Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / d059ad881c7ae58c67931c48788d0bd7343ab16c / . / docs / dyn / cloudresourcemanager_v1.folders.html
blob: 0445c6f9cfcb420cc86df0176bd4bb5e75fccedb [file] [log] [blame]
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]75<h1><a href="cloudresourcemanager_v1.html">Cloud Resource Manager API</a> . <a href="cloudresourcemanager_v1.folders.html">folders</a></h1>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]76<h2>Instance Methods</h2>
77<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]78 <code><a href="#clearOrgPolicy">clearOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]79<p class="firstline">Clears a `Policy` from a resource.</p>
80<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]81 <code><a href="#getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]82<p class="firstline">Gets the effective `Policy` on a resource. This is the result of merging</p>
83<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]84 <code><a href="#getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]85<p class="firstline">Gets a `Policy` on a resource.</p>
86<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]87 <code><a href="#listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]88<p class="firstline">Lists `Constraints` that could be applied on the specified resource.</p>
89<p class="toc_element">
90 <code><a href="#listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</a></code></p>
91<p class="firstline">Retrieves the next page of results.</p>
92<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]93 <code><a href="#listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]94<p class="firstline">Lists all the `Policies` set for a particular resource.</p>
95<p class="toc_element">
96 <code><a href="#listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</a></code></p>
97<p class="firstline">Retrieves the next page of results.</p>
98<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]99 <code><a href="#setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]100<p class="firstline">Updates the specified `Policy` on the resource. Creates a new `Policy` for</p>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]101<h3>Method Details</h3>
102<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]103 <code class="details" id="clearOrgPolicy">clearOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]104 <pre>Clears a `Policy` from a resource.
105
106Args:
107 resource: string, Name of the resource for the `Policy` to clear. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]108 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]109 The object takes the form of:
110
111{ # The request sent to the ClearOrgPolicy method.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]112 &quot;constraint&quot;: &quot;A String&quot;, # Name of the `Constraint` of the `Policy` to clear.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]113 &quot;etag&quot;: &quot;A String&quot;, # The current version, for concurrency control. Not sending an `etag`
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]114 # will cause the `Policy` to be cleared blindly.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]115 }
116
117 x__xgafv: string, V1 error format.
118 Allowed values
119 1 - v1 error format
120 2 - v2 error format
121
122Returns:
123 An object of the form:
124
125 { # A generic empty message that you can re-use to avoid defining duplicated
126 # empty messages in your APIs. A typical example is to use it as the request
127 # or the response type of an API method. For instance:
128 #
129 # service Foo {
130 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
131 # }
132 #
133 # The JSON representation for `Empty` is empty JSON object `{}`.
134 }</pre>
135</div>
136
137<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]138 <code class="details" id="getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]139 <pre>Gets the effective `Policy` on a resource. This is the result of merging
140`Policies` in the resource hierarchy. The returned `Policy` will not have
141an `etag`set because it is a computed `Policy` across multiple resources.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]142Subtrees of Resource Manager resource hierarchy with &#x27;under:&#x27; prefix will
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]143not be expanded.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]144
145Args:
146 resource: string, The name of the resource to start computing the effective `Policy`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]147 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]148 The object takes the form of:
149
150{ # The request sent to the GetEffectiveOrgPolicy method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]151 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` to compute the effective `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]152 }
153
154 x__xgafv: string, V1 error format.
155 Allowed values
156 1 - v1 error format
157 2 - v2 error format
158
159Returns:
160 An object of the form:
161
162 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
163 # for configurations of Cloud Platform resources.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]164 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
165 # resource.
166 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
167 # configuration is acceptable.
168 #
169 # Suppose you have a `Constraint`
170 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
171 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
172 # behavior:
173 # - If the `Policy` at this resource has enforced set to `false`, serial
174 # port connection attempts will be allowed.
175 # - If the `Policy` at this resource has enforced set to `true`, serial
176 # port connection attempts will be refused.
177 # - If the `Policy` at this resource is `RestoreDefault`, serial port
178 # connection attempts will be allowed.
179 # - If no `Policy` is set at this resource or anywhere higher in the
180 # resource hierarchy, serial port connection attempts will be allowed.
181 # - If no `Policy` is set at this resource, but one exists higher in the
182 # resource hierarchy, the behavior is as if the`Policy` were set at
183 # this resource.
184 #
185 # The following examples demonstrate the different possible layerings:
186 #
187 # Example 1 (nearest `Constraint` wins):
188 # `organizations/foo` has a `Policy` with:
189 # {enforced: false}
190 # `projects/bar` has no `Policy` set.
191 # The constraint at `projects/bar` and `organizations/foo` will not be
192 # enforced.
193 #
194 # Example 2 (enforcement gets replaced):
195 # `organizations/foo` has a `Policy` with:
196 # {enforced: false}
197 # `projects/bar` has a `Policy` with:
198 # {enforced: true}
199 # The constraint at `organizations/foo` is not enforced.
200 # The constraint at `projects/bar` is enforced.
201 #
202 # Example 3 (RestoreDefault):
203 # `organizations/foo` has a `Policy` with:
204 # {enforced: true}
205 # `projects/bar` has a `Policy` with:
206 # {RestoreDefault: {}}
207 # The constraint at `organizations/foo` is enforced.
208 # The constraint at `projects/bar` is not enforced, because
209 # `constraint_default` for the `Constraint` is `ALLOW`.
210 },
211 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
212 # `Constraint` type.
213 # `constraint_default` enforcement behavior of the specific `Constraint` at
214 # this resource.
215 #
216 # Suppose that `constraint_default` is set to `ALLOW` for the
217 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
218 # foo.com sets a `Policy` at their Organization resource node that restricts
219 # the allowed service activations to deny all service activations. They
220 # could then set a `Policy` with the `policy_type` `restore_default` on
221 # several experimental projects, restoring the `constraint_default`
222 # enforcement of the `Constraint` for only those projects, allowing those
223 # projects to have all services activated.
224 },
225 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
226 # server, not specified by the caller, and represents the last time a call to
227 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
228 # be ignored.
229 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
230 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
231 # concurrency control.
232 #
233 # When the `Policy` is returned from either a `GetPolicy` or a
234 # `ListOrgPolicy` request, this `etag` indicates the version of the current
235 # `Policy` to use when executing a read-modify-write loop.
236 #
237 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
238 # `etag` will be unset.
239 #
240 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
241 # that was returned from a `GetOrgPolicy` request as part of a
242 # read-modify-write loop for concurrency control. Not setting the `etag`in a
243 # `SetOrgPolicy` request will result in an unconditional write of the
244 # `Policy`.
245 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
246 # `constraints/serviceuser.services`.
