Blame - docs/dyn/cloudresourcemanager_v1.projects.html - platform/external/python/google-api-python-client

2017-01-06 09:58:29 -0800

[diff] [blame]

275

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

276

# You can find out more about this error model and how to work with it in the

277

# [API Design Guide](https://cloud.google.com/apis/design/errors).

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

278

"message": "A String", # A developer-facing error message, which should be in English. Any

279

# user-facing error message should be localized and sent in the

280

# google.rpc.Status.details field, or localized by the client.

Sai Cheemalapati

ea3a5e1

2016-10-12 14:05:53 -0700

[diff] [blame]

281

"code": 42, # The status code, which should be an enum value of google.rpc.Code.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

282

"details": [ # A list of messages that carry the error details. There is a common set of

283

# message types for APIs to use.

Sai Cheemalapati

ea3a5e1

2016-10-12 14:05:53 -0700

[diff] [blame]

284

{

285

"a_key": "", # Properties of the object. Contains field @type with type URL.

286

},

287

],

288

},

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

289

"done": True or False, # If the value is `false`, it means the operation is still in progress.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

290

# If `true`, the operation is completed, and either `error` or `response` is

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

291

# available.

292

"response": { # The normal response of the operation in case of success. If the original

293

# method returns no data on success, such as `Delete`, the response is

294

# `google.protobuf.Empty`. If the original method is standard

295

# `Get`/`Create`/`Update`, the response should be the resource. For other

296

# methods, the response should have the type `XxxResponse`, where `Xxx`

297

# is the original method name. For example, if the original method name

298

# is `TakeSnapshot()`, the inferred response type is

299

# `TakeSnapshotResponse`.

300

"a_key": "", # Properties of the object. Contains field @type with type URL.

301

},

302

"name": "A String", # The server-assigned name, which is only unique within the same service that

303

# originally returns it. If you use the default HTTP mapping, the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

304

# `name` should be a resource name ending with `operations/{unique_id}`.

Sai Cheemalapati

ea3a5e1

2016-10-12 14:05:53 -0700

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

309

<code class="details" id="delete">delete(projectId, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

310

<pre>Marks the Project identified by the specified

311

`project_id` (for example, `my-project-123`) for deletion.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

312

This method will only affect the Project if it has a lifecycle state of

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

313

ACTIVE.

314

315

This method changes the Project's lifecycle state from

316

ACTIVE

317

to DELETE_REQUESTED.

318

The deletion starts at an unspecified time,

319

at which point the Project is no longer accessible.

320

321

Until the deletion completes, you can check the lifecycle state

322

checked by retrieving the Project with GetProject,

323

and the Project remains visible to ListProjects.

324

However, you cannot update the project.

325

326

After the deletion completes, the Project is not retrievable by

327

the GetProject and

328

ListProjects methods.

329

330

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

331

332

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

333

projectId: string, The Project ID (for example, `foo-bar-123`).

334

335

Required. (required)

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

336

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

337

Allowed values

338

1 - v1 error format

339

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

340

341

Returns:

342

An object of the form:

343

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

344

{ # A generic empty message that you can re-use to avoid defining duplicated

345

# empty messages in your APIs. A typical example is to use it as the request

346

# or the response type of an API method. For instance:

347

#

348

# service Foo {

349

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

350

# }

351

#

352

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

357

<code class="details" id="get">get(projectId, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

358

<pre>Retrieves the Project identified by the specified

359

`project_id` (for example, `my-project-123`).

360

361

The caller must have read permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

362

363

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

364

projectId: string, The Project ID (for example, `my-project-123`).

365

366

Required. (required)

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

367

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

368

Allowed values

369

1 - v1 error format

370

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

371

372

Returns:

373

An object of the form:

374

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

375

{ # A Project is a high-level Google Cloud Platform entity. It is a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

376

# container for ACLs, APIs, App Engine Apps, VMs, and other

377

# Google Cloud Platform resources.

378

"name": "A String", # The optional user-assigned display name of the Project.

379

# When present it must be between 4 to 30 characters.

380

# Allowed characters are: lowercase and uppercase letters, numbers,

381

# hyphen, single-quote, double-quote, space, and exclamation point.

382

#

383

# Example: <code>My Project</code>

384

# Read-write.

385

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

386

#

387

# Supported parent types include "organization" and "folder". Once set, the

388

# parent cannot be cleared. The `parent` can be set on creation or using the

389

# `UpdateProject` method; the end user must have the

390

# `resourcemanager.projects.create` permission on the parent.

391

#

392

# Read-write.

393

# Cloud Platform is a generic term for something you (a developer) may want to

394

# interact with through one of our API's. Some examples are an App Engine app,

395

# a Compute Engine instance, a Cloud SQL database, and so on.

396

"type": "A String", # Required field representing the resource type this id is for.

397

# At present, the valid types are: "organization", "folder", and "project".

398

"id": "A String", # Required field for the type-specific id. This should correspond to the id

399

# used in the type-specific API's.

400

},

401

"projectId": "A String", # The unique, user-assigned ID of the Project.

402

# It must be 6 to 30 lowercase letters, digits, or hyphens.

403

# It must start with a letter.

404

# Trailing hyphens are prohibited.

405

#

406

# Example: <code>tokyo-rain-123</code>

407

# Read-only after creation.

408

"labels": { # The labels associated with this Project.

409

#

410

# Label keys must be between 1 and 63 characters long and must conform

411

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

412

#

413

# Label values must be between 0 and 63 characters long and must conform

414

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

415

# value can be empty.

416

#

417

# No more than 256 labels can be associated with a given resource.

418

#

419

# Clients should store labels in a representation such as JSON that does not

420

# depend on specific characters being disallowed.

421

#

422

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"projectNumber": "A String", # The number uniquely identifying the project.

427

#

428

# Example: <code>415104041262</code>

429

# Read-only.

430

"lifecycleState": "A String", # The Project lifecycle state.

431

#

432

# Read-only.

433

"createTime": "A String", # Creation time.

434

#

435

# Read-only.

436

}</pre>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

440

<code class="details" id="getAncestry">getAncestry(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

441

<pre>Gets a list of ancestors in the resource hierarchy for the Project

442

identified by the specified `project_id` (for example, `my-project-123`).

443

444

The caller must have read permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

445

446

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

447

projectId: string, The Project ID (for example, `my-project-123`).

448

449

Required. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

450

body: object, The request body.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

451

The object takes the form of:

452

453

{ # The request sent to the

# GetAncestry

# method.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

465

466

{ # Response from the GetAncestry method.

467

"ancestor": [ # Ancestors are ordered from bottom to top of the resource hierarchy. The

468

# first ancestor is the project itself, followed by the project's parent,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

469

# etc..

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

470

{ # Identifying information for a single ancestor of a project.

471

"resourceId": { # A container to reference an id for any resource type. A `resource` in Google # Resource id of the ancestor.

