#

614

# To learn which resources support conditions in their IAM policies, see the

615

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

}</pre>

</div>

<code class="details" id="list">list(parent, pageSize=None, pageToken=None, filter=None, orderBy=None, x__xgafv=None)</code>

621

<pre>Lists Cloud Bigtable backups. Returns both completed and pending

backups.

Args:

parent: string, Required. The cluster to list backups from. Values are of the

626

form `projects/{project}/instances/{instance}/clusters/{cluster}`.

627

Use `{cluster} = '-'` to list backups for all clusters in an instance,

628

e.g., `projects/{project}/instances/{instance}/clusters/-`. (required)

629

pageSize: integer, Number of backups to be returned in the response. If 0 or

630

less, defaults to the server's maximum allowed page size.

631

pageToken: string, If non-empty, `page_token` should contain a

632

next_page_token from a

633

previous ListBackupsResponse to the same `parent` and with the same

634

`filter`.

635

filter: string, A filter expression that filters backups listed in the response.

636

The expression must specify the field name, a comparison operator,

637

and the value that you want to use for filtering. The value must be a

638

string, a number, or a boolean. The comparison operator must be

639

<, >, <=, >=, !=, =, or :. Colon ‘:’ represents a HAS operator which is

640

roughly synonymous with equality. Filter rules are case insensitive.

641

642

The fields eligible for filtering are:

* `name`

* `source_table`

* `state`

* `start_time` (and values are of the format YYYY-MM-DDTHH:MM:SSZ)

647

* `end_time` (and values are of the format YYYY-MM-DDTHH:MM:SSZ)

648

* `expire_time` (and values are of the format YYYY-MM-DDTHH:MM:SSZ)

649

* `size_bytes`

650

651

To filter on multiple expressions, provide each separate expression within

652

parentheses. By default, each expression is an AND expression. However,

653

you can include AND, OR, and NOT expressions explicitly.

654

655

Some examples of using filters are:

656

657

* `name:"exact"` --> The backup's name is the string "exact".

658

* `name:howl` --> The backup's name contains the string "howl".

659

* `source_table:prod`

660

--> The source_table's name contains the string "prod".

661

* `state:CREATING` --> The backup is pending creation.

662

* `state:READY` --> The backup is fully created and ready for use.

663

* `(name:howl) AND (start_time < \"2018-03-28T14:50:00Z\")`

664

--> The backup name contains the string "howl" and start_time

665

of the backup is before 2018-03-28T14:50:00Z.

666

* `size_bytes > 10000000000` --> The backup's size is greater than 10GB

667

orderBy: string, An expression for specifying the sort order of the results of the request.

668

The string value should specify one or more fields in Backup. The full

669

syntax is described at https://aip.dev/132#ordering.

670

671

Fields supported are:

* name

* source_table

* expire_time

* start_time

* end_time

* size_bytes

* state

For example, "start_time". The default sorting order is ascending.

681

To specify descending order for the field, a suffix " desc" should

682

be appended to the field name. For example, "start_time desc".

683

Redundant space characters in the syntax are insigificant.

684

685

If order_by is empty, results will be sorted by `start_time` in descending

686

order starting from the most recently created backup.

687

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

694

695

{ # The response for ListBackups.

696

"backups": [ # The list of matching backups.

697

{ # A backup of a Cloud Bigtable table.

698

"startTime": "A String", # Output only. `start_time` is the time that the backup was started

699

# (i.e. approximately the time the

700

# CreateBackup request is received). The

701

# row data in this backup will be no older than this timestamp.

702

"state": "A String", # Output only. The current state of the backup.

703

"sizeBytes": "A String", # Output only. Size of the backup in bytes.

704

"name": "A String", # A globally unique identifier for the backup which cannot be

705

# changed. Values are of the form

706

# `projects/{project}/instances/{instance}/clusters/{cluster}/

707

# backups/_a-zA-Z0-9*`

708

# The final segment of the name must be between 1 and 50 characters

709

# in length.

710

#

711

# The backup is stored in the cluster identified by the prefix of the backup

712

# name of the form

713

# `projects/{project}/instances/{instance}/clusters/{cluster}`.

714

"endTime": "A String", # Output only. `end_time` is the time that the backup was finished. The row

715

# data in the backup will be no newer than this timestamp.

716

"sourceTable": "A String", # Required. Immutable. Name of the table from which this backup was created. This needs

717

# to be in the same instance as the backup. Values are of the form

718

# `projects/{project}/instances/{instance}/tables/{source_table}`.

719

"expireTime": "A String", # Required. The expiration time of the backup, with microseconds

720

# granularity that must be at least 6 hours and at most 30 days

721

# from the time the request is received. Once the `expire_time`

722

# has passed, Cloud Bigtable will delete the backup and free the

723

# resources used by the backup.

724

},

725

],

726

"nextPageToken": "A String", # `next_page_token` can be sent in a subsequent

727

# ListBackups call to fetch more

728

# of the matching backups.

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

734

<pre>Retrieves the next page of results.