247 #
248 # A [list of available
249 # constraints](/resource-manager/docs/organization-policy/org-policy-constraints)
250 # is available.
251 #
252 # Immutable after creation.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]253 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]254 # resource.
255 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]256 # `ListPolicy` can define specific values and subtrees of Cloud Resource
257 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
258 # are allowed or denied by setting the `allowed_values` and `denied_values`
259 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
260 # The `under:` prefix is used to denote resource subtree values.
261 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]262 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]263 # same as values with no prefix.
264 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]265 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
266 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
267 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]268 # The `supports_under` field of the associated `Constraint` defines whether
269 # ancestry prefixes can be used. You can set `allowed_values` and
270 # `denied_values` in the same `Policy` if `all_values` is
271 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
272 # values. If `all_values` is set to either `ALLOW` or `DENY`,
273 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]274 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]275 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]276 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]277 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]278 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]279 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
280 # that matches the value specified in this `Policy`. If `suggested_value`
281 # is not set, it will inherit the value specified higher in the hierarchy,
282 # unless `inherit_from_parent` is `false`.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]283 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
284 # is set to `ALL_VALUES_UNSPECIFIED`.
285 &quot;A String&quot;,
286 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]287 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]288 #
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]289 # By default, a `ListPolicy` set at a resource supersedes any `Policy` set
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]290 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
291 # set to `true`, then the values from the effective `Policy` of the parent
292 # resource are inherited, meaning the values set in this `Policy` are
293 # added to the values inherited up the hierarchy.
294 #
295 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]296 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]297 # simple and understandable. However, it is possible to set a `Policy` with
298 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
299 # In this case, the values that are allowed must be in `allowed_values` and
300 # not present in `denied_values`.
301 #
302 # For example, suppose you have a `Constraint`
303 # `constraints/serviceuser.services`, which has a `constraint_type` of
304 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
305 # Suppose that at the Organization level, a `Policy` is applied that
306 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
307 # `Policy` is applied to a project below the Organization that has
308 # `inherit_from_parent` set to `false` and field all_values set to DENY,
309 # then an attempt to activate any API will be denied.
310 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]311 # The following examples demonstrate different possible layerings for
312 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]313 #
314 # Example 1 (no inherited values):
315 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]316 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]317 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]318 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]319 # The accepted values at `organizations/foo` are `E1`, `E2`.
320 # The accepted values at `projects/bar` are `E3`, and `E4`.
321 #
322 # Example 2 (inherited values):
323 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]324 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]325 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]326 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]327 # The accepted values at `organizations/foo` are `E1`, `E2`.
328 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
329 #
330 # Example 3 (inheriting both allowed and denied values):
331 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]332 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]333 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]334 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]335 # The accepted values at `organizations/foo` are `E1`, `E2`.
336 # The value accepted at `projects/bar` is `E2`.
337 #
338 # Example 4 (RestoreDefault):
339 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]340 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]341 # `projects/bar` has a `Policy` with values:
342 # {RestoreDefault: {}}
343 # The accepted values at `organizations/foo` are `E1`, `E2`.
344 # The accepted values at `projects/bar` are either all or none depending on
345 # the value of `constraint_default` (if `ALLOW`, all; if
346 # `DENY`, none).
347 #
348 # Example 5 (no policy inherits parent policy):
349 # `organizations/foo` has no `Policy` set.
350 # `projects/bar` has no `Policy` set.
351 # The accepted values at both levels are either all or none depending on
352 # the value of `constraint_default` (if `ALLOW`, all; if
353 # `DENY`, none).
354 #
355 # Example 6 (ListConstraint allowing all):
356 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]357 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]358 # `projects/bar` has a `Policy` with:
359 # {all: ALLOW}
360 # The accepted values at `organizations/foo` are `E1`, E2`.
361 # Any value is accepted at `projects/bar`.
362 #
363 # Example 7 (ListConstraint allowing none):
364 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]365 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]366 # `projects/bar` has a `Policy` with:
367 # {all: DENY}
368 # The accepted values at `organizations/foo` are `E1`, E2`.
369 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]370 #
371 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
372 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]373 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]374 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]375 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]376 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]377 # {allowed_values: &quot;under:projects/P3&quot;}
378 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]379 # The accepted values at `organizations/foo` are `organizations/O1`,
380 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
381 # `projects/P3`.
382 # The accepted values at `projects/bar` are `organizations/O1`,
383 # `folders/F1`, `projects/P1`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]384 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]385 }</pre>
386</div>
387
388<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]389 <code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]390 <pre>Gets a `Policy` on a resource.
391
392If no `Policy` is set on the resource, a `Policy` is returned with default
393values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The
394`etag` value can be used with `SetOrgPolicy()` to create or update a
395`Policy` during read-modify-write.
396
397Args:
398 resource: string, Name of the resource the `Policy` is set on. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]399 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]400 The object takes the form of:
401
402{ # The request sent to the GetOrgPolicy method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]403 &quot;constraint&quot;: &quot;A String&quot;, # Name of the `Constraint` to get the `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]404 }
405
406 x__xgafv: string, V1 error format.
407 Allowed values
408 1 - v1 error format
409 2 - v2 error format
410
411Returns:
412 An object of the form:
413
414 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
415 # for configurations of Cloud Platform resources.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]416 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
417 # resource.
418 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
419 # configuration is acceptable.
420 #
421 # Suppose you have a `Constraint`
422 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
423 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
424 # behavior:
425 # - If the `Policy` at this resource has enforced set to `false`, serial
426 # port connection attempts will be allowed.
427 # - If the `Policy` at this resource has enforced set to `true`, serial
428 # port connection attempts will be refused.
429 # - If the `Policy` at this resource is `RestoreDefault`, serial port
430 # connection attempts will be allowed.
431 # - If no `Policy` is set at this resource or anywhere higher in the
432 # resource hierarchy, serial port connection attempts will be allowed.
433 # - If no `Policy` is set at this resource, but one exists higher in the
434 # resource hierarchy, the behavior is as if the`Policy` were set at
435 # this resource.
436 #
437 # The following examples demonstrate the different possible layerings:
438 #
439 # Example 1 (nearest `Constraint` wins):
440 # `organizations/foo` has a `Policy` with:
441 # {enforced: false}
442 # `projects/bar` has no `Policy` set.
443 # The constraint at `projects/bar` and `organizations/foo` will not be
444 # enforced.
445 #
446 # Example 2 (enforcement gets replaced):
447 # `organizations/foo` has a `Policy` with:
448 # {enforced: false}
449 # `projects/bar` has a `Policy` with:
450 # {enforced: true}
451 # The constraint at `organizations/foo` is not enforced.
