Blame - docs/dyn/cloudkms_v1.projects.locations.keyRings.html - platform/external/python/google-api-python-client

2017-03-13 12:12:03 -0400

[diff] [blame]

76

<h2>Instance Methods</h2>

77

78

<code><a href="cloudkms_v1.projects.locations.keyRings.cryptoKeys.html">cryptoKeys()</a></code>

79

</p>

80

<p class="firstline">Returns the cryptoKeys Resource.</p>

81

82

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

83

<code><a href="cloudkms_v1.projects.locations.keyRings.importJobs.html">importJobs()</a></code>

84

</p>

85

<p class="firstline">Returns the importJobs Resource.</p>

86

87

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

88

<code><a href="#create">create(parent, body=None, keyRingId=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

89

<p class="firstline">Create a new KeyRing in a given Project and Location.</p>

90

91

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

92

<p class="firstline">Returns metadata for a given KeyRing.</p>

93

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

94

<code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

95

<p class="firstline">Gets the access control policy for a resource.</p>

96

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

97

<code><a href="#list">list(parent, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None, filter=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

98

<p class="firstline">Lists KeyRings.</p>

99

100

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

101

<p class="firstline">Retrieves the next page of results.</p>

102

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

103

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

104

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

105

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

106

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

107

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

108

<h3>Method Details</h3>

109

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

110

<code class="details" id="create">create(parent, body=None, keyRingId=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

111

<pre>Create a new KeyRing in a given Project and Location.

112

113

Args:

114

parent: string, Required. The resource name of the location associated with the

115

KeyRings, in the format `projects/*/locations/*`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

116

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

117

The object takes the form of:

118

119

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

120

"createTime": "A String", # Output only. The time at which this KeyRing was created.

121

"name": "A String", # Output only. The resource name for the KeyRing in the format

122

# `projects/*/locations/*/keyRings/*`.

123

}

124

125

keyRingId: string, Required. It must be unique within a location and match the regular

126

expression `[a-zA-Z0-9_-]{1,63}`

127

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

134

135

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

136

"createTime": "A String", # Output only. The time at which this KeyRing was created.

137

"name": "A String", # Output only. The resource name for the KeyRing in the format

138

# `projects/*/locations/*/keyRings/*`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

144

<pre>Returns metadata for a given KeyRing.

145

146

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

147

name: string, Required. The name of the KeyRing to get. (required)

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

148

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

155

156

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

157

"createTime": "A String", # Output only. The time at which this KeyRing was created.

158

"name": "A String", # Output only. The resource name for the KeyRing in the format

159

# `projects/*/locations/*/keyRings/*`.

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

164

<code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

165

<pre>Gets the access control policy for a resource.

166

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

171

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

172

options_requestedPolicyVersion: integer, Optional. The policy format version to be returned.

173

174

Valid values are 0, 1, and 3. Requests specifying an invalid value will be

175

rejected.

176

177

Requests for policies with any conditional bindings must specify version 3.