735

736

Args:

737

previous_request: The request for the previous page. (required)

738

previous_response: The response from the request for the previous page. (required)

739

740

Returns:

741

A request object that you can call 'execute()' on to request the next

742

page. Returns None if there are no more items in the collection.

</pre>

</div>

<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>

748

<pre>Updates a pending or completed Cloud Bigtable Backup.

Args:

changed. Values are of the form

753

`projects/{project}/instances/{instance}/clusters/{cluster}/

754

backups/_a-zA-Z0-9*`

755

The final segment of the name must be between 1 and 50 characters

756

in length.

757

758

The backup is stored in the cluster identified by the prefix of the backup

759

name of the form

760

`projects/{project}/instances/{instance}/clusters/{cluster}`. (required)

761

body: object, The request body.

762

The object takes the form of:

763

764

{ # A backup of a Cloud Bigtable table.

765

"startTime": "A String", # Output only. `start_time` is the time that the backup was started

766

# (i.e. approximately the time the

767

# CreateBackup request is received). The

768

# row data in this backup will be no older than this timestamp.

769

"state": "A String", # Output only. The current state of the backup.

770

"sizeBytes": "A String", # Output only. Size of the backup in bytes.

771

"name": "A String", # A globally unique identifier for the backup which cannot be

772

# changed. Values are of the form

773

# `projects/{project}/instances/{instance}/clusters/{cluster}/

774

# backups/_a-zA-Z0-9*`

775

# The final segment of the name must be between 1 and 50 characters

776

# in length.

777

#

778

# The backup is stored in the cluster identified by the prefix of the backup

779

# name of the form

780

# `projects/{project}/instances/{instance}/clusters/{cluster}`.

781

"endTime": "A String", # Output only. `end_time` is the time that the backup was finished. The row

782

# data in the backup will be no newer than this timestamp.

783

"sourceTable": "A String", # Required. Immutable. Name of the table from which this backup was created. This needs

784

# to be in the same instance as the backup. Values are of the form

785

# `projects/{project}/instances/{instance}/tables/{source_table}`.

786

"expireTime": "A String", # Required. The expiration time of the backup, with microseconds

787

# granularity that must be at least 6 hours and at most 30 days

788

# from the time the request is received. Once the `expire_time`

789

# has passed, Cloud Bigtable will delete the backup and free the

790

# resources used by the backup.

791

}

792

793

updateMask: string, Required. A mask specifying which fields (e.g. `expire_time`) in the

794

Backup resource should be updated. This mask is relative to the Backup

795

resource, not to the request message. The field mask must always be

796

specified; this prevents any future fields from being erased accidentally

797

by clients that do not know about them.

798

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

805

806

{ # A backup of a Cloud Bigtable table.

807

"startTime": "A String", # Output only. `start_time` is the time that the backup was started

808

# (i.e. approximately the time the

809

# CreateBackup request is received). The

810

# row data in this backup will be no older than this timestamp.

811

"state": "A String", # Output only. The current state of the backup.

812

"sizeBytes": "A String", # Output only. Size of the backup in bytes.

813

"name": "A String", # A globally unique identifier for the backup which cannot be

814

# changed. Values are of the form

815

# `projects/{project}/instances/{instance}/clusters/{cluster}/

816

# backups/_a-zA-Z0-9*`

817

# The final segment of the name must be between 1 and 50 characters

818

# in length.

819

#

820

# The backup is stored in the cluster identified by the prefix of the backup

821

# name of the form

822

# `projects/{project}/instances/{instance}/clusters/{cluster}`.

823

"endTime": "A String", # Output only. `end_time` is the time that the backup was finished. The row

824

# data in the backup will be no newer than this timestamp.

825

"sourceTable": "A String", # Required. Immutable. Name of the table from which this backup was created. This needs

826

# to be in the same instance as the backup. Values are of the form

827

# `projects/{project}/instances/{instance}/tables/{source_table}`.

828

"expireTime": "A String", # Required. The expiration time of the backup, with microseconds

829

# granularity that must be at least 6 hours and at most 30 days

830

# from the time the request is received. Once the `expire_time`

831

# has passed, Cloud Bigtable will delete the backup and free the

832

# resources used by the backup.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

838

<pre>Sets the access control policy on a Table resource.