452 # The constraint at `projects/bar` is enforced.
453 #
454 # Example 3 (RestoreDefault):
455 # `organizations/foo` has a `Policy` with:
456 # {enforced: true}
457 # `projects/bar` has a `Policy` with:
458 # {RestoreDefault: {}}
459 # The constraint at `organizations/foo` is enforced.
460 # The constraint at `projects/bar` is not enforced, because
461 # `constraint_default` for the `Constraint` is `ALLOW`.
462 },
463 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
464 # `Constraint` type.
465 # `constraint_default` enforcement behavior of the specific `Constraint` at
466 # this resource.
467 #
468 # Suppose that `constraint_default` is set to `ALLOW` for the
469 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
470 # foo.com sets a `Policy` at their Organization resource node that restricts
471 # the allowed service activations to deny all service activations. They
472 # could then set a `Policy` with the `policy_type` `restore_default` on
473 # several experimental projects, restoring the `constraint_default`
474 # enforcement of the `Constraint` for only those projects, allowing those
475 # projects to have all services activated.
476 },
477 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
478 # server, not specified by the caller, and represents the last time a call to
479 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
480 # be ignored.
481 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
482 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
483 # concurrency control.
484 #
485 # When the `Policy` is returned from either a `GetPolicy` or a
486 # `ListOrgPolicy` request, this `etag` indicates the version of the current
487 # `Policy` to use when executing a read-modify-write loop.
488 #
489 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
490 # `etag` will be unset.
491 #
492 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
493 # that was returned from a `GetOrgPolicy` request as part of a
494 # read-modify-write loop for concurrency control. Not setting the `etag`in a
495 # `SetOrgPolicy` request will result in an unconditional write of the
496 # `Policy`.
497 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
498 # `constraints/serviceuser.services`.
499 #
500 # A [list of available
501 # constraints](/resource-manager/docs/organization-policy/org-policy-constraints)
502 # is available.
503 #
504 # Immutable after creation.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]505 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]506 # resource.
507 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]508 # `ListPolicy` can define specific values and subtrees of Cloud Resource
509 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
510 # are allowed or denied by setting the `allowed_values` and `denied_values`
511 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
512 # The `under:` prefix is used to denote resource subtree values.
513 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]514 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]515 # same as values with no prefix.
516 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]517 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
518 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
519 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]520 # The `supports_under` field of the associated `Constraint` defines whether
521 # ancestry prefixes can be used. You can set `allowed_values` and
522 # `denied_values` in the same `Policy` if `all_values` is
523 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
524 # values. If `all_values` is set to either `ALLOW` or `DENY`,
525 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]526 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]527 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]528 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]529 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]530 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]531 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
532 # that matches the value specified in this `Policy`. If `suggested_value`
533 # is not set, it will inherit the value specified higher in the hierarchy,
534 # unless `inherit_from_parent` is `false`.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]535 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
536 # is set to `ALL_VALUES_UNSPECIFIED`.
537 &quot;A String&quot;,
538 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]539 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]540 #
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]541 # By default, a `ListPolicy` set at a resource supersedes any `Policy` set
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]542 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
543 # set to `true`, then the values from the effective `Policy` of the parent
544 # resource are inherited, meaning the values set in this `Policy` are
545 # added to the values inherited up the hierarchy.
546 #
547 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]548 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]549 # simple and understandable. However, it is possible to set a `Policy` with
550 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
551 # In this case, the values that are allowed must be in `allowed_values` and
552 # not present in `denied_values`.
553 #
554 # For example, suppose you have a `Constraint`
555 # `constraints/serviceuser.services`, which has a `constraint_type` of
556 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
557 # Suppose that at the Organization level, a `Policy` is applied that
558 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
559 # `Policy` is applied to a project below the Organization that has
560 # `inherit_from_parent` set to `false` and field all_values set to DENY,
561 # then an attempt to activate any API will be denied.
562 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]563 # The following examples demonstrate different possible layerings for
564 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]565 #
566 # Example 1 (no inherited values):
567 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]568 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]569 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]570 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]571 # The accepted values at `organizations/foo` are `E1`, `E2`.
572 # The accepted values at `projects/bar` are `E3`, and `E4`.
573 #
574 # Example 2 (inherited values):
575 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]576 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]577 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]578 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]579 # The accepted values at `organizations/foo` are `E1`, `E2`.
580 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
581 #
582 # Example 3 (inheriting both allowed and denied values):
583 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]584 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]585 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]586 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]587 # The accepted values at `organizations/foo` are `E1`, `E2`.
588 # The value accepted at `projects/bar` is `E2`.
589 #
590 # Example 4 (RestoreDefault):
591 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]592 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]593 # `projects/bar` has a `Policy` with values:
594 # {RestoreDefault: {}}
595 # The accepted values at `organizations/foo` are `E1`, `E2`.
596 # The accepted values at `projects/bar` are either all or none depending on
597 # the value of `constraint_default` (if `ALLOW`, all; if
598 # `DENY`, none).
599 #
600 # Example 5 (no policy inherits parent policy):
601 # `organizations/foo` has no `Policy` set.
602 # `projects/bar` has no `Policy` set.
603 # The accepted values at both levels are either all or none depending on
604 # the value of `constraint_default` (if `ALLOW`, all; if
605 # `DENY`, none).
606 #
607 # Example 6 (ListConstraint allowing all):
608 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]609 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]610 # `projects/bar` has a `Policy` with:
611 # {all: ALLOW}
612 # The accepted values at `organizations/foo` are `E1`, E2`.
613 # Any value is accepted at `projects/bar`.
614 #
615 # Example 7 (ListConstraint allowing none):
616 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]617 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]618 # `projects/bar` has a `Policy` with:
619 # {all: DENY}
620 # The accepted values at `organizations/foo` are `E1`, E2`.
621 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]622 #
623 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
624 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]625 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]626 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]627 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]628 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]629 # {allowed_values: &quot;under:projects/P3&quot;}
630 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]631 # The accepted values at `organizations/foo` are `organizations/O1`,
632 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
633 # `projects/P3`.
634 # The accepted values at `projects/bar` are `organizations/O1`,
635 # `folders/F1`, `projects/P1`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]636 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]637 }</pre>
638</div>
639
640<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]641 <code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]642 <pre>Lists `Constraints` that could be applied on the specified resource.
643
644Args:
645 resource: string, Name of the resource to list `Constraints` for. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]646 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]647 The object takes the form of:
648
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]649{ # The request sent to the `ListAvailableOrgPolicyConstraints` method on the
650 # project, folder, or organization.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]651 &quot;pageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently unsupported
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]652 # and will be ignored. The server may at any point start using this field.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]653 &quot;pageSize&quot;: 42, # Size of the pages to be returned. This is currently unsupported and will
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]654 # be ignored. The server may at any point start using this field to limit
655 # page size.