178

Policies without any conditional bindings may specify any valid value or

179

leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

180

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

187

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

188

{ # An Identity and Access Management (IAM) policy, which specifies access

189

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

190

#

191

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

192

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

193

# `members` to a single `role`. Members can be user accounts, service accounts,

194

# Google groups, and domains (such as G Suite). A `role` is a named list of

195

# permissions; each `role` can be an IAM predefined role or a user-created

196

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

197

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

198

# Optionally, a `binding` can specify a `condition`, which is a logical

199

# expression that allows access to a resource only if the expression evaluates

200

# to `true`. A condition can add constraints based on attributes of the

201

# request, the resource, or both.

202

#

203

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

208

# "role": "roles/resourcemanager.organizationAdmin",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

209

# "members": [

210

# "user:mike@example.com",

211

# "group:admins@example.com",

212

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

213

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

214

# ]

215

# },

216

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

217

# "role": "roles/resourcemanager.organizationViewer",

218

# "members": ["user:eve@example.com"],

219

# "condition": {

220

# "title": "expirable access",

221

# "description": "Does not grant access after Sep 2020",

222

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

223

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

224

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

225

# ],

226

# "etag": "BwWWja0YfJA=",

227

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

228

# }

229

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

230

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

235

# - group:admins@example.com

236

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

237

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

238

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

239

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

240

# - user:eve@example.com

241

# role: roles/resourcemanager.organizationViewer

242

# condition:

243

# title: expirable access

244

# description: Does not grant access after Sep 2020

245

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

246

# - etag: BwWWja0YfJA=

247

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

248

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

249

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

250

# [IAM documentation](https://cloud.google.com/iam/docs/).

251

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

252

# `condition` that determines how and when the `bindings` are applied. Each

253

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

254

{ # Associates `members` with a `role`.

255

"role": "A String", # Role that is assigned to `members`.

256

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

257

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

258

# NOTE: An unsatisfied condition will not allow user access via current

259

# binding. Different bindings, including their conditions, are examined

260

# independently.

261

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

262

# are documented at https://github.com/google/cel-spec.

263

#

264

# Example (Comparison):

265

#

266

# title: "Summary size limit"

267

# description: "Determines if a summary is less than 100 chars"

268

# expression: "document.summary.size() < 100"

269

#

270

# Example (Equality):

271

#

272

# title: "Requestor is owner"

273

# description: "Determines if requestor is the document owner"

274

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

279

# description: "Determine whether the document should be publicly visible"

280

# expression: "document.type != 'private' && document.type != 'internal'"

281

#

282

# Example (Data Manipulation):

283

#

284

# title: "Notification string"

285

# description: "Create a notification string with a timestamp."

286

# expression: "'New message received at ' + string(document.create_time)"

287

#

288

# The exact variables and functions that may be referenced within an expression

289

# are determined by the service that evaluates it. See the service

290

# documentation for additional information.

291

"location": "A String", # Optional. String indicating the location of the expression for error

292

# reporting, e.g. a file name and a position in the file.

293

"expression": "A String", # Textual representation of an expression in Common Expression Language

294

# syntax.

295

"description": "A String", # Optional. Description of the expression. This is a longer text which