839

Replaces any existing policy.

840

841

Args:

842

resource: string, REQUIRED: The resource for which the policy is being specified.

843

See the operation documentation for the appropriate value for this field. (required)

844

body: object, The request body.

845

The object takes the form of:

846

847

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

848

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

849

# the fields in the mask will be modified. If no mask is provided, the

850

# following default mask is used:

851

#

852

# `paths: "bindings, etag"`

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

853

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

854

# the policy is limited to a few 10s of KB. An empty policy is a

855

# valid policy but certain Cloud Platform services (such as Projects)

856

# might reject them.

857

# controls for Google Cloud resources.

858

#

859

#

860

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

861

# `members` to a single `role`. Members can be user accounts, service accounts,

862

# Google groups, and domains (such as G Suite). A `role` is a named list of

863

# permissions; each `role` can be an IAM predefined role or a user-created

864

# custom role.

865

#

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

866

# For some types of Google Cloud resources, a `binding` can also specify a

867

# `condition`, which is a logical expression that allows access to a resource

868

# only if the expression evaluates to `true`. A condition can add constraints

869

# based on attributes of the request, the resource, or both. To learn which

870

# resources support conditions in their IAM policies, see the

871

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

#

# **JSON example:**

#

# {

# "bindings": [

# {

# "role": "roles/resourcemanager.organizationAdmin",

879

# "members": [

880

# "user:mike@example.com",

881

# "group:admins@example.com",

882

# "domain:google.com",

883

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

# ]

# },

# {

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

888

# "members": [

889

# "user:eve@example.com"

890

# ],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

891

# "condition": {

892

# "title": "expirable access",

893

# "description": "Does not grant access after Sep 2020",

894

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

# }

# }

# ],

# "etag": "BwWWja0YfJA=",

# "version": 3

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

907

# - group:admins@example.com

908

# - domain:google.com

909

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

910

# role: roles/resourcemanager.organizationAdmin

911

# - members:

912

# - user:eve@example.com

913

# role: roles/resourcemanager.organizationViewer

914

# condition:

915

# title: expirable access

916

# description: Does not grant access after Sep 2020

917

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

918

# - etag: BwWWja0YfJA=

919

# - version: 3

920

#

921

# For a description of IAM and its features, see the

922

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

923

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

924

# `condition` that determines how and when the `bindings` are applied. Each

925

# of the `bindings` must contain at least one member.

926

{ # Associates `members` with a `role`.

927

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

928

#

929

# If the condition evaluates to `true`, then this binding applies to the

930

# current request.

931

#

932

# If the condition evaluates to `false`, then this binding does not apply to

933

# the current request. However, a different role binding might grant the same

934

# role to one or more of the members in this binding.

935

#

936

# To learn which resources support conditions in their IAM policies, see the

937

# [IAM

938

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

939

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

940

# are documented at https://github.com/google/cel-spec.

941

#

942

# Example (Comparison):

943

#

944

# title: "Summary size limit"

945

# description: "Determines if a summary is less than 100 chars"

946

# expression: "document.summary.size() < 100"

947

#

948

# Example (Equality):

949

#

950

# title: "Requestor is owner"

951

# description: "Determines if requestor is the document owner"

952

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

957

# description: "Determine whether the document should be publicly visible"

958

# expression: "document.type != 'private' && document.type != 'internal'"

959

#

960

# Example (Data Manipulation):

961

#

962

# title: "Notification string"

963

# description: "Create a notification string with a timestamp."

964

# expression: "'New message received at ' + string(document.create_time)"

965

#

966

# The exact variables and functions that may be referenced within an expression

967

# are determined by the service that evaluates it. See the service

968

# documentation for additional information.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

969

"expression": "A String", # Textual representation of an expression in Common Expression Language

970

# syntax.

971

"description": "A String", # Optional. Description of the expression. This is a longer text which

972

# describes the expression, e.g. when hovered over it in a UI.

973

"location": "A String", # Optional. String indicating the location of the expression for error