656 }
657
658 x__xgafv: string, V1 error format.
659 Allowed values
660 1 - v1 error format
661 2 - v2 error format
662
663Returns:
664 An object of the form:
665
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]666 { # The response returned from the `ListAvailableOrgPolicyConstraints` method.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]667 # Returns all `Constraints` that could be set at this level of the hierarchy
668 # (contrast with the response from `ListPolicies`, which returns all policies
669 # which are set).
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]670 &quot;constraints&quot;: [ # The collection of constraints that are settable on the request resource.
671 { # A `Constraint` describes a way in which a resource&#x27;s configuration can be
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]672 # restricted. For example, it controls which cloud services can be activated
673 # across an organization, or whether a Compute Engine instance can have
674 # serial port connections established. `Constraints` can be configured by the
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]675 # organization&#x27;s policy administrator to fit the needs of the organzation by
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]676 # setting Policies for `Constraints` at different locations in the
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]677 # organization&#x27;s resource hierarchy. Policies are inherited down the resource
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]678 # hierarchy from higher levels, but can also be overridden. For details about
679 # the inheritance rules please read about
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]680 # [Policies](/resource-manager/reference/rest/v1/Policy).
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]681 #
682 # `Constraints` have a default behavior determined by the `constraint_default`
683 # field, which is the enforcement behavior that is used in the absence of a
684 # `Policy` being defined or inherited for the resource in question.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]685 &quot;booleanConstraint&quot;: { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.
686 #
687 # For example a constraint `constraints/compute.disableSerialPortAccess`.
688 # If it is enforced on a VM instance, serial port connections will not be
689 # opened to that instance.
690 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]691 &quot;name&quot;: &quot;A String&quot;, # Immutable value, required to globally be unique. For example,
692 # `constraints/serviceuser.services`
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]693 &quot;displayName&quot;: &quot;A String&quot;, # The human readable name.
694 #
695 # Mutable.
696 &quot;version&quot;: 42, # Version of the `Constraint`. Default version is 0;
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]697 &quot;listConstraint&quot;: { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.
698 # configured by an Organization&#x27;s policy administrator with a `Policy`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]699 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
700 # that matches the value specified in this `Constraint`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]701 &quot;supportsUnder&quot;: True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy
702 # can be used in `Policy.allowed_values` and `Policy.denied_values`. For
703 # example, `&quot;under:folders/123&quot;` would match any resource under the
704 # &#x27;folders/123&#x27; folder.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]705 },
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]706 &quot;constraintDefault&quot;: &quot;A String&quot;, # The evaluation behavior of this constraint in the absence of &#x27;Policy&#x27;.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]707 &quot;description&quot;: &quot;A String&quot;, # Detailed description of what this `Constraint` controls as well as how and
708 # where it is enforced.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]709 #
710 # Mutable.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]711 },
712 ],
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]713 &quot;nextPageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently not used.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]714 }</pre>
715</div>
716
717<div class="method">
718 <code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>
719 <pre>Retrieves the next page of results.
720
721Args:
722 previous_request: The request for the previous page. (required)
723 previous_response: The response from the request for the previous page. (required)
724
725Returns:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]726 A request object that you can call &#x27;execute()&#x27; on to request the next
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]727 page. Returns None if there are no more items in the collection.
728 </pre>
729</div>
730
731<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]732 <code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]733 <pre>Lists all the `Policies` set for a particular resource.
734
735Args:
736 resource: string, Name of the resource to list Policies for. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]737 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]738 The object takes the form of:
739
740{ # The request sent to the ListOrgPolicies method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]741 &quot;pageSize&quot;: 42, # Size of the pages to be returned. This is currently unsupported and will
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]742 # be ignored. The server may at any point start using this field to limit
743 # page size.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]744 &quot;pageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently unsupported
745 # and will be ignored. The server may at any point start using this field.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]746 }
747
748 x__xgafv: string, V1 error format.
749 Allowed values
750 1 - v1 error format
751 2 - v2 error format
752
753Returns:
754 An object of the form:
755
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]756 { # The response returned from the `ListOrgPolicies` method. It will be empty
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]757 # if no `Policies` are set on the resource.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]758 &quot;nextPageToken&quot;: &quot;A String&quot;, # Page token used to retrieve the next page. This is currently not used, but
759 # the server may at any point start supplying a valid token.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]760 &quot;policies&quot;: [ # The `Policies` that are set on the resource. It will be empty if no
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]761 # `Policies` are set.
762 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
763 # for configurations of Cloud Platform resources.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]764 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
765 # resource.
766 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
767 # configuration is acceptable.
768 #
769 # Suppose you have a `Constraint`
770 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
771 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
772 # behavior:
773 # - If the `Policy` at this resource has enforced set to `false`, serial
774 # port connection attempts will be allowed.
775 # - If the `Policy` at this resource has enforced set to `true`, serial
776 # port connection attempts will be refused.
777 # - If the `Policy` at this resource is `RestoreDefault`, serial port
778 # connection attempts will be allowed.
779 # - If no `Policy` is set at this resource or anywhere higher in the
780 # resource hierarchy, serial port connection attempts will be allowed.
781 # - If no `Policy` is set at this resource, but one exists higher in the
782 # resource hierarchy, the behavior is as if the`Policy` were set at
783 # this resource.
784 #
785 # The following examples demonstrate the different possible layerings:
786 #
787 # Example 1 (nearest `Constraint` wins):
788 # `organizations/foo` has a `Policy` with:
789 # {enforced: false}
790 # `projects/bar` has no `Policy` set.
791 # The constraint at `projects/bar` and `organizations/foo` will not be
792 # enforced.
793 #
794 # Example 2 (enforcement gets replaced):
795 # `organizations/foo` has a `Policy` with:
796 # {enforced: false}
797 # `projects/bar` has a `Policy` with:
798 # {enforced: true}
799 # The constraint at `organizations/foo` is not enforced.
800 # The constraint at `projects/bar` is enforced.
801 #
802 # Example 3 (RestoreDefault):
803 # `organizations/foo` has a `Policy` with:
804 # {enforced: true}
805 # `projects/bar` has a `Policy` with:
806 # {RestoreDefault: {}}
807 # The constraint at `organizations/foo` is enforced.
808 # The constraint at `projects/bar` is not enforced, because
809 # `constraint_default` for the `Constraint` is `ALLOW`.
810 },
811 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
812 # `Constraint` type.
813 # `constraint_default` enforcement behavior of the specific `Constraint` at
814 # this resource.