472

# Cloud Platform is a generic term for something you (a developer) may want to

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

473

# interact with through one of our API's. Some examples are an App Engine app,

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

474

# a Compute Engine instance, a Cloud SQL database, and so on.

475

"type": "A String", # Required field representing the resource type this id is for.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

476

# At present, the valid types are: "organization", "folder", and "project".

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

477

"id": "A String", # Required field for the type-specific id. This should correspond to the id

478

# used in the type-specific API's.

},

},

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

486

<code class="details" id="getEffectiveOrgPolicy">getEffectiveOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

487

<pre>Gets the effective `Policy` on a resource. This is the result of merging

488

`Policies` in the resource hierarchy. The returned `Policy` will not have

489

an `etag`set because it is a computed `Policy` across multiple resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

490

Subtrees of Resource Manager resource hierarchy with 'under:' prefix will

491

not be expanded.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

492

493

Args:

494

resource: string, The name of the resource to start computing the effective `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

495

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

496

The object takes the form of:

497

498

{ # The request sent to the GetEffectiveOrgPolicy method.

499

"constraint": "A String", # The name of the `Constraint` to compute the effective `Policy`.

500

}

501

502

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

509

510

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

511

# for configurations of Cloud Platform resources.

512

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

513

# server, not specified by the caller, and represents the last time a call to

514

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

515

# be ignored.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

516

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

517

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

518

# `constraints/serviceuser.services`.

519

#

520

# Immutable after creation.

521

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

522

# `Constraint` type.

523

# `constraint_default` enforcement behavior of the specific `Constraint` at

524

# this resource.

525

#

526

# Suppose that `constraint_default` is set to `ALLOW` for the

527

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

528

# foo.com sets a `Policy` at their Organization resource node that restricts

529

# the allowed service activations to deny all service activations. They

530

# could then set a `Policy` with the `policy_type` `restore_default` on

531

# several experimental projects, restoring the `constraint_default`

532

# enforcement of the `Constraint` for only those projects, allowing those

533

# projects to have all services activated.

534

},

535

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

536

# resource.

537

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

538

# `ListPolicy` can define specific values and subtrees of Cloud Resource

539

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

540

# are allowed or denied by setting the `allowed_values` and `denied_values`

541

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

542

# The `under:` prefix is used to denote resource subtree values.

543

# The `is:` prefix is used to denote specific values, and is required only

544

# if the value contains a ":". Values prefixed with "is:" are treated the

545

# same as values with no prefix.

546

# Ancestry subtrees must be in one of the following formats:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

547

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

548

# - "folders/<folder-id>", e.g. "folders/1234"

549

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

550

# The `supports_under` field of the associated `Constraint` defines whether

551

# ancestry prefixes can be used. You can set `allowed_values` and

552

# `denied_values` in the same `Policy` if `all_values` is

553

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

554

# values. If `all_values` is set to either `ALLOW` or `DENY`,

555

# `allowed_values` and `denied_values` must be unset.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

556

"allValues": "A String", # The policy all_values state.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