974

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

975

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

976

# its purpose. This can be used e.g. in UIs which allow to enter the

977

# expression.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

978

},

979

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

980

# `members` can have the following values:

981

#

982

# * `allUsers`: A special identifier that represents anyone who is

983

# on the internet; with or without a Google account.

984

#

985

# * `allAuthenticatedUsers`: A special identifier that represents anyone

986

# who is authenticated with a Google account or a service account.

987

#

988

# * `user:{emailid}`: An email address that represents a specific Google

989

# account. For example, `alice@example.com` .

990

#

991

#

992

# * `serviceAccount:{emailid}`: An email address that represents a service

993

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

994

#

995

# * `group:{emailid}`: An email address that represents a Google group.

996

# For example, `admins@example.com`.

997

#

998

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

999

# identifier) representing a user that has been recently deleted. For

1000

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1001

# recovered, this value reverts to `user:{emailid}` and the recovered user

1002

# retains the role in the binding.

1003

#

1004

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1005

# unique identifier) representing a service account that has been recently

1006

# deleted. For example,

1007

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1008

# If the service account is undeleted, this value reverts to

1009

# `serviceAccount:{emailid}` and the undeleted service account retains the

1010

# role in the binding.

1011

#

1012

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1013

# identifier) representing a Google group that has been recently

1014

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1015

# the group is recovered, this value reverts to `group:{emailid}` and the

1016

# recovered group retains the role in the binding.

1017

#

1018

#

1019

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1020

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"role": "A String", # Role that is assigned to `members`.

1025

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

1026

},

1027

],

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1028

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1029

{ # Specifies the audit configuration for a service.

1030

# The configuration determines which permission types are logged, and what

1031

# identities, if any, are exempted from logging.

1032

# An AuditConfig must have one or more AuditLogConfigs.

1033

#

1034

# If there are AuditConfigs for both `allServices` and a specific service,

1035

# the union of the two AuditConfigs is used for that service: the log_types

1036

# specified in each AuditConfig are enabled, and the exempted_members in each

1037

# AuditLogConfig are exempted.

1038

#

1039

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

1045

# "audit_log_configs": [

1046

# {

1047

# "log_type": "DATA_READ",

1048

# "exempted_members": [

1049

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

1054

# },

1055

# {

1056

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

1062

# "audit_log_configs": [

1063

# {

1064

# "log_type": "DATA_READ"

1065

# },

1066

# {

1067

# "log_type": "DATA_WRITE",

1068

# "exempted_members": [

1069

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1078

# logging. It also exempts jose@example.com from DATA_READ logging, and

1079

# aliya@example.com from DATA_WRITE logging.

1080

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1081

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1086

# {

1087

# "log_type": "DATA_READ",

1088

# "exempted_members": [

1089

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1099

# jose@example.com from DATA_READ logging.

1100

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1101

# permission.

1102

# Follows the same format of Binding.members.

1103

"A String",

1104

],

1105

"logType": "A String", # The log type that this config enables.

1106

},

1107

],

1108

"service": "A String", # Specifies a service that will be enabled for audit logging.

1109

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1110

# `allServices` is a special value that covers all services.

1111

},

1112

],

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame]

1113

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1114

# prevent simultaneous updates of a policy from overwriting each other.

1115

# It is strongly suggested that systems make use of the `etag` in the

1116

# read-modify-write cycle to perform policy updates in order to avoid race

1117

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1118

# systems are expected to put that etag in the request to `setIamPolicy` to

1119

# ensure that their change will be applied to the same version of the policy.

1120

#

1121

# **Important:** If you use IAM Conditions, you must include the `etag` field

1122

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1123

# you to overwrite a version `3` policy with a version `1` policy, and all of

1124

# the conditions in the version `3` policy are lost.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1125

"version": 42, # Specifies the format of the policy.