815 #
816 # Suppose that `constraint_default` is set to `ALLOW` for the
817 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
818 # foo.com sets a `Policy` at their Organization resource node that restricts
819 # the allowed service activations to deny all service activations. They
820 # could then set a `Policy` with the `policy_type` `restore_default` on
821 # several experimental projects, restoring the `constraint_default`
822 # enforcement of the `Constraint` for only those projects, allowing those
823 # projects to have all services activated.
824 },
825 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
826 # server, not specified by the caller, and represents the last time a call to
827 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
828 # be ignored.
829 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
830 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
831 # concurrency control.
832 #
833 # When the `Policy` is returned from either a `GetPolicy` or a
834 # `ListOrgPolicy` request, this `etag` indicates the version of the current
835 # `Policy` to use when executing a read-modify-write loop.
836 #
837 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
838 # `etag` will be unset.
839 #
840 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
841 # that was returned from a `GetOrgPolicy` request as part of a
842 # read-modify-write loop for concurrency control. Not setting the `etag`in a
843 # `SetOrgPolicy` request will result in an unconditional write of the
844 # `Policy`.
845 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
846 # `constraints/serviceuser.services`.
847 #
848 # A [list of available
849 # constraints](/resource-manager/docs/organization-policy/org-policy-constraints)
850 # is available.
851 #
852 # Immutable after creation.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]853 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]854 # resource.
855 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]856 # `ListPolicy` can define specific values and subtrees of Cloud Resource
857 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
858 # are allowed or denied by setting the `allowed_values` and `denied_values`
859 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
860 # The `under:` prefix is used to denote resource subtree values.
861 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]862 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]863 # same as values with no prefix.
864 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]865 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
866 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
867 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]868 # The `supports_under` field of the associated `Constraint` defines whether
869 # ancestry prefixes can be used. You can set `allowed_values` and
870 # `denied_values` in the same `Policy` if `all_values` is
871 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
872 # values. If `all_values` is set to either `ALLOW` or `DENY`,
873 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]874 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]875 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]876 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]877 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]878 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]879 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
880 # that matches the value specified in this `Policy`. If `suggested_value`
881 # is not set, it will inherit the value specified higher in the hierarchy,
882 # unless `inherit_from_parent` is `false`.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]883 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
884 # is set to `ALL_VALUES_UNSPECIFIED`.
885 &quot;A String&quot;,
886 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]887 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]888 #
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]889 # By default, a `ListPolicy` set at a resource supersedes any `Policy` set
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]890 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
891 # set to `true`, then the values from the effective `Policy` of the parent
892 # resource are inherited, meaning the values set in this `Policy` are
893 # added to the values inherited up the hierarchy.
894 #
895 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]896 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]897 # simple and understandable. However, it is possible to set a `Policy` with
898 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
899 # In this case, the values that are allowed must be in `allowed_values` and
900 # not present in `denied_values`.
901 #
902 # For example, suppose you have a `Constraint`
903 # `constraints/serviceuser.services`, which has a `constraint_type` of
904 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
905 # Suppose that at the Organization level, a `Policy` is applied that
906 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
907 # `Policy` is applied to a project below the Organization that has
908 # `inherit_from_parent` set to `false` and field all_values set to DENY,
909 # then an attempt to activate any API will be denied.
910 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]911 # The following examples demonstrate different possible layerings for
912 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]913 #
914 # Example 1 (no inherited values):
915 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]916 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]917 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]918 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]919 # The accepted values at `organizations/foo` are `E1`, `E2`.
920 # The accepted values at `projects/bar` are `E3`, and `E4`.
921 #
922 # Example 2 (inherited values):
923 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]924 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]925 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]926 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]927 # The accepted values at `organizations/foo` are `E1`, `E2`.
928 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
929 #
930 # Example 3 (inheriting both allowed and denied values):
931 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]932 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]933 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]934 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]935 # The accepted values at `organizations/foo` are `E1`, `E2`.
936 # The value accepted at `projects/bar` is `E2`.
937 #
938 # Example 4 (RestoreDefault):
939 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]940 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]941 # `projects/bar` has a `Policy` with values:
942 # {RestoreDefault: {}}
943 # The accepted values at `organizations/foo` are `E1`, `E2`.
944 # The accepted values at `projects/bar` are either all or none depending on
945 # the value of `constraint_default` (if `ALLOW`, all; if
946 # `DENY`, none).
947 #
948 # Example 5 (no policy inherits parent policy):
949 # `organizations/foo` has no `Policy` set.
950 # `projects/bar` has no `Policy` set.
951 # The accepted values at both levels are either all or none depending on
952 # the value of `constraint_default` (if `ALLOW`, all; if
953 # `DENY`, none).
954 #
955 # Example 6 (ListConstraint allowing all):
956 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]957 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]958 # `projects/bar` has a `Policy` with:
959 # {all: ALLOW}
960 # The accepted values at `organizations/foo` are `E1`, E2`.
961 # Any value is accepted at `projects/bar`.
962 #
963 # Example 7 (ListConstraint allowing none):
964 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]965 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]966 # `projects/bar` has a `Policy` with:
967 # {all: DENY}
968 # The accepted values at `organizations/foo` are `E1`, E2`.
969 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]970 #
971 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
972 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]973 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]974 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]975 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]976 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]977 # {allowed_values: &quot;under:projects/P3&quot;}
978 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]979 # The accepted values at `organizations/foo` are `organizations/O1`,
980 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
981 # `projects/P3`.
982 # The accepted values at `projects/bar` are `organizations/O1`,
983 # `folders/F1`, `projects/P1`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]984 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]985 },
986 ],
987 }</pre>
988</div>
989
990<div class="method">
991 <code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>
992 <pre>Retrieves the next page of results.
993
994Args:
995 previous_request: The request for the previous page. (required)
996 previous_response: The response from the request for the previous page. (required)
997
998Returns:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]999 A request object that you can call &#x27;execute()&#x27; on to request the next
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1000 page. Returns None if there are no more items in the collection.
1001 </pre>
1002</div>
1003
1004<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1005 <code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1006 <pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for
1007that `Constraint` on the resource if one does not exist.
1008
1009Not supplying an `etag` on the request `Policy` results in an unconditional
1010write of the `Policy`.
1011
1012Args:
1013 resource: string, Resource name of the resource to attach the `Policy`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1014 body: object, The request body.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1015 The object takes the form of:
1016
1017{ # The request sent to the SetOrgPolicyRequest method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1018 &quot;policy&quot;: { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1019 # for configurations of Cloud Platform resources.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1020 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
1021 # resource.
1022 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
1023 # configuration is acceptable.