296

# describes the expression, e.g. when hovered over it in a UI.

297

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

298

# its purpose. This can be used e.g. in UIs which allow to enter the

299

# expression.

300

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

301

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

302

# `members` can have the following values:

303

#

304

# * `allUsers`: A special identifier that represents anyone who is

305

# on the internet; with or without a Google account.

306

#

307

# * `allAuthenticatedUsers`: A special identifier that represents anyone

308

# who is authenticated with a Google account or a service account.

309

#

310

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

311

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

312

#

313

#

314

# * `serviceAccount:{emailid}`: An email address that represents a service

315

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

316

#

317

# * `group:{emailid}`: An email address that represents a Google group.

318

# For example, `admins@example.com`.

319

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

320

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

321

# identifier) representing a user that has been recently deleted. For

322

# example, `alice@example.com?uid=123456789012345678901`. If the user is

323

# recovered, this value reverts to `user:{emailid}` and the recovered user

324

# retains the role in the binding.

325

#

326

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

327

# unique identifier) representing a service account that has been recently

328

# deleted. For example,

329

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

330

# If the service account is undeleted, this value reverts to

331

# `serviceAccount:{emailid}` and the undeleted service account retains the

332

# role in the binding.

333

#

334

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

335

# identifier) representing a Google group that has been recently

336

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

337

# the group is recovered, this value reverts to `group:{emailid}` and the

338

# recovered group retains the role in the binding.

339

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

340

#

341

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

342

# users of that domain. For example, `google.com` or `example.com`.

343

#

344

"A String",

345

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

346

},

347

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

348

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

349

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

350

# The configuration determines which permission types are logged, and what

351

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

352

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

353

#

354

# If there are AuditConfigs for both `allServices` and a specific service,

355

# the union of the two AuditConfigs is used for that service: the log_types

356

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

357

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

358

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

359

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

360

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

361

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

362

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

363

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

364

# "service": "allServices"

365

# "audit_log_configs": [

366

# {

367

# "log_type": "DATA_READ",

368

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

369

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

374

# },

375

# {

376

# "log_type": "ADMIN_READ",

377

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

378

# ]

379

# },

380

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

381

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

382

# "audit_log_configs": [

383

# {

384

# "log_type": "DATA_READ",

385

# },

386

# {

387

# "log_type": "DATA_WRITE",

388

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

389

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

390

# ]

391

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

396

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

397

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

398

# logging. It also exempts jose@example.com from DATA_READ logging, and

399

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

400

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

401

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

406

# {

407

# "log_type": "DATA_READ",

408

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

409

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

419

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

420

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

421

# permission.

422

# Follows the same format of Binding.members.

423

"A String",

424

],

425

"logType": "A String", # The log type that this config enables.

426

},

427

],

428

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

429

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

430

# `allServices` is a special value that covers all services.

431

},

432

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

433

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

434

# prevent simultaneous updates of a policy from overwriting each other.

435

# It is strongly suggested that systems make use of the `etag` in the

436

# read-modify-write cycle to perform policy updates in order to avoid race

437

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

438

# systems are expected to put that etag in the request to `setIamPolicy` to

439

# ensure that their change will be applied to the same version of the policy.

440

#

441

# **Important:** If you use IAM Conditions, you must include the `etag` field

442

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

443

# you to overwrite a version `3` policy with a version `1` policy, and all of

444

# the conditions in the version `3` policy are lost.

445

"version": 42, # Specifies the format of the policy.

446

#

447

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

448

# are rejected.

449

#

450

# Any operation that affects conditional role bindings must specify version

451

# `3`. This requirement applies to the following operations:

452

#

453

# * Getting a policy that includes a conditional role binding

454

# * Adding a conditional role binding to a policy

455

# * Changing a conditional role binding in a policy

456

# * Removing any role binding, with or without a condition, from a policy

457

# that includes conditions

458

#

459

# **Important:** If you use IAM Conditions, you must include the `etag` field

460

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

461

# you to overwrite a version `3` policy with a version `1` policy, and all of

462

# the conditions in the version `3` policy are lost.

463

#

464

# If a policy does not include any conditions, operations on that policy may

465

# specify any valid version or leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

470

<code class="details" id="list">list(parent, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None, filter=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

<pre>Lists KeyRings.

Args:

parent: string, Required. The resource name of the location associated with the

475

KeyRings, in the format `projects/*/locations/*`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

476

orderBy: string, Optional. Specify how the results should be sorted. If not specified, the

477

results will be sorted in the default order. For more information, see

478

[Sorting and filtering list

479

results](https://cloud.google.com/kms/docs/sorting-and-filtering).

480

pageSize: integer, Optional. Optional limit on the number of KeyRings to include in the

481

response. Further KeyRings can subsequently be obtained by

482

including the ListKeyRingsResponse.next_page_token in a subsequent

483

request. If unspecified, the server will pick an appropriate default.

484

pageToken: string, Optional. Optional pagination token, returned earlier via

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

485

ListKeyRingsResponse.next_page_token.

486

x__xgafv: string, V1 error format.

487

Allowed values

488

1 - v1 error format

489

2 - v2 error format

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

490

filter: string, Optional. Only include resources that match the filter in the response. For

491

more information, see

492

[Sorting and filtering list

493

results](https://cloud.google.com/kms/docs/sorting-and-filtering).

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

494

495

Returns:

496

An object of the form:

497

498

{ # Response message for KeyManagementService.ListKeyRings.

499

"nextPageToken": "A String", # A token to retrieve next page of results. Pass this value in

500

# ListKeyRingsRequest.page_token to retrieve the next page of results.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

501

"totalSize": 42, # The total number of KeyRings that matched the query.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

502

"keyRings": [ # The list of KeyRings.

503

{ # A KeyRing is a toplevel logical grouping of CryptoKeys.

504

"createTime": "A String", # Output only. The time at which this KeyRing was created.

505

"name": "A String", # Output only. The resource name for the KeyRing in the format

506

# `projects/*/locations/*/keyRings/*`.

},

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

514

<pre>Retrieves the next page of results.