557

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

558

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

559

"A String",

560

],

561

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

562

#

563

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

564

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

565

# set to `true`, then the values from the effective `Policy` of the parent

566

# resource are inherited, meaning the values set in this `Policy` are

567

# added to the values inherited up the hierarchy.

568

#

569

# Setting `Policy` hierarchies that inherit both allowed values and denied

570

# values isn't recommended in most circumstances to keep the configuration

571

# simple and understandable. However, it is possible to set a `Policy` with

572

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

573

# In this case, the values that are allowed must be in `allowed_values` and

574

# not present in `denied_values`.

575

#

576

# For example, suppose you have a `Constraint`

577

# `constraints/serviceuser.services`, which has a `constraint_type` of

578

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

579

# Suppose that at the Organization level, a `Policy` is applied that

580

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

581

# `Policy` is applied to a project below the Organization that has

582

# `inherit_from_parent` set to `false` and field all_values set to DENY,

583

# then an attempt to activate any API will be denied.

584

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

585

# The following examples demonstrate different possible layerings for

586

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

587

#

588

# Example 1 (no inherited values):

589

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

590

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

591

# `projects/bar` has `inherit_from_parent` `false` and values:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

592

# {allowed_values: "E3" allowed_values: "E4"}

593

# The accepted values at `organizations/foo` are `E1`, `E2`.

594

# The accepted values at `projects/bar` are `E3`, and `E4`.

595

#

596

# Example 2 (inherited values):

597

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

598

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

599

# `projects/bar` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

600

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

601

# The accepted values at `organizations/foo` are `E1`, `E2`.

602

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

603

#

604

# Example 3 (inheriting both allowed and denied values):

605

# `organizations/foo` has a `Policy` with values:

606

# {allowed_values: "E1" allowed_values: "E2"}

607

# `projects/bar` has a `Policy` with:

608

# {denied_values: "E1"}

609

# The accepted values at `organizations/foo` are `E1`, `E2`.

610

# The value accepted at `projects/bar` is `E2`.

611

#

612

# Example 4 (RestoreDefault):

613

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

614

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

615

# `projects/bar` has a `Policy` with values:

616

# {RestoreDefault: {}}

617

# The accepted values at `organizations/foo` are `E1`, `E2`.

618

# The accepted values at `projects/bar` are either all or none depending on

619

# the value of `constraint_default` (if `ALLOW`, all; if

620

# `DENY`, none).

621

#

622

# Example 5 (no policy inherits parent policy):

623

# `organizations/foo` has no `Policy` set.

624

# `projects/bar` has no `Policy` set.

625

# The accepted values at both levels are either all or none depending on

626

# the value of `constraint_default` (if `ALLOW`, all; if

627

# `DENY`, none).

628

#

629

# Example 6 (ListConstraint allowing all):

630

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

631

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

632

# `projects/bar` has a `Policy` with:

633

# {all: ALLOW}

634

# The accepted values at `organizations/foo` are `E1`, E2`.

635

# Any value is accepted at `projects/bar`.

636

#

637

# Example 7 (ListConstraint allowing none):

638

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

639

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

640

# `projects/bar` has a `Policy` with:

641

# {all: DENY}

642

# The accepted values at `organizations/foo` are `E1`, E2`.

643

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

644

#

645

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

646

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

647

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

648

# `organizations/foo` has a `Policy` with values:

649

# {allowed_values: "under:organizations/O1"}

650

# `projects/bar` has a `Policy` with:

651

# {allowed_values: "under:projects/P3"}

652

# {denied_values: "under:folders/F2"}

653

# The accepted values at `organizations/foo` are `organizations/O1`,

654

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

655

# `projects/P3`.

656

# The accepted values at `projects/bar` are `organizations/O1`,

657

# `folders/F1`, `projects/P1`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

658

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

659

# that matches the value specified in this `Policy`. If `suggested_value`

660

# is not set, it will inherit the value specified higher in the hierarchy,

661

# unless `inherit_from_parent` is `false`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

662

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

663

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

664

"A String",

665

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

666

},

667

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

668

# resource.

669

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

670

# configuration is acceptable.

671

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

672

# Suppose you have a `Constraint`

673

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

674

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

675

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

676

# - If the `Policy` at this resource has enforced set to `false`, serial

677

# port connection attempts will be allowed.

678

# - If the `Policy` at this resource has enforced set to `true`, serial

679

# port connection attempts will be refused.

680

# - If the `Policy` at this resource is `RestoreDefault`, serial port

681

# connection attempts will be allowed.

682

# - If no `Policy` is set at this resource or anywhere higher in the

683

# resource hierarchy, serial port connection attempts will be allowed.

684

# - If no `Policy` is set at this resource, but one exists higher in the

685

# resource hierarchy, the behavior is as if the`Policy` were set at

686

# this resource.

687

#

688

# The following examples demonstrate the different possible layerings:

689

#

690

# Example 1 (nearest `Constraint` wins):

691

# `organizations/foo` has a `Policy` with:

692

# {enforced: false}

693

# `projects/bar` has no `Policy` set.

694

# The constraint at `projects/bar` and `organizations/foo` will not be

695

# enforced.

696

#

697

# Example 2 (enforcement gets replaced):

698

# `organizations/foo` has a `Policy` with:

699

# {enforced: false}

700

# `projects/bar` has a `Policy` with:

701

# {enforced: true}

702

# The constraint at `organizations/foo` is not enforced.

703

# The constraint at `projects/bar` is enforced.

704

#

705

# Example 3 (RestoreDefault):

706

# `organizations/foo` has a `Policy` with:

707

# {enforced: true}

708

# `projects/bar` has a `Policy` with:

709

# {RestoreDefault: {}}

710

# The constraint at `organizations/foo` is enforced.

711

# The constraint at `projects/bar` is not enforced, because

712

# `constraint_default` for the `Constraint` is `ALLOW`.

713

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

714

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

715

# concurrency control.

716

#

717

# When the `Policy` is returned from either a `GetPolicy` or a

718

# `ListOrgPolicy` request, this `etag` indicates the version of the current

719

# `Policy` to use when executing a read-modify-write loop.

720

#

721

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

722

# `etag` will be unset.

723

#

724

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

725

# that was returned from a `GetOrgPolicy` request as part of a

726

# read-modify-write loop for concurrency control. Not setting the `etag`in a

727

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

733

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

734

<pre>Returns the IAM access control policy for the specified Project.

735

Permission is denied if the policy or the resource does not exist.

736

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

737

Authorization requires the Google IAM permission

738

`resourcemanager.projects.getIamPolicy` on the project.

739

740

For additional information about resource structure and identification,

741

see [Resource Names](/apis/design/resource_names).

742

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

743

Args:

744

resource: string, REQUIRED: The resource for which the policy is being requested.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

745

See the operation documentation for the appropriate value for this field. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

746

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

747

The object takes the form of:

748

749

{ # Request message for `GetIamPolicy` method.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

750

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

751

# `GetIamPolicy`.

752

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

753

#

754

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

755

# rejected.

756

#

757

# Requests for policies with any conditional bindings must specify version 3.

758

# Policies without any conditional bindings may specify any valid value or

759

# leave the field unset.

760

},

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

761

}

762

763

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

764

Allowed values

765

1 - v1 error format

766

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

767

768

Returns:

769

An object of the form:

770

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

771

{ # An Identity and Access Management (IAM) policy, which specifies access

772

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

773

#

774

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

775

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

776

# `members` to a single `role`. Members can be user accounts, service accounts,

777

# Google groups, and domains (such as G Suite). A `role` is a named list of

778

# permissions; each `role` can be an IAM predefined role or a user-created

779

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

780

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

781

# Optionally, a `binding` can specify a `condition`, which is a logical

782

# expression that allows access to a resource only if the expression evaluates

783

# to `true`. A condition can add constraints based on attributes of the

784

# request, the resource, or both.

785

#

786

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

791

# "role": "roles/resourcemanager.organizationAdmin",

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

792

# "members": [

793

# "user:mike@example.com",

794

# "group:admins@example.com",

795

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

796

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

797

# ]

798

# },

799

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

800

# "role": "roles/resourcemanager.organizationViewer",

801

# "members": ["user:eve@example.com"],

802

# "condition": {

803

# "title": "expirable access",

804

# "description": "Does not grant access after Sep 2020",

805

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

806

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

807

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

808

# ],

809

# "etag": "BwWWja0YfJA=",

810

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

811

# }

812

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

813

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

818

# - group:admins@example.com

819

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

820

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

821

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

822

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

823

# - user:eve@example.com

824

# role: roles/resourcemanager.organizationViewer

825

# condition:

826

# title: expirable access

827

# description: Does not grant access after Sep 2020

828

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

829

# - etag: BwWWja0YfJA=

830

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

831

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

832

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

833

# [IAM documentation](https://cloud.google.com/iam/docs/).

834

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

835

# `condition` that determines how and when the `bindings` are applied. Each

836

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

837

{ # Associates `members` with a `role`.

838

"role": "A String", # Role that is assigned to `members`.

839

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

840

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

841

# `members` can have the following values:

842

#

843

# * `allUsers`: A special identifier that represents anyone who is

844

# on the internet; with or without a Google account.

845

#

846

# * `allAuthenticatedUsers`: A special identifier that represents anyone

847

# who is authenticated with a Google account or a service account.

848

#

849

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

850

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

851

#

852

#

853

# * `serviceAccount:{emailid}`: An email address that represents a service

854

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

855

#

856

# * `group:{emailid}`: An email address that represents a Google group.

857

# For example, `admins@example.com`.

858

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

859

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

860

# identifier) representing a user that has been recently deleted. For

861

# example, `alice@example.com?uid=123456789012345678901`. If the user is

862

# recovered, this value reverts to `user:{emailid}` and the recovered user

863

# retains the role in the binding.

864

#

865

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

866

# unique identifier) representing a service account that has been recently

867

# deleted. For example,

868

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

869

# If the service account is undeleted, this value reverts to

870

# `serviceAccount:{emailid}` and the undeleted service account retains the

871

# role in the binding.

872

#

873

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

874

# identifier) representing a Google group that has been recently

875

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

876

# the group is recovered, this value reverts to `group:{emailid}` and the

877

# recovered group retains the role in the binding.

878

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

879

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

880

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

881

# users of that domain. For example, `google.com` or `example.com`.

882

#

883

"A String",

884

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

885

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

886

# NOTE: An unsatisfied condition will not allow user access via current

887

# binding. Different bindings, including their conditions, are examined

888

# independently.

889

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

890

# are documented at https://github.com/google/cel-spec.

891

#

892

# Example (Comparison):

893

#

894

# title: "Summary size limit"

895

# description: "Determines if a summary is less than 100 chars"

896

# expression: "document.summary.size() < 100"

897

#

898

# Example (Equality):

899

#

900

# title: "Requestor is owner"

901

# description: "Determines if requestor is the document owner"

902

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

907

# description: "Determine whether the document should be publicly visible"

908

# expression: "document.type != 'private' && document.type != 'internal'"

909

#

910

# Example (Data Manipulation):

911

#

912

# title: "Notification string"

913

# description: "Create a notification string with a timestamp."

914

# expression: "'New message received at ' + string(document.create_time)"

915

#

916

# The exact variables and functions that may be referenced within an expression

917

# are determined by the service that evaluates it. See the service

918

# documentation for additional information.

919

"description": "A String", # Optional. Description of the expression. This is a longer text which