1024 #
1025 # Suppose you have a `Constraint`
1026 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
1027 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
1028 # behavior:
1029 # - If the `Policy` at this resource has enforced set to `false`, serial
1030 # port connection attempts will be allowed.
1031 # - If the `Policy` at this resource has enforced set to `true`, serial
1032 # port connection attempts will be refused.
1033 # - If the `Policy` at this resource is `RestoreDefault`, serial port
1034 # connection attempts will be allowed.
1035 # - If no `Policy` is set at this resource or anywhere higher in the
1036 # resource hierarchy, serial port connection attempts will be allowed.
1037 # - If no `Policy` is set at this resource, but one exists higher in the
1038 # resource hierarchy, the behavior is as if the`Policy` were set at
1039 # this resource.
1040 #
1041 # The following examples demonstrate the different possible layerings:
1042 #
1043 # Example 1 (nearest `Constraint` wins):
1044 # `organizations/foo` has a `Policy` with:
1045 # {enforced: false}
1046 # `projects/bar` has no `Policy` set.
1047 # The constraint at `projects/bar` and `organizations/foo` will not be
1048 # enforced.
1049 #
1050 # Example 2 (enforcement gets replaced):
1051 # `organizations/foo` has a `Policy` with:
1052 # {enforced: false}
1053 # `projects/bar` has a `Policy` with:
1054 # {enforced: true}
1055 # The constraint at `organizations/foo` is not enforced.
1056 # The constraint at `projects/bar` is enforced.
1057 #
1058 # Example 3 (RestoreDefault):
1059 # `organizations/foo` has a `Policy` with:
1060 # {enforced: true}
1061 # `projects/bar` has a `Policy` with:
1062 # {RestoreDefault: {}}
1063 # The constraint at `organizations/foo` is enforced.
1064 # The constraint at `projects/bar` is not enforced, because
1065 # `constraint_default` for the `Constraint` is `ALLOW`.
1066 },
1067 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
1068 # `Constraint` type.
1069 # `constraint_default` enforcement behavior of the specific `Constraint` at
1070 # this resource.
1071 #
1072 # Suppose that `constraint_default` is set to `ALLOW` for the
1073 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
1074 # foo.com sets a `Policy` at their Organization resource node that restricts
1075 # the allowed service activations to deny all service activations. They
1076 # could then set a `Policy` with the `policy_type` `restore_default` on
1077 # several experimental projects, restoring the `constraint_default`
1078 # enforcement of the `Constraint` for only those projects, allowing those
1079 # projects to have all services activated.
1080 },
1081 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
1082 # server, not specified by the caller, and represents the last time a call to
1083 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
1084 # be ignored.
1085 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
1086 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
1087 # concurrency control.
1088 #
1089 # When the `Policy` is returned from either a `GetPolicy` or a
1090 # `ListOrgPolicy` request, this `etag` indicates the version of the current
1091 # `Policy` to use when executing a read-modify-write loop.
1092 #
1093 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
1094 # `etag` will be unset.
1095 #
1096 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
1097 # that was returned from a `GetOrgPolicy` request as part of a
1098 # read-modify-write loop for concurrency control. Not setting the `etag`in a
1099 # `SetOrgPolicy` request will result in an unconditional write of the
1100 # `Policy`.
1101 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
1102 # `constraints/serviceuser.services`.
1103 #
1104 # A [list of available
1105 # constraints](/resource-manager/docs/organization-policy/org-policy-constraints)
1106 # is available.
1107 #
1108 # Immutable after creation.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1109 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1110 # resource.
1111 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1112 # `ListPolicy` can define specific values and subtrees of Cloud Resource
1113 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
1114 # are allowed or denied by setting the `allowed_values` and `denied_values`
1115 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
1116 # The `under:` prefix is used to denote resource subtree values.
1117 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1118 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1119 # same as values with no prefix.
1120 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1121 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
1122 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
1123 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1124 # The `supports_under` field of the associated `Constraint` defines whether
1125 # ancestry prefixes can be used. You can set `allowed_values` and
1126 # `denied_values` in the same `Policy` if `all_values` is
1127 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
1128 # values. If `all_values` is set to either `ALLOW` or `DENY`,
1129 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1130 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1131 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1132 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1133 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1134 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1135 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
1136 # that matches the value specified in this `Policy`. If `suggested_value`
1137 # is not set, it will inherit the value specified higher in the hierarchy,
1138 # unless `inherit_from_parent` is `false`.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1139 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
1140 # is set to `ALL_VALUES_UNSPECIFIED`.
1141 &quot;A String&quot;,
1142 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1143 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1144 #
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1145 # By default, a `ListPolicy` set at a resource supersedes any `Policy` set
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1146 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
1147 # set to `true`, then the values from the effective `Policy` of the parent
1148 # resource are inherited, meaning the values set in this `Policy` are
1149 # added to the values inherited up the hierarchy.
1150 #
1151 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1152 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1153 # simple and understandable. However, it is possible to set a `Policy` with
1154 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
1155 # In this case, the values that are allowed must be in `allowed_values` and
1156 # not present in `denied_values`.
1157 #
1158 # For example, suppose you have a `Constraint`
1159 # `constraints/serviceuser.services`, which has a `constraint_type` of
1160 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
1161 # Suppose that at the Organization level, a `Policy` is applied that
1162 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
1163 # `Policy` is applied to a project below the Organization that has
1164 # `inherit_from_parent` set to `false` and field all_values set to DENY,
1165 # then an attempt to activate any API will be denied.
1166 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1167 # The following examples demonstrate different possible layerings for
1168 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1169 #
1170 # Example 1 (no inherited values):
1171 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1172 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1173 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1174 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1175 # The accepted values at `organizations/foo` are `E1`, `E2`.
1176 # The accepted values at `projects/bar` are `E3`, and `E4`.
1177 #
1178 # Example 2 (inherited values):
1179 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1180 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1181 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1182 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1183 # The accepted values at `organizations/foo` are `E1`, `E2`.
1184 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
1185 #
1186 # Example 3 (inheriting both allowed and denied values):
1187 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1188 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1189 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1190 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1191 # The accepted values at `organizations/foo` are `E1`, `E2`.
1192 # The value accepted at `projects/bar` is `E2`.
1193 #
1194 # Example 4 (RestoreDefault):
1195 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1196 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1197 # `projects/bar` has a `Policy` with values:
1198 # {RestoreDefault: {}}
1199 # The accepted values at `organizations/foo` are `E1`, `E2`.
1200 # The accepted values at `projects/bar` are either all or none depending on
1201 # the value of `constraint_default` (if `ALLOW`, all; if
1202 # `DENY`, none).
1203 #
1204 # Example 5 (no policy inherits parent policy):
1205 # `organizations/foo` has no `Policy` set.