515

516

Args:

517

previous_request: The request for the previous page. (required)

518

previous_response: The response from the request for the previous page. (required)

519

520

Returns:

521

A request object that you can call 'execute()' on to request the next

522

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

527

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

528

<pre>Sets the access control policy on the specified resource. Replaces any

529

existing policy.

530

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

531

Can return Public Errors: NOT_FOUND, INVALID_ARGUMENT and PERMISSION_DENIED

532

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

533

Args:

534

resource: string, REQUIRED: The resource for which the policy is being specified.

535

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

536

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

537

The object takes the form of:

538

539

{ # Request message for `SetIamPolicy` method.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

540

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

541

# the policy is limited to a few 10s of KB. An empty policy is a

542

# valid policy but certain Cloud Platform services (such as Projects)

543

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

544

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

545

#

546

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

547

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

548

# `members` to a single `role`. Members can be user accounts, service accounts,

549

# Google groups, and domains (such as G Suite). A `role` is a named list of

550

# permissions; each `role` can be an IAM predefined role or a user-created

551

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

552

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

553

# Optionally, a `binding` can specify a `condition`, which is a logical

554

# expression that allows access to a resource only if the expression evaluates

555

# to `true`. A condition can add constraints based on attributes of the

556

# request, the resource, or both.

557

#

558

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

563

# "role": "roles/resourcemanager.organizationAdmin",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

564

# "members": [

565

# "user:mike@example.com",

566

# "group:admins@example.com",

567

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

568

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

569

# ]

570

# },

571

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

572

# "role": "roles/resourcemanager.organizationViewer",

573

# "members": ["user:eve@example.com"],

574

# "condition": {

575

# "title": "expirable access",

576

# "description": "Does not grant access after Sep 2020",

577

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

578

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

579

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

580

# ],

581

# "etag": "BwWWja0YfJA=",

582

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

583

# }

584

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

585

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

590

# - group:admins@example.com

591

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

592

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

593

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

594

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

595

# - user:eve@example.com

596

# role: roles/resourcemanager.organizationViewer

597

# condition:

598

# title: expirable access

599

# description: Does not grant access after Sep 2020

600

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

601

# - etag: BwWWja0YfJA=

602

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

603

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

604

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

605

# [IAM documentation](https://cloud.google.com/iam/docs/).

606

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

607

# `condition` that determines how and when the `bindings` are applied. Each

608

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

609

{ # Associates `members` with a `role`.

610

"role": "A String", # Role that is assigned to `members`.

611

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

612

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

613

# NOTE: An unsatisfied condition will not allow user access via current

614

# binding. Different bindings, including their conditions, are examined

615

# independently.

616

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

617

# are documented at https://github.com/google/cel-spec.

618

#

619

# Example (Comparison):

620

#

621

# title: "Summary size limit"

622

# description: "Determines if a summary is less than 100 chars"

623

# expression: "document.summary.size() < 100"

624

#

625

# Example (Equality):

626

#

627

# title: "Requestor is owner"

628

# description: "Determines if requestor is the document owner"

629

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

634

# description: "Determine whether the document should be publicly visible"

635

# expression: "document.type != 'private' && document.type != 'internal'"

636

#

637

# Example (Data Manipulation):

638

#

639

# title: "Notification string"

640

# description: "Create a notification string with a timestamp."

641

# expression: "'New message received at ' + string(document.create_time)"

642

#

643

# The exact variables and functions that may be referenced within an expression

644

# are determined by the service that evaluates it. See the service

645

# documentation for additional information.

646

"location": "A String", # Optional. String indicating the location of the expression for error

647

# reporting, e.g. a file name and a position in the file.

648

"expression": "A String", # Textual representation of an expression in Common Expression Language

649

# syntax.

650

"description": "A String", # Optional. Description of the expression. This is a longer text which