920

# describes the expression, e.g. when hovered over it in a UI.

921

"expression": "A String", # Textual representation of an expression in Common Expression Language

922

# syntax.

923

"location": "A String", # Optional. String indicating the location of the expression for error

924

# reporting, e.g. a file name and a position in the file.

925

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

926

# its purpose. This can be used e.g. in UIs which allow to enter the

927

# expression.

928

},

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

929

},

930

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

931

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

932

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

933

# The configuration determines which permission types are logged, and what

934

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

935

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

936

#

937

# If there are AuditConfigs for both `allServices` and a specific service,

938

# the union of the two AuditConfigs is used for that service: the log_types

939

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

940

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

941

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

942

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

943

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

944

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

945

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

946

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

947

# "service": "allServices"

948

# "audit_log_configs": [

949

# {

950

# "log_type": "DATA_READ",

951

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

952

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

957

# },

958

# {

959

# "log_type": "ADMIN_READ",

960

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

961

# ]

962

# },

963

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

964

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

965

# "audit_log_configs": [

966

# {

967

# "log_type": "DATA_READ",

968

# },

969

# {

970

# "log_type": "DATA_WRITE",

971

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

972

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

973

# ]

974

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

979

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

980

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

981

# logging. It also exempts jose@example.com from DATA_READ logging, and

982

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

983

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

984

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

989

# {

990

# "log_type": "DATA_READ",

991

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

992

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1002

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1003

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1004

# permission.

1005

# Follows the same format of Binding.members.

1006

"A String",

1007

],

1008

"logType": "A String", # The log type that this config enables.

1009

},

1010

],

1011

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1012

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1013

# `allServices` is a special value that covers all services.

1014

},

1015

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1016

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1017

# prevent simultaneous updates of a policy from overwriting each other.

1018

# It is strongly suggested that systems make use of the `etag` in the

1019

# read-modify-write cycle to perform policy updates in order to avoid race

1020

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1021

# systems are expected to put that etag in the request to `setIamPolicy` to

1022

# ensure that their change will be applied to the same version of the policy.

1023

#

1024

# **Important:** If you use IAM Conditions, you must include the `etag` field

1025

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1026

# you to overwrite a version `3` policy with a version `1` policy, and all of

1027

# the conditions in the version `3` policy are lost.

1028

"version": 42, # Specifies the format of the policy.

1029

#

1030

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1031

# are rejected.

1032

#

1033

# Any operation that affects conditional role bindings must specify version

1034

# `3`. This requirement applies to the following operations:

1035

#

1036

# * Getting a policy that includes a conditional role binding

1037

# * Adding a conditional role binding to a policy

1038

# * Changing a conditional role binding in a policy

1039

# * Removing any role binding, with or without a condition, from a policy

1040

# that includes conditions

1041

#

1042

# **Important:** If you use IAM Conditions, you must include the `etag` field

1043

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1044

# you to overwrite a version `3` policy with a version `1` policy, and all of

1045

# the conditions in the version `3` policy are lost.

1046

#

1047

# If a policy does not include any conditions, operations on that policy may

1048

# specify any valid version or leave the field unset.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1053

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1054

<pre>Gets a `Policy` on a resource.

1055

1056

If no `Policy` is set on the resource, a `Policy` is returned with default

1057

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

1058

`etag` value can be used with `SetOrgPolicy()` to create or update a

1059

`Policy` during read-modify-write.

1060

1061

Args:

1062

resource: string, Name of the resource the `Policy` is set on. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1063

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1064

The object takes the form of:

1065

1066

{ # The request sent to the GetOrgPolicy method.

1067

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

1068

}

1069

1070

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1077

1078

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1079

# for configurations of Cloud Platform resources.

1080

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1081

# server, not specified by the caller, and represents the last time a call to

1082

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1083

# be ignored.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1084

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1085

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1086

# `constraints/serviceuser.services`.

1087

#

1088

# Immutable after creation.

1089

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1090

# `Constraint` type.

1091

# `constraint_default` enforcement behavior of the specific `Constraint` at

1092

# this resource.

1093

#

1094

# Suppose that `constraint_default` is set to `ALLOW` for the

1095

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1096

# foo.com sets a `Policy` at their Organization resource node that restricts

1097

# the allowed service activations to deny all service activations. They

1098

# could then set a `Policy` with the `policy_type` `restore_default` on

1099

# several experimental projects, restoring the `constraint_default`

1100

# enforcement of the `Constraint` for only those projects, allowing those

1101

# projects to have all services activated.

1102

},

1103

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1104

# resource.

1105

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1106

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1107

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1108

# are allowed or denied by setting the `allowed_values` and `denied_values`

1109

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1110

# The `under:` prefix is used to denote resource subtree values.

1111

# The `is:` prefix is used to denote specific values, and is required only

1112

# if the value contains a ":". Values prefixed with "is:" are treated the

1113

# same as values with no prefix.

1114

# Ancestry subtrees must be in one of the following formats:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1115

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1116

# - "folders/<folder-id>", e.g. "folders/1234"

1117

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1118

# The `supports_under` field of the associated `Constraint` defines whether

1119

# ancestry prefixes can be used. You can set `allowed_values` and

1120

# `denied_values` in the same `Policy` if `all_values` is

1121

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1122

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1123

# `allowed_values` and `denied_values` must be unset.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1124

"allValues": "A String", # The policy all_values state.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1125