1206 # `projects/bar` has no `Policy` set.
1207 # The accepted values at both levels are either all or none depending on
1208 # the value of `constraint_default` (if `ALLOW`, all; if
1209 # `DENY`, none).
1210 #
1211 # Example 6 (ListConstraint allowing all):
1212 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1213 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1214 # `projects/bar` has a `Policy` with:
1215 # {all: ALLOW}
1216 # The accepted values at `organizations/foo` are `E1`, E2`.
1217 # Any value is accepted at `projects/bar`.
1218 #
1219 # Example 7 (ListConstraint allowing none):
1220 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1221 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1222 # `projects/bar` has a `Policy` with:
1223 # {all: DENY}
1224 # The accepted values at `organizations/foo` are `E1`, E2`.
1225 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1226 #
1227 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
1228 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1229 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1230 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1231 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1232 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1233 # {allowed_values: &quot;under:projects/P3&quot;}
1234 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1235 # The accepted values at `organizations/foo` are `organizations/O1`,
1236 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
1237 # `projects/P3`.
1238 # The accepted values at `projects/bar` are `organizations/O1`,
1239 # `folders/F1`, `projects/P1`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1240 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1241 },
1242 }
1243
1244 x__xgafv: string, V1 error format.
1245 Allowed values
1246 1 - v1 error format
1247 2 - v2 error format
1248
1249Returns:
1250 An object of the form:
1251
1252 { # Defines a Cloud Organization `Policy` which is used to specify `Constraints`
1253 # for configurations of Cloud Platform resources.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1254 &quot;booleanPolicy&quot;: { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.
1255 # resource.
1256 &quot;enforced&quot;: True or False, # If `true`, then the `Policy` is enforced. If `false`, then any
1257 # configuration is acceptable.
1258 #
1259 # Suppose you have a `Constraint`
1260 # `constraints/compute.disableSerialPortAccess` with `constraint_default`
1261 # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following
1262 # behavior:
1263 # - If the `Policy` at this resource has enforced set to `false`, serial
1264 # port connection attempts will be allowed.
1265 # - If the `Policy` at this resource has enforced set to `true`, serial
1266 # port connection attempts will be refused.
1267 # - If the `Policy` at this resource is `RestoreDefault`, serial port
1268 # connection attempts will be allowed.
1269 # - If no `Policy` is set at this resource or anywhere higher in the
1270 # resource hierarchy, serial port connection attempts will be allowed.
1271 # - If no `Policy` is set at this resource, but one exists higher in the
1272 # resource hierarchy, the behavior is as if the`Policy` were set at
1273 # this resource.
1274 #
1275 # The following examples demonstrate the different possible layerings:
1276 #
1277 # Example 1 (nearest `Constraint` wins):
1278 # `organizations/foo` has a `Policy` with:
1279 # {enforced: false}
1280 # `projects/bar` has no `Policy` set.
1281 # The constraint at `projects/bar` and `organizations/foo` will not be
1282 # enforced.
1283 #
1284 # Example 2 (enforcement gets replaced):
1285 # `organizations/foo` has a `Policy` with:
1286 # {enforced: false}
1287 # `projects/bar` has a `Policy` with:
1288 # {enforced: true}
1289 # The constraint at `organizations/foo` is not enforced.
1290 # The constraint at `projects/bar` is enforced.
1291 #
1292 # Example 3 (RestoreDefault):
1293 # `organizations/foo` has a `Policy` with:
1294 # {enforced: true}
1295 # `projects/bar` has a `Policy` with:
1296 # {RestoreDefault: {}}
1297 # The constraint at `organizations/foo` is enforced.
1298 # The constraint at `projects/bar` is not enforced, because
1299 # `constraint_default` for the `Constraint` is `ALLOW`.
1300 },
1301 &quot;restoreDefault&quot;: { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of
1302 # `Constraint` type.
1303 # `constraint_default` enforcement behavior of the specific `Constraint` at
1304 # this resource.
1305 #
1306 # Suppose that `constraint_default` is set to `ALLOW` for the
1307 # `Constraint` `constraints/serviceuser.services`. Suppose that organization
1308 # foo.com sets a `Policy` at their Organization resource node that restricts
1309 # the allowed service activations to deny all service activations. They
1310 # could then set a `Policy` with the `policy_type` `restore_default` on
1311 # several experimental projects, restoring the `constraint_default`
1312 # enforcement of the `Constraint` for only those projects, allowing those
1313 # projects to have all services activated.
1314 },
1315 &quot;updateTime&quot;: &quot;A String&quot;, # The time stamp the `Policy` was previously updated. This is set by the
1316 # server, not specified by the caller, and represents the last time a call to
1317 # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will
1318 # be ignored.
1319 &quot;version&quot;: 42, # Version of the `Policy`. Default version is 0;
1320 &quot;etag&quot;: &quot;A String&quot;, # An opaque tag indicating the current version of the `Policy`, used for
1321 # concurrency control.
1322 #
1323 # When the `Policy` is returned from either a `GetPolicy` or a
1324 # `ListOrgPolicy` request, this `etag` indicates the version of the current
1325 # `Policy` to use when executing a read-modify-write loop.
1326 #
1327 # When the `Policy` is returned from a `GetEffectivePolicy` request, the
1328 # `etag` will be unset.
1329 #
1330 # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value
1331 # that was returned from a `GetOrgPolicy` request as part of a
1332 # read-modify-write loop for concurrency control. Not setting the `etag`in a
1333 # `SetOrgPolicy` request will result in an unconditional write of the
1334 # `Policy`.
1335 &quot;constraint&quot;: &quot;A String&quot;, # The name of the `Constraint` the `Policy` is configuring, for example,
1336 # `constraints/serviceuser.services`.
1337 #
1338 # A [list of available
1339 # constraints](/resource-manager/docs/organization-policy/org-policy-constraints)
1340 # is available.
1341 #
1342 # Immutable after creation.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1343 &quot;listPolicy&quot;: { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1344 # resource.
1345 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1346 # `ListPolicy` can define specific values and subtrees of Cloud Resource
1347 # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
1348 # are allowed or denied by setting the `allowed_values` and `denied_values`
1349 # fields. This is achieved by using the `under:` and optional `is:` prefixes.
1350 # The `under:` prefix is used to denote resource subtree values.
1351 # The `is:` prefix is used to denote specific values, and is required only
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1352 # if the value contains a &quot;:&quot;. Values prefixed with &quot;is:&quot; are treated the
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1353 # same as values with no prefix.