651

# describes the expression, e.g. when hovered over it in a UI.

652

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

653

# its purpose. This can be used e.g. in UIs which allow to enter the

654

# expression.

655

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

656

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

657

# `members` can have the following values:

658

#

659

# * `allUsers`: A special identifier that represents anyone who is

660

# on the internet; with or without a Google account.

661

#

662

# * `allAuthenticatedUsers`: A special identifier that represents anyone

663

# who is authenticated with a Google account or a service account.

664

#

665

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

666

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

667

#

668

#

669

# * `serviceAccount:{emailid}`: An email address that represents a service

670

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

671

#

672

# * `group:{emailid}`: An email address that represents a Google group.

673

# For example, `admins@example.com`.

674

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

675

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

676

# identifier) representing a user that has been recently deleted. For

677

# example, `alice@example.com?uid=123456789012345678901`. If the user is

678

# recovered, this value reverts to `user:{emailid}` and the recovered user

679

# retains the role in the binding.

680

#

681

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

682

# unique identifier) representing a service account that has been recently

683

# deleted. For example,

684

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

685

# If the service account is undeleted, this value reverts to

686

# `serviceAccount:{emailid}` and the undeleted service account retains the

687

# role in the binding.

688

#

689

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

690

# identifier) representing a Google group that has been recently

691

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

692

# the group is recovered, this value reverts to `group:{emailid}` and the

693

# recovered group retains the role in the binding.

694

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

695

#

696

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

697

# users of that domain. For example, `google.com` or `example.com`.

698

#

699

"A String",

700

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

701

},

702

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

703

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

704

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

705

# The configuration determines which permission types are logged, and what

706

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

707

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

708

#

709

# If there are AuditConfigs for both `allServices` and a specific service,

710

# the union of the two AuditConfigs is used for that service: the log_types

711

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

712

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

713

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

714

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

715

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

716

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

717

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

718

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

719

# "service": "allServices"

720

# "audit_log_configs": [

721

# {

722

# "log_type": "DATA_READ",

723

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

724

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

729

# },

730

# {

731

# "log_type": "ADMIN_READ",

732

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

733

# ]

734

# },

735

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

736

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

737

# "audit_log_configs": [

738

# {

739

# "log_type": "DATA_READ",

740

# },

741

# {

742

# "log_type": "DATA_WRITE",

743

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

744

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

745

# ]

746

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

751

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

752

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

753

# logging. It also exempts jose@example.com from DATA_READ logging, and

754

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

755

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

756

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

761

# {

762

# "log_type": "DATA_READ",

763

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

764

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

774

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

775

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

776

# permission.

777

# Follows the same format of Binding.members.

778

"A String",

779

],

780

"logType": "A String", # The log type that this config enables.

781

},

782

],

783

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

784

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

785

# `allServices` is a special value that covers all services.

786

},

787

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

788

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

789

# prevent simultaneous updates of a policy from overwriting each other.

790

# It is strongly suggested that systems make use of the `etag` in the

791

# read-modify-write cycle to perform policy updates in order to avoid race

792

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

793

# systems are expected to put that etag in the request to `setIamPolicy` to

794

# ensure that their change will be applied to the same version of the policy.

795

#

796

# **Important:** If you use IAM Conditions, you must include the `etag` field

797

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

798

# you to overwrite a version `3` policy with a version `1` policy, and all of

799

# the conditions in the version `3` policy are lost.

800

"version": 42, # Specifies the format of the policy.