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1126

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1127

"A String",

1128

],

1129

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1130

#

1131

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1132

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1133

# set to `true`, then the values from the effective `Policy` of the parent

1134

# resource are inherited, meaning the values set in this `Policy` are

1135

# added to the values inherited up the hierarchy.

1136

#

1137

# Setting `Policy` hierarchies that inherit both allowed values and denied

1138

# values isn't recommended in most circumstances to keep the configuration

1139

# simple and understandable. However, it is possible to set a `Policy` with

1140

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1141

# In this case, the values that are allowed must be in `allowed_values` and

1142

# not present in `denied_values`.

1143

#

1144

# For example, suppose you have a `Constraint`

1145

# `constraints/serviceuser.services`, which has a `constraint_type` of

1146

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1147

# Suppose that at the Organization level, a `Policy` is applied that

1148

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1149

# `Policy` is applied to a project below the Organization that has

1150

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1151

# then an attempt to activate any API will be denied.

1152

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1153

# The following examples demonstrate different possible layerings for

1154

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1155

#

1156

# Example 1 (no inherited values):

1157

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1158

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1159

# `projects/bar` has `inherit_from_parent` `false` and values:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1160

# {allowed_values: "E3" allowed_values: "E4"}

1161

# The accepted values at `organizations/foo` are `E1`, `E2`.

1162

# The accepted values at `projects/bar` are `E3`, and `E4`.

1163

#

1164

# Example 2 (inherited values):

1165

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1166

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1167

# `projects/bar` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1168

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1169

# The accepted values at `organizations/foo` are `E1`, `E2`.

1170

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1171

#

1172

# Example 3 (inheriting both allowed and denied values):

1173

# `organizations/foo` has a `Policy` with values:

1174

# {allowed_values: "E1" allowed_values: "E2"}

1175

# `projects/bar` has a `Policy` with:

1176

# {denied_values: "E1"}

1177

# The accepted values at `organizations/foo` are `E1`, `E2`.

1178

# The value accepted at `projects/bar` is `E2`.

1179

#

1180

# Example 4 (RestoreDefault):

1181

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1182

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1183

# `projects/bar` has a `Policy` with values:

1184

# {RestoreDefault: {}}

1185

# The accepted values at `organizations/foo` are `E1`, `E2`.

1186

# The accepted values at `projects/bar` are either all or none depending on

1187

# the value of `constraint_default` (if `ALLOW`, all; if

1188

# `DENY`, none).

1189

#

1190

# Example 5 (no policy inherits parent policy):

1191

# `organizations/foo` has no `Policy` set.

1192

# `projects/bar` has no `Policy` set.

1193

# The accepted values at both levels are either all or none depending on

1194

# the value of `constraint_default` (if `ALLOW`, all; if

1195

# `DENY`, none).

1196

#

1197

# Example 6 (ListConstraint allowing all):

1198

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1199

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1200

# `projects/bar` has a `Policy` with:

1201

# {all: ALLOW}

1202

# The accepted values at `organizations/foo` are `E1`, E2`.

1203

# Any value is accepted at `projects/bar`.

1204

#

1205

# Example 7 (ListConstraint allowing none):

1206

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1207

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1208

# `projects/bar` has a `Policy` with:

1209

# {all: DENY}

1210

# The accepted values at `organizations/foo` are `E1`, E2`.

1211

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1212

#

1213

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1214

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1215

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1216

# `organizations/foo` has a `Policy` with values:

1217

# {allowed_values: "under:organizations/O1"}

1218

# `projects/bar` has a `Policy` with:

1219

# {allowed_values: "under:projects/P3"}

1220

# {denied_values: "under:folders/F2"}

1221

# The accepted values at `organizations/foo` are `organizations/O1`,

1222

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1223

# `projects/P3`.

1224

# The accepted values at `projects/bar` are `organizations/O1`,

1225

# `folders/F1`, `projects/P1`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1226

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1227

# that matches the value specified in this `Policy`. If `suggested_value`

1228

# is not set, it will inherit the value specified higher in the hierarchy,

1229

# unless `inherit_from_parent` is `false`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1230

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1231

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1232

"A String",

1233

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1234

},

1235

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1236

# resource.

1237

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1238

# configuration is acceptable.

1239

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1240

# Suppose you have a `Constraint`

1241

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1242

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1243

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1244

# - If the `Policy` at this resource has enforced set to `false`, serial

1245

# port connection attempts will be allowed.

1246

# - If the `Policy` at this resource has enforced set to `true`, serial

1247

# port connection attempts will be refused.

1248

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1249

# connection attempts will be allowed.

1250

# - If no `Policy` is set at this resource or anywhere higher in the

1251

# resource hierarchy, serial port connection attempts will be allowed.

1252

# - If no `Policy` is set at this resource, but one exists higher in the

1253

# resource hierarchy, the behavior is as if the`Policy` were set at

1254

# this resource.

1255

#

1256

# The following examples demonstrate the different possible layerings:

1257

#

1258

# Example 1 (nearest `Constraint` wins):

1259

# `organizations/foo` has a `Policy` with:

1260

# {enforced: false}

1261

# `projects/bar` has no `Policy` set.

1262

# The constraint at `projects/bar` and `organizations/foo` will not be

1263

# enforced.

1264

#

1265

# Example 2 (enforcement gets replaced):

1266

# `organizations/foo` has a `Policy` with:

1267

# {enforced: false}

1268

# `projects/bar` has a `Policy` with:

1269

# {enforced: true}

1270

# The constraint at `organizations/foo` is not enforced.

1271

# The constraint at `projects/bar` is enforced.

1272

#

1273

# Example 3 (RestoreDefault):

1274

# `organizations/foo` has a `Policy` with:

1275

# {enforced: true}

1276

# `projects/bar` has a `Policy` with:

1277

# {RestoreDefault: {}}

1278

# The constraint at `organizations/foo` is enforced.

1279

# The constraint at `projects/bar` is not enforced, because

1280

# `constraint_default` for the `Constraint` is `ALLOW`.

1281

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1282

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1283

# concurrency control.

1284

#

1285

# When the `Policy` is returned from either a `GetPolicy` or a

1286

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1287

# `Policy` to use when executing a read-modify-write loop.

1288

#

1289

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1290

# `etag` will be unset.

1291

#

1292

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1293

# that was returned from a `GetOrgPolicy` request as part of a

1294

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1295

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1301

<code class="details" id="list">list(pageSize=None, pageToken=None, x__xgafv=None, filter=None)</code>

1302

<pre>Lists Projects that the caller has the `resourcemanager.projects.get`

1303

permission on and satisfy the specified filter.

1304

1305

This method returns Projects in an unspecified order.

1306

This method is eventually consistent with project mutations; this means

1307

that a newly created project may not appear in the results or recent

1308

updates to an existing project may not be reflected in the results. To

1309

retrieve the latest state of a project, use the

1310

GetProject method.

1311

1312

NOTE: If the request filter contains a `parent.type` and `parent.id` and

1313

the caller has the `resourcemanager.projects.list` permission on the

1314

parent, the results will be drawn from an alternate index which provides

1315

more consistent results. In future versions of this API, this List method

1316

will be split into List and Search to properly capture the behavorial

1317

difference.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1318

1319

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1320

pageSize: integer, The maximum number of Projects to return in the response.

1321

The server can return fewer Projects than requested.

1322

If unspecified, server picks an appropriate default.

1323

1324

Optional.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1325

pageToken: string, A pagination token returned from a previous call to ListProjects

1326

that indicates from where listing should continue.