1126

#

1127

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1128

# are rejected.

1129

#

1130

# Any operation that affects conditional role bindings must specify version

1131

# `3`. This requirement applies to the following operations:

1132

#

1133

# * Getting a policy that includes a conditional role binding

1134

# * Adding a conditional role binding to a policy

1135

# * Changing a conditional role binding in a policy

1136

# * Removing any role binding, with or without a condition, from a policy

1137

# that includes conditions

1138

#

1139

# **Important:** If you use IAM Conditions, you must include the `etag` field

1140

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1141

# you to overwrite a version `3` policy with a version `1` policy, and all of

1142

# the conditions in the version `3` policy are lost.

1143

#

1144

# If a policy does not include any conditions, operations on that policy may

1145

# specify any valid version or leave the field unset.

1146

#

1147

# To learn which resources support conditions in their IAM policies, see the

1148

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1149

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1150

}

1151

1152

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1159

1160

{ # An Identity and Access Management (IAM) policy, which specifies access

1161

# controls for Google Cloud resources.

1162

#

1163

#

1164

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1165

# `members` to a single `role`. Members can be user accounts, service accounts,

1166

# Google groups, and domains (such as G Suite). A `role` is a named list of

1167

# permissions; each `role` can be an IAM predefined role or a user-created

1168

# custom role.

1169

#

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1170

# For some types of Google Cloud resources, a `binding` can also specify a

1171

# `condition`, which is a logical expression that allows access to a resource

1172

# only if the expression evaluates to `true`. A condition can add constraints

1173

# based on attributes of the request, the resource, or both. To learn which

1174

# resources support conditions in their IAM policies, see the

1175

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

#

# **JSON example:**

#

# {

# "bindings": [

# {

# "role": "roles/resourcemanager.organizationAdmin",

1183

# "members": [

1184

# "user:mike@example.com",

1185

# "group:admins@example.com",

1186

# "domain:google.com",

1187

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

# ]

# },

# {

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1192

# "members": [

1193

# "user:eve@example.com"

1194

# ],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1195

# "condition": {

1196

# "title": "expirable access",

1197

# "description": "Does not grant access after Sep 2020",

1198

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

# }

# }

# ],

# "etag": "BwWWja0YfJA=",

# "version": 3

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

1211

# - group:admins@example.com

1212

# - domain:google.com

1213

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1214

# role: roles/resourcemanager.organizationAdmin

1215

# - members:

1216

# - user:eve@example.com

1217

# role: roles/resourcemanager.organizationViewer

1218

# condition:

1219

# title: expirable access

1220

# description: Does not grant access after Sep 2020

1221

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

1222

# - etag: BwWWja0YfJA=

1223

# - version: 3

1224

#

1225

# For a description of IAM and its features, see the

1226

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1227

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

1228

# `condition` that determines how and when the `bindings` are applied. Each

1229

# of the `bindings` must contain at least one member.

1230

{ # Associates `members` with a `role`.

1231

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1232

#

1233

# If the condition evaluates to `true`, then this binding applies to the

1234

# current request.

1235

#

1236

# If the condition evaluates to `false`, then this binding does not apply to

1237

# the current request. However, a different role binding might grant the same

1238

# role to one or more of the members in this binding.

1239

#

1240

# To learn which resources support conditions in their IAM policies, see the

1241

# [IAM

1242

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1243

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1244

# are documented at https://github.com/google/cel-spec.

1245

#

1246

# Example (Comparison):

1247

#

1248

# title: "Summary size limit"

1249

# description: "Determines if a summary is less than 100 chars"

1250

# expression: "document.summary.size() < 100"

1251

#

1252

# Example (Equality):

1253

#

1254

# title: "Requestor is owner"

1255

# description: "Determines if requestor is the document owner"

1256

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1261

# description: "Determine whether the document should be publicly visible"

1262

# expression: "document.type != 'private' && document.type != 'internal'"

1263

#

1264

# Example (Data Manipulation):

1265

#

1266

# title: "Notification string"

1267

# description: "Create a notification string with a timestamp."

1268

# expression: "'New message received at ' + string(document.create_time)"

1269

#

1270

# The exact variables and functions that may be referenced within an expression

1271

# are determined by the service that evaluates it. See the service

1272

# documentation for additional information.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1273

"expression": "A String", # Textual representation of an expression in Common Expression Language

1274

# syntax.

1275

"description": "A String", # Optional. Description of the expression. This is a longer text which

1276

# describes the expression, e.g. when hovered over it in a UI.

1277

"location": "A String", # Optional. String indicating the location of the expression for error