1354 # Ancestry subtrees must be in one of the following formats:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1355 # - &quot;projects/&lt;project-id&gt;&quot;, e.g. &quot;projects/tokyo-rain-123&quot;
1356 # - &quot;folders/&lt;folder-id&gt;&quot;, e.g. &quot;folders/1234&quot;
1357 # - &quot;organizations/&lt;organization-id&gt;&quot;, e.g. &quot;organizations/1234&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1358 # The `supports_under` field of the associated `Constraint` defines whether
1359 # ancestry prefixes can be used. You can set `allowed_values` and
1360 # `denied_values` in the same `Policy` if `all_values` is
1361 # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all
1362 # values. If `all_values` is set to either `ALLOW` or `DENY`,
1363 # `allowed_values` and `denied_values` must be unset.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1364 &quot;allValues&quot;: &quot;A String&quot;, # The policy all_values state.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1365 &quot;deniedValues&quot;: [ # List of values denied at this resource. Can only be set if `all_values`
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1366 # is set to `ALL_VALUES_UNSPECIFIED`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1367 &quot;A String&quot;,
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1368 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1369 &quot;suggestedValue&quot;: &quot;A String&quot;, # Optional. The Google Cloud Console will try to default to a configuration
1370 # that matches the value specified in this `Policy`. If `suggested_value`
1371 # is not set, it will inherit the value specified higher in the hierarchy,
1372 # unless `inherit_from_parent` is `false`.
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1373 &quot;allowedValues&quot;: [ # List of values allowed at this resource. Can only be set if `all_values`
1374 # is set to `ALL_VALUES_UNSPECIFIED`.
1375 &quot;A String&quot;,
1376 ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1377 &quot;inheritFromParent&quot;: True or False, # Determines the inheritance behavior for this `Policy`.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1378 #
Bu Sun Kimd059ad82020-07-22 17:02:09 -0700[diff] [blame^]1379 # By default, a `ListPolicy` set at a resource supersedes any `Policy` set
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1380 # anywhere up the resource hierarchy. However, if `inherit_from_parent` is
1381 # set to `true`, then the values from the effective `Policy` of the parent
1382 # resource are inherited, meaning the values set in this `Policy` are
1383 # added to the values inherited up the hierarchy.
1384 #
1385 # Setting `Policy` hierarchies that inherit both allowed values and denied
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1386 # values isn&#x27;t recommended in most circumstances to keep the configuration
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1387 # simple and understandable. However, it is possible to set a `Policy` with
1388 # `allowed_values` set that inherits a `Policy` with `denied_values` set.
1389 # In this case, the values that are allowed must be in `allowed_values` and
1390 # not present in `denied_values`.
1391 #
1392 # For example, suppose you have a `Constraint`
1393 # `constraints/serviceuser.services`, which has a `constraint_type` of
1394 # `list_constraint`, and with `constraint_default` set to `ALLOW`.
1395 # Suppose that at the Organization level, a `Policy` is applied that
1396 # restricts the allowed API activations to {`E1`, `E2`}. Then, if a
1397 # `Policy` is applied to a project below the Organization that has
1398 # `inherit_from_parent` set to `false` and field all_values set to DENY,
1399 # then an attempt to activate any API will be denied.
1400 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1401 # The following examples demonstrate different possible layerings for
1402 # `projects/bar` parented by `organizations/foo`:
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1403 #
1404 # Example 1 (no inherited values):
1405 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1406 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1407 # `projects/bar` has `inherit_from_parent` `false` and values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1408 # {allowed_values: &quot;E3&quot; allowed_values: &quot;E4&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1409 # The accepted values at `organizations/foo` are `E1`, `E2`.
1410 # The accepted values at `projects/bar` are `E3`, and `E4`.
1411 #
1412 # Example 2 (inherited values):
1413 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1414 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1415 # `projects/bar` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1416 # {value: &quot;E3&quot; value: &quot;E4&quot; inherit_from_parent: true}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1417 # The accepted values at `organizations/foo` are `E1`, `E2`.
1418 # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
1419 #
1420 # Example 3 (inheriting both allowed and denied values):
1421 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1422 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1423 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1424 # {denied_values: &quot;E1&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1425 # The accepted values at `organizations/foo` are `E1`, `E2`.
1426 # The value accepted at `projects/bar` is `E2`.
1427 #
1428 # Example 4 (RestoreDefault):
1429 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1430 # {allowed_values: &quot;E1&quot; allowed_values:&quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1431 # `projects/bar` has a `Policy` with values:
1432 # {RestoreDefault: {}}
1433 # The accepted values at `organizations/foo` are `E1`, `E2`.
1434 # The accepted values at `projects/bar` are either all or none depending on
1435 # the value of `constraint_default` (if `ALLOW`, all; if
1436 # `DENY`, none).
1437 #
1438 # Example 5 (no policy inherits parent policy):
1439 # `organizations/foo` has no `Policy` set.
1440 # `projects/bar` has no `Policy` set.
1441 # The accepted values at both levels are either all or none depending on
1442 # the value of `constraint_default` (if `ALLOW`, all; if
1443 # `DENY`, none).
1444 #
1445 # Example 6 (ListConstraint allowing all):
1446 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1447 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1448 # `projects/bar` has a `Policy` with:
1449 # {all: ALLOW}
1450 # The accepted values at `organizations/foo` are `E1`, E2`.
1451 # Any value is accepted at `projects/bar`.
1452 #
1453 # Example 7 (ListConstraint allowing none):
1454 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1455 # {allowed_values: &quot;E1&quot; allowed_values: &quot;E2&quot;}
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1456 # `projects/bar` has a `Policy` with:
1457 # {all: DENY}
1458 # The accepted values at `organizations/foo` are `E1`, E2`.
1459 # No value is accepted at `projects/bar`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1460 #
1461 # Example 10 (allowed and denied subtrees of Resource Manager hierarchy):
1462 # Given the following resource hierarchy
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame]1463 # O1-&gt;{F1, F2}; F1-&gt;{P1}; F2-&gt;{P2, P3},
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1464 # `organizations/foo` has a `Policy` with values:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1465 # {allowed_values: &quot;under:organizations/O1&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1466 # `projects/bar` has a `Policy` with:
Bu Sun Kim65020912020-05-20 12:08:20 -0700[diff] [blame]1467 # {allowed_values: &quot;under:projects/P3&quot;}
1468 # {denied_values: &quot;under:folders/F2&quot;}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1469 # The accepted values at `organizations/foo` are `organizations/O1`,
1470 # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,
1471 # `projects/P3`.
1472 # The accepted values at `projects/bar` are `organizations/O1`,
1473 # `folders/F1`, `projects/P1`.
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700[diff] [blame]1474 },
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1475 }</pre>
1476</div>
1477
1478</body></html>