1327

1328

Optional.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1329

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1330

Allowed values

1331

1 - v1 error format

1332

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1333

filter: string, An expression for filtering the results of the request. Filter rules are

1334

case insensitive. The fields eligible for filtering are:

1335

1336

+ `name`

1337

+ `id`

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1338

+ `labels.<key>` (where *key* is the name of a label)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

+ `parent.type`

+ `parent.id`

Some examples of using labels as filters:

1343

1344

| Filter | Description |

1345

|------------------|-----------------------------------------------------|

1346

| name:how* | The project's name starts with "how". |

1347

| name:Howl | The project's name is `Howl` or `howl`. |

1348

| name:HOWL | Equivalent to above. |

1349

| NAME:howl | Equivalent to above. |

1350

| labels.color:* | The project has the label `color`. |

1351

| labels.color:red | The project's label `color` has the value `red`. |

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1352

| labels.color:red&nbsp;labels.size:big |The project's label `color` has

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1353

the value `red` and its label `size` has the value `big`. |

1354

1355

If no filter is specified, the call will return projects for which the user

1356

has the `resourcemanager.projects.get` permission.

1357

1358

NOTE: To perform a by-parent query (eg., what projects are directly in a

1359

Folder), the caller must have the `resourcemanager.projects.list`

1360

permission on the parent and the filter must contain both a `parent.type`

1361

and a `parent.id` restriction

1362

(example: "parent.type:folder parent.id:123"). In this case an alternate

1363

search index is used which provides more consistent results.

1364

1365

Optional.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1366

1367

Returns:

1368

An object of the form:

1369

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1370

{ # A page of the response received from the

# ListProjects

# method.

#

# A paginated response where more pages are available has

1375

# `next_page_token` set. This token can be used in a subsequent request to

1376

# retrieve the next request page.

1377

"nextPageToken": "A String", # Pagination token.

1378

#

1379

# If the result set is too large to fit in a single response, this token

1380

# is returned. It encodes the position of the current result cursor.

1381

# Feeding this value into a new list request with the `page_token` parameter

1382

# gives the next page of the results.

1383

#

1384

# When `next_page_token` is not filled in, there is no next page and

1385

# the list returned is the last page in the result set.

1386

#

1387

# Pagination tokens have a limited lifetime.

1388

"projects": [ # The list of Projects that matched the list filter. This list can

1389

# be paginated.

1390

{ # A Project is a high-level Google Cloud Platform entity. It is a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1391

# container for ACLs, APIs, App Engine Apps, VMs, and other

1392

# Google Cloud Platform resources.

1393

"name": "A String", # The optional user-assigned display name of the Project.

1394

# When present it must be between 4 to 30 characters.

1395

# Allowed characters are: lowercase and uppercase letters, numbers,

1396

# hyphen, single-quote, double-quote, space, and exclamation point.

1397

#

1398

# Example: <code>My Project</code>

1399

# Read-write.

1400

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

1401

#

1402

# Supported parent types include "organization" and "folder". Once set, the

1403

# parent cannot be cleared. The `parent` can be set on creation or using the

1404

# `UpdateProject` method; the end user must have the

1405

# `resourcemanager.projects.create` permission on the parent.

1406

#

1407

# Read-write.

1408

# Cloud Platform is a generic term for something you (a developer) may want to

1409

# interact with through one of our API's. Some examples are an App Engine app,

1410

# a Compute Engine instance, a Cloud SQL database, and so on.

1411

"type": "A String", # Required field representing the resource type this id is for.

1412

# At present, the valid types are: "organization", "folder", and "project".

1413

"id": "A String", # Required field for the type-specific id. This should correspond to the id

1414

# used in the type-specific API's.

1415

},

1416

"projectId": "A String", # The unique, user-assigned ID of the Project.

1417

# It must be 6 to 30 lowercase letters, digits, or hyphens.

1418

# It must start with a letter.

1419

# Trailing hyphens are prohibited.

1420

#

1421

# Example: <code>tokyo-rain-123</code>

1422

# Read-only after creation.

1423

"labels": { # The labels associated with this Project.

1424

#

1425

# Label keys must be between 1 and 63 characters long and must conform

1426

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

1427

#

1428

# Label values must be between 0 and 63 characters long and must conform

1429

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

1430

# value can be empty.

1431

#

1432

# No more than 256 labels can be associated with a given resource.

1433

#

1434

# Clients should store labels in a representation such as JSON that does not

1435

# depend on specific characters being disallowed.

1436

#

1437

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"projectNumber": "A String", # The number uniquely identifying the project.

1442

#

1443

# Example: <code>415104041262</code>

1444

# Read-only.

1445

"lifecycleState": "A String", # The Project lifecycle state.

1446

#

1447

# Read-only.

1448

"createTime": "A String", # Creation time.

1449

#

1450

# Read-only.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1451

},

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1457

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1458

<pre>Lists `Constraints` that could be applied on the specified resource.

1459

1460

Args:

1461

resource: string, Name of the resource to list `Constraints` for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1462

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1463

The object takes the form of:

1464

1465

{ # The request sent to the [ListAvailableOrgPolicyConstraints]

1466

# google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.

1467

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1468

# and will be ignored. The server may at any point start using this field.

1469

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

1470

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1481

1482

{ # The response returned from the ListAvailableOrgPolicyConstraints method.

1483

# Returns all `Constraints` that could be set at this level of the hierarchy

1484

# (contrast with the response from `ListPolicies`, which returns all policies

1485

# which are set).

1486

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

1487

"constraints": [ # The collection of constraints that are settable on the request resource.

1488

{ # A `Constraint` describes a way in which a resource's configuration can be

1489

# restricted. For example, it controls which cloud services can be activated

1490

# across an organization, or whether a Compute Engine instance can have

1491

# serial port connections established. `Constraints` can be configured by the

1492

# organization's policy adminstrator to fit the needs of the organzation by

1493

# setting Policies for `Constraints` at different locations in the

1494

# organization's resource hierarchy. Policies are inherited down the resource

1495

# hierarchy from higher levels, but can also be overridden. For details about

1496

# the inheritance rules please read about

1497

# Policies.

1498

#

1499

# `Constraints` have a default behavior determined by the `constraint_default`

1500

# field, which is the enforcement behavior that is used in the absence of a

1501

# `Policy` being defined or inherited for the resource in question.

1502

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absense of 'Policy'.

1503

"displayName": "A String", # The human readable name.

1504

#

1505

# Mutable.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1506

"name": "A String", # Immutable value, required to globally be unique. For example,

1507

# `constraints/serviceuser.services`

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1508

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

1509

#

1510

# For example a constraint `constraints/compute.disableSerialPortAccess`.

1511

# If it is enforced on a VM instance, serial port connections will not be

1512

# opened to that instance.

1513

},

1514

"version": 42, # Version of the `Constraint`. Default version is 0;

1515

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

1516

# configured by an Organization's policy administrator with a `Policy`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1517

"supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy

1518

# can be used in `Policy.allowed_values` and `Policy.denied_values`. For

1519

# example, `"under:folders/123"` would match any resource under the

1520

# 'folders/123' folder.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1521

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1522

# that matches the value specified in this `Constraint`.

1523

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1524

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

1525

# where it is enforced.

1526

#

1527

# Mutable.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

1535

<pre>Retrieves the next page of results.