1278

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1279

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1280

# its purpose. This can be used e.g. in UIs which allow to enter the

1281

# expression.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1282

},

1283

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

1284

# `members` can have the following values:

1285

#

1286

# * `allUsers`: A special identifier that represents anyone who is

1287

# on the internet; with or without a Google account.

1288

#

1289

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1290

# who is authenticated with a Google account or a service account.

1291

#

1292

# * `user:{emailid}`: An email address that represents a specific Google

1293

# account. For example, `alice@example.com` .

1294

#

1295

#

1296

# * `serviceAccount:{emailid}`: An email address that represents a service

1297

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1298

#

1299

# * `group:{emailid}`: An email address that represents a Google group.

1300

# For example, `admins@example.com`.

1301

#

1302

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1303

# identifier) representing a user that has been recently deleted. For

1304

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1305

# recovered, this value reverts to `user:{emailid}` and the recovered user

1306

# retains the role in the binding.

1307

#

1308

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1309

# unique identifier) representing a service account that has been recently

1310

# deleted. For example,

1311

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1312

# If the service account is undeleted, this value reverts to

1313

# `serviceAccount:{emailid}` and the undeleted service account retains the

1314

# role in the binding.

1315

#

1316

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1317

# identifier) representing a Google group that has been recently

1318

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1319

# the group is recovered, this value reverts to `group:{emailid}` and the

1320

# recovered group retains the role in the binding.

1321

#

1322

#

1323

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1324

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"role": "A String", # Role that is assigned to `members`.

1329

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

1330

},

1331

],

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1332

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1333

{ # Specifies the audit configuration for a service.

1334

# The configuration determines which permission types are logged, and what

1335

# identities, if any, are exempted from logging.

1336

# An AuditConfig must have one or more AuditLogConfigs.

1337

#

1338

# If there are AuditConfigs for both `allServices` and a specific service,

1339

# the union of the two AuditConfigs is used for that service: the log_types

1340

# specified in each AuditConfig are enabled, and the exempted_members in each

1341

# AuditLogConfig are exempted.

1342

#

1343

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

1349

# "audit_log_configs": [

1350

# {

1351

# "log_type": "DATA_READ",

1352

# "exempted_members": [

1353

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

1358

# },

1359

# {

1360

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

1366

# "audit_log_configs": [

1367

# {

1368

# "log_type": "DATA_READ"

1369

# },

1370

# {

1371

# "log_type": "DATA_WRITE",

1372

# "exempted_members": [

1373

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1382

# logging. It also exempts jose@example.com from DATA_READ logging, and

1383

# aliya@example.com from DATA_WRITE logging.

1384

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1385

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1390

# {

1391

# "log_type": "DATA_READ",

1392

# "exempted_members": [

1393

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1403

# jose@example.com from DATA_READ logging.

1404

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1405

# permission.

1406

# Follows the same format of Binding.members.

1407

"A String",

1408

],

1409

"logType": "A String", # The log type that this config enables.

1410

},

1411

],

1412

"service": "A String", # Specifies a service that will be enabled for audit logging.

1413

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1414

# `allServices` is a special value that covers all services.

1415

},

1416

],

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame]

1417

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1418

# prevent simultaneous updates of a policy from overwriting each other.

1419

# It is strongly suggested that systems make use of the `etag` in the

1420

# read-modify-write cycle to perform policy updates in order to avoid race

1421

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1422

# systems are expected to put that etag in the request to `setIamPolicy` to

1423

# ensure that their change will be applied to the same version of the policy.

1424

#

1425

# **Important:** If you use IAM Conditions, you must include the `etag` field

1426

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1427

# you to overwrite a version `3` policy with a version `1` policy, and all of

1428

# the conditions in the version `3` policy are lost.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame^]

1429

"version": 42, # Specifies the format of the policy.

1430

#

1431

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1432

# are rejected.

1433

#

1434

# Any operation that affects conditional role bindings must specify version

1435

# `3`. This requirement applies to the following operations:

1436

#

1437

# * Getting a policy that includes a conditional role binding

1438

# * Adding a conditional role binding to a policy

1439

# * Changing a conditional role binding in a policy

1440

# * Removing any role binding, with or without a condition, from a policy

1441

# that includes conditions

1442

#

1443

# **Important:** If you use IAM Conditions, you must include the `etag` field

1444

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1445

# you to overwrite a version `3` policy with a version `1` policy, and all of

1446

# the conditions in the version `3` policy are lost.

1447

#

1448

# If a policy does not include any conditions, operations on that policy may

1449

# specify any valid version or leave the field unset.

1450

#

1451

# To learn which resources support conditions in their IAM policies, see the

1452

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

1458

<pre>Returns permissions that the caller has on the specified table resource.

1459

1460

Args:

1461

resource: string, REQUIRED: The resource for which the policy detail is being requested.

1462

See the operation documentation for the appropriate value for this field. (required)

1463

body: object, The request body.

1464

The object takes the form of:

1465

1466

{ # Request message for `TestIamPermissions` method.

1467

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

1468

# wildcards (such as '*' or 'storage.*') are not allowed. For more

1469

# information see

1470

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

"A String",

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1482

1483

{ # Response message for `TestIamPermissions` method.

1484

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

# allowed.

"A String",

],

}</pre>

</div>

</body></html>