801

#

802

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

803

# are rejected.

804

#

805

# Any operation that affects conditional role bindings must specify version

806

# `3`. This requirement applies to the following operations:

807

#

808

# * Getting a policy that includes a conditional role binding

809

# * Adding a conditional role binding to a policy

810

# * Changing a conditional role binding in a policy

811

# * Removing any role binding, with or without a condition, from a policy

812

# that includes conditions

813

#

814

# **Important:** If you use IAM Conditions, you must include the `etag` field

815

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

816

# you to overwrite a version `3` policy with a version `1` policy, and all of

817

# the conditions in the version `3` policy are lost.

818

#

819

# If a policy does not include any conditions, operations on that policy may

820

# specify any valid version or leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

821

},

822

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

823

# the fields in the mask will be modified. If no mask is provided, the

824

# following default mask is used:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

825

# paths: "bindings, etag"

826

# This field is only used by Cloud IAM.

827

}

828

829

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

836

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

837

{ # An Identity and Access Management (IAM) policy, which specifies access

838

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

839

#

840

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

841

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

842

# `members` to a single `role`. Members can be user accounts, service accounts,

843

# Google groups, and domains (such as G Suite). A `role` is a named list of

844

# permissions; each `role` can be an IAM predefined role or a user-created

845

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

846

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

847

# Optionally, a `binding` can specify a `condition`, which is a logical

848

# expression that allows access to a resource only if the expression evaluates

849

# to `true`. A condition can add constraints based on attributes of the

850

# request, the resource, or both.

851

#

852

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

857

# "role": "roles/resourcemanager.organizationAdmin",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

858

# "members": [

859

# "user:mike@example.com",

860

# "group:admins@example.com",

861

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

862

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

863

# ]

864

# },

865

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

866

# "role": "roles/resourcemanager.organizationViewer",

867

# "members": ["user:eve@example.com"],

868

# "condition": {

869

# "title": "expirable access",

870

# "description": "Does not grant access after Sep 2020",

871

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

872

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

873

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

874

# ],

875

# "etag": "BwWWja0YfJA=",

876

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

877

# }

878

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

879

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

884

# - group:admins@example.com

885

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

886

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

887

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

888

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

889

# - user:eve@example.com

890

# role: roles/resourcemanager.organizationViewer

891

# condition:

892

# title: expirable access

893

# description: Does not grant access after Sep 2020

894

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

895

# - etag: BwWWja0YfJA=

896

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

897

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

898

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

899

# [IAM documentation](https://cloud.google.com/iam/docs/).

900

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

901

# `condition` that determines how and when the `bindings` are applied. Each

902

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

903

{ # Associates `members` with a `role`.

904

"role": "A String", # Role that is assigned to `members`.

905

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

906

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

907

# NOTE: An unsatisfied condition will not allow user access via current

908

# binding. Different bindings, including their conditions, are examined

909

# independently.

910

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

911

# are documented at https://github.com/google/cel-spec.

912

#

913

# Example (Comparison):

914

#

915

# title: "Summary size limit"

916

# description: "Determines if a summary is less than 100 chars"

917

# expression: "document.summary.size() < 100"

918

#

919

# Example (Equality):

920

#

921

# title: "Requestor is owner"

922

# description: "Determines if requestor is the document owner"

923

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

928

# description: "Determine whether the document should be publicly visible"

929

# expression: "document.type != 'private' && document.type != 'internal'"

930

#

931

# Example (Data Manipulation):

932

#

933

# title: "Notification string"

934

# description: "Create a notification string with a timestamp."

935

# expression: "'New message received at ' + string(document.create_time)"

936

#

937

# The exact variables and functions that may be referenced within an expression

938

# are determined by the service that evaluates it. See the service

939

# documentation for additional information.

940

"location": "A String", # Optional. String indicating the location of the expression for error

941

# reporting, e.g. a file name and a position in the file.

942

"expression": "A String", # Textual representation of an expression in Common Expression Language

943

# syntax.

944

"description": "A String", # Optional. Description of the expression. This is a longer text which