1536

1537

Args:

1538

previous_request: The request for the previous page. (required)

1539

previous_response: The response from the request for the previous page. (required)

1540

1541

Returns:

1542

A request object that you can call 'execute()' on to request the next

1543

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1548

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1549

<pre>Lists all the `Policies` set for a particular resource.

1550

1551

Args:

1552

resource: string, Name of the resource to list Policies for. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1553

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1554

The object takes the form of:

1555

1556

{ # The request sent to the ListOrgPolicies method.

1557

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1558

# and will be ignored. The server may at any point start using this field.

1559

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

1560

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1571

1572

{ # The response returned from the ListOrgPolicies method. It will be empty

1573

# if no `Policies` are set on the resource.

1574

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

1575

# the server may at any point start supplying a valid token.

1576

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

1577

# `Policies` are set.

1578

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1579

# for configurations of Cloud Platform resources.

1580

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1581

# server, not specified by the caller, and represents the last time a call to

1582

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1583

# be ignored.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1584

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1585

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1586

# `constraints/serviceuser.services`.

1587

#

1588

# Immutable after creation.

1589

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1590

# `Constraint` type.

1591

# `constraint_default` enforcement behavior of the specific `Constraint` at

1592

# this resource.

1593

#

1594

# Suppose that `constraint_default` is set to `ALLOW` for the

1595

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1596

# foo.com sets a `Policy` at their Organization resource node that restricts

1597

# the allowed service activations to deny all service activations. They

1598

# could then set a `Policy` with the `policy_type` `restore_default` on

1599

# several experimental projects, restoring the `constraint_default`

1600

# enforcement of the `Constraint` for only those projects, allowing those

1601

# projects to have all services activated.

1602

},

1603

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1604

# resource.

1605

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1606

# `ListPolicy` can define specific values and subtrees of Cloud Resource

1607

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

1608

# are allowed or denied by setting the `allowed_values` and `denied_values`

1609

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

1610

# The `under:` prefix is used to denote resource subtree values.

1611

# The `is:` prefix is used to denote specific values, and is required only

1612

# if the value contains a ":". Values prefixed with "is:" are treated the

1613

# same as values with no prefix.

1614

# Ancestry subtrees must be in one of the following formats:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1615

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

1616

# - "folders/<folder-id>", e.g. "folders/1234"

1617

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1618

# The `supports_under` field of the associated `Constraint` defines whether

1619

# ancestry prefixes can be used. You can set `allowed_values` and

1620

# `denied_values` in the same `Policy` if `all_values` is

1621

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

1622

# values. If `all_values` is set to either `ALLOW` or `DENY`,

1623

# `allowed_values` and `denied_values` must be unset.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1624

"allValues": "A String", # The policy all_values state.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1625