945

# describes the expression, e.g. when hovered over it in a UI.

946

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

947

# its purpose. This can be used e.g. in UIs which allow to enter the

948

# expression.

949

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

950

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

951

# `members` can have the following values:

952

#

953

# * `allUsers`: A special identifier that represents anyone who is

954

# on the internet; with or without a Google account.

955

#

956

# * `allAuthenticatedUsers`: A special identifier that represents anyone

957

# who is authenticated with a Google account or a service account.

958

#

959

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

960

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

961

#

962

#

963

# * `serviceAccount:{emailid}`: An email address that represents a service

964

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

965

#

966

# * `group:{emailid}`: An email address that represents a Google group.

967

# For example, `admins@example.com`.

968

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

969

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

970

# identifier) representing a user that has been recently deleted. For

971

# example, `alice@example.com?uid=123456789012345678901`. If the user is

972

# recovered, this value reverts to `user:{emailid}` and the recovered user

973

# retains the role in the binding.

974

#

975

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

976

# unique identifier) representing a service account that has been recently

977

# deleted. For example,

978

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

979

# If the service account is undeleted, this value reverts to

980

# `serviceAccount:{emailid}` and the undeleted service account retains the

981

# role in the binding.

982

#

983

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

984

# identifier) representing a Google group that has been recently

985

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

986

# the group is recovered, this value reverts to `group:{emailid}` and the

987

# recovered group retains the role in the binding.

988

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

989

#

990

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

991

# users of that domain. For example, `google.com` or `example.com`.

992

#

993

"A String",

994

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

995

},

996

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

997

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

998

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

999

# The configuration determines which permission types are logged, and what

1000

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1001

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1002

#

1003

# If there are AuditConfigs for both `allServices` and a specific service,

1004

# the union of the two AuditConfigs is used for that service: the log_types

1005

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1006

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1007

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1008

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1009

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1010

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1011

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1012

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1013

# "service": "allServices"

1014

# "audit_log_configs": [

1015

# {

1016

# "log_type": "DATA_READ",

1017

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1018

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

1023

# },

1024

# {

1025

# "log_type": "ADMIN_READ",

1026

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1027

# ]

1028

# },

1029

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1030

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1031

# "audit_log_configs": [

1032

# {

1033

# "log_type": "DATA_READ",

1034

# },

1035

# {

1036

# "log_type": "DATA_WRITE",

1037

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1038

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1039

# ]

1040

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1045

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1046

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1047

# logging. It also exempts jose@example.com from DATA_READ logging, and

1048

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1049

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1050

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1055

# {

1056

# "log_type": "DATA_READ",

1057

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1058

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1068

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1069

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1070

# permission.

1071

# Follows the same format of Binding.members.

1072

"A String",

1073

],

1074

"logType": "A String", # The log type that this config enables.

1075

},

1076

],

1077

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1078

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1079

# `allServices` is a special value that covers all services.

1080

},

1081

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1082

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1083

# prevent simultaneous updates of a policy from overwriting each other.

1084

# It is strongly suggested that systems make use of the `etag` in the

1085

# read-modify-write cycle to perform policy updates in order to avoid race

1086

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1087

# systems are expected to put that etag in the request to `setIamPolicy` to

1088

# ensure that their change will be applied to the same version of the policy.

1089

#

1090

# **Important:** If you use IAM Conditions, you must include the `etag` field

1091

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1092

# you to overwrite a version `3` policy with a version `1` policy, and all of

1093

# the conditions in the version `3` policy are lost.

1094

"version": 42, # Specifies the format of the policy.

1095

#

1096

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1097

# are rejected.

1098

#

1099

# Any operation that affects conditional role bindings must specify version

1100

# `3`. This requirement applies to the following operations:

1101

#

1102

# * Getting a policy that includes a conditional role binding

1103

# * Adding a conditional role binding to a policy

1104

# * Changing a conditional role binding in a policy

1105

# * Removing any role binding, with or without a condition, from a policy

1106

# that includes conditions

1107

#

1108

# **Important:** If you use IAM Conditions, you must include the `etag` field

1109

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1110

# you to overwrite a version `3` policy with a version `1` policy, and all of

1111

# the conditions in the version `3` policy are lost.

1112

#

1113

# If a policy does not include any conditions, operations on that policy may

1114

# specify any valid version or leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1119

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1120

<pre>Returns permissions that a caller has on the specified resource.

1121

If the resource does not exist, this will return an empty set of

1122

permissions, not a NOT_FOUND error.

1123

1124

Note: This operation is designed to be used for building permission-aware

1125

UIs and command-line tools, not for authorization checking. This operation

1126

may "fail open" without warning.

1127

1128

Args:

1129

resource: string, REQUIRED: The resource for which the policy detail is being requested.

1130

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1131

body: object, The request body.

Sai Cheemalapati