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1626

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1627

"A String",

1628

],

1629

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1630

#

1631

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1632

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1633

# set to `true`, then the values from the effective `Policy` of the parent

1634

# resource are inherited, meaning the values set in this `Policy` are

1635

# added to the values inherited up the hierarchy.

1636

#

1637

# Setting `Policy` hierarchies that inherit both allowed values and denied

1638

# values isn't recommended in most circumstances to keep the configuration

1639

# simple and understandable. However, it is possible to set a `Policy` with

1640

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1641

# In this case, the values that are allowed must be in `allowed_values` and

1642

# not present in `denied_values`.

1643

#

1644

# For example, suppose you have a `Constraint`

1645

# `constraints/serviceuser.services`, which has a `constraint_type` of

1646

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1647

# Suppose that at the Organization level, a `Policy` is applied that

1648

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1649

# `Policy` is applied to a project below the Organization that has

1650

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1651

# then an attempt to activate any API will be denied.

1652

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1653

# The following examples demonstrate different possible layerings for

1654

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1655

#

1656

# Example 1 (no inherited values):

1657

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1658

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1659

# `projects/bar` has `inherit_from_parent` `false` and values:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1660

# {allowed_values: "E3" allowed_values: "E4"}

1661

# The accepted values at `organizations/foo` are `E1`, `E2`.

1662

# The accepted values at `projects/bar` are `E3`, and `E4`.

1663

#

1664

# Example 2 (inherited values):

1665

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1666

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1667

# `projects/bar` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1668

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1669

# The accepted values at `organizations/foo` are `E1`, `E2`.

1670

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1671

#

1672

# Example 3 (inheriting both allowed and denied values):

1673

# `organizations/foo` has a `Policy` with values:

1674

# {allowed_values: "E1" allowed_values: "E2"}

1675

# `projects/bar` has a `Policy` with:

1676

# {denied_values: "E1"}

1677

# The accepted values at `organizations/foo` are `E1`, `E2`.

1678

# The value accepted at `projects/bar` is `E2`.

1679

#

1680

# Example 4 (RestoreDefault):

1681

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1682

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1683

# `projects/bar` has a `Policy` with values:

1684

# {RestoreDefault: {}}

1685

# The accepted values at `organizations/foo` are `E1`, `E2`.

1686

# The accepted values at `projects/bar` are either all or none depending on

1687

# the value of `constraint_default` (if `ALLOW`, all; if

1688

# `DENY`, none).

1689

#

1690

# Example 5 (no policy inherits parent policy):

1691

# `organizations/foo` has no `Policy` set.

1692

# `projects/bar` has no `Policy` set.

1693

# The accepted values at both levels are either all or none depending on

1694

# the value of `constraint_default` (if `ALLOW`, all; if

1695

# `DENY`, none).

1696

#

1697

# Example 6 (ListConstraint allowing all):

1698

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1699

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1700

# `projects/bar` has a `Policy` with:

1701

# {all: ALLOW}

1702

# The accepted values at `organizations/foo` are `E1`, E2`.

1703

# Any value is accepted at `projects/bar`.

1704

#

1705

# Example 7 (ListConstraint allowing none):

1706

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1707

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1708

# `projects/bar` has a `Policy` with:

1709

# {all: DENY}

1710

# The accepted values at `organizations/foo` are `E1`, E2`.

1711

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1712

#

1713

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

1714

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1715

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1716

# `organizations/foo` has a `Policy` with values:

1717

# {allowed_values: "under:organizations/O1"}

1718

# `projects/bar` has a `Policy` with:

1719

# {allowed_values: "under:projects/P3"}

1720

# {denied_values: "under:folders/F2"}

1721

# The accepted values at `organizations/foo` are `organizations/O1`,

1722

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

1723

# `projects/P3`.

1724

# The accepted values at `projects/bar` are `organizations/O1`,

1725

# `folders/F1`, `projects/P1`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1726

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1727

# that matches the value specified in this `Policy`. If `suggested_value`

1728

# is not set, it will inherit the value specified higher in the hierarchy,

1729

# unless `inherit_from_parent` is `false`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1730

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1731

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1736

# resource.

1737

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1738

# configuration is acceptable.

1739

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1740

# Suppose you have a `Constraint`

1741

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

1742

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

1743

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1744

# - If the `Policy` at this resource has enforced set to `false`, serial

1745

# port connection attempts will be allowed.

1746

# - If the `Policy` at this resource has enforced set to `true`, serial

1747

# port connection attempts will be refused.

1748

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1749

# connection attempts will be allowed.

1750

# - If no `Policy` is set at this resource or anywhere higher in the

1751

# resource hierarchy, serial port connection attempts will be allowed.

1752

# - If no `Policy` is set at this resource, but one exists higher in the

1753

# resource hierarchy, the behavior is as if the`Policy` were set at

1754

# this resource.

1755

#

1756

# The following examples demonstrate the different possible layerings:

1757

#

1758

# Example 1 (nearest `Constraint` wins):

1759

# `organizations/foo` has a `Policy` with:

1760

# {enforced: false}

1761

# `projects/bar` has no `Policy` set.

1762

# The constraint at `projects/bar` and `organizations/foo` will not be

1763

# enforced.

1764

#

1765

# Example 2 (enforcement gets replaced):

1766

# `organizations/foo` has a `Policy` with:

1767

# {enforced: false}

1768

# `projects/bar` has a `Policy` with:

1769

# {enforced: true}

1770

# The constraint at `organizations/foo` is not enforced.

1771

# The constraint at `projects/bar` is enforced.

1772

#

1773

# Example 3 (RestoreDefault):

1774

# `organizations/foo` has a `Policy` with:

1775

# {enforced: true}

1776

# `projects/bar` has a `Policy` with:

1777

# {RestoreDefault: {}}

1778

# The constraint at `organizations/foo` is enforced.

1779

# The constraint at `projects/bar` is not enforced, because

1780

# `constraint_default` for the `Constraint` is `ALLOW`.

1781

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

1782

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1783

# concurrency control.

1784

#

1785

# When the `Policy` is returned from either a `GetPolicy` or a

1786

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1787

# `Policy` to use when executing a read-modify-write loop.

1788

#

1789

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1790

# `etag` will be unset.

1791

#

1792

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1793

# that was returned from a `GetOrgPolicy` request as part of a

1794

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1795

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

],

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

1804

<pre>Retrieves the next page of results.

1805

1806

Args:

1807

previous_request: The request for the previous page. (required)

1808

previous_response: The response from the request for the previous page. (required)

1809

1810

Returns:

1811

A request object that you can call 'execute()' on to request the next

1812

page. Returns None if there are no more items in the collection.

</pre>

</div>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1817

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

1818

<pre>Retrieves the next page of results.

1819

1820

Args:

1821

previous_request: The request for the previous page. (required)

1822

previous_response: The response from the request for the previous page. (required)

1823

1824

Returns:

1825

A request object that you can call 'execute()' on to request the next

1826

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1831

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1832

<pre>Sets the IAM access control policy for the specified Project. Overwrites

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1833

any existing policy.

1834

1835

The following constraints apply when using `setIamPolicy()`:

1836

1837

+ Project does not support `allUsers` and `allAuthenticatedUsers` as

1838

`members` in a `Binding` of a `Policy`.

1839

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1840

+ The owner role can be granted to a `user`, `serviceAccount`, or a group

1841

that is part of an organization. For example,

1842

group@myownpersonaldomain.com could be added as an owner to a project in

1843

the myownpersonaldomain.com organization, but not the examplepetstore.com

1844

organization.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1845

1846

+ Service accounts can be made owners of a project directly

1847

without any restrictions. However, to be added as an owner, a user must be

1848

invited via Cloud Platform console and must accept the invitation.

1849

1850

+ A user cannot be granted the owner role using `setIamPolicy()`. The user

1851

must be granted the owner role using the Cloud Platform Console and must

1852

explicitly accept the invitation.

1853

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1854

+ You can only grant ownership of a project to a member by using the

1855

GCP Console. Inviting a member will deliver an invitation email that

1856

they must accept. An invitation email is not generated if you are

1857

granting a role other than owner, or if both the member you are inviting

1858

and the project are part of your organization.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1859

1860

+ Membership changes that leave the project without any owners that have

1861

accepted the Terms of Service (ToS) will be rejected.

1862

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1863

+ If the project is not part of an organization, there must be at least

1864

one owner who has accepted the Terms of Service (ToS) agreement in the

1865

policy. Calling `setIamPolicy()` to remove the last ToS-accepted owner

1866

from the policy will fail. This restriction also applies to legacy

1867

projects that no longer have owners who have accepted the ToS. Edits to

1868

IAM policies will be rejected until the lack of a ToS-accepting owner is

1869

rectified.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1870

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1871

+ This method will replace the existing policy, and cannot be used to

1872

append additional IAM settings.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1873

1874

Note: Removing service accounts from policies or changing their roles

1875

can render services completely inoperable. It is important to understand

1876

how the service account is being used before removing or updating its

1877

roles.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1878

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1879

Authorization requires the Google IAM permission

1880

`resourcemanager.projects.setIamPolicy` on the project

1881

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1882

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1883

resource: string, REQUIRED: The resource for which the policy is being specified.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1884

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1885

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

1886

The object takes the form of:

1887

1888

{ # Request message for `SetIamPolicy` method.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1889

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1890

# the policy is limited to a few 10s of KB. An empty policy is a

1891

# valid policy but certain Cloud Platform services (such as Projects)

1892

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1893

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1894

#

1895

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1896

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1897

# `members` to a single `role`. Members can be user accounts, service accounts,

1898

# Google groups, and domains (such as G Suite). A `role` is a named list of

1899

# permissions; each `role` can be an IAM predefined role or a user-created

1900

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1901

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1902

# Optionally, a `binding` can specify a `condition`, which is a logical

1903

# expression that allows access to a resource only if the expression evaluates

1904

# to `true`. A condition can add constraints based on attributes of the

1905

# request, the resource, or both.

1906

#

1907

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1912

# "role": "roles/resourcemanager.organizationAdmin",

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1913

# "members": [

1914

# "user:mike@example.com",

1915

# "group:admins@example.com",

1916

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1917

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1918

# ]

1919

# },

1920

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1921

# "role": "roles/resourcemanager.organizationViewer",

1922

# "members": ["user:eve@example.com"],

1923

# "condition": {

1924

# "title": "expirable access",

1925

# "description": "Does not grant access after Sep 2020",

1926

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

1927

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1928

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1929

# ],

1930

# "etag": "BwWWja0YfJA=",

1931

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1932

# }

1933

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1934

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1939

# - group:admins@example.com

1940

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1941

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1942

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1943

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1944

# - user:eve@example.com

1945

# role: roles/resourcemanager.organizationViewer

1946

# condition:

1947

# title: expirable access

1948

# description: Does not grant access after Sep 2020

1949

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

1950

# - etag: BwWWja0YfJA=

1951

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1952

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

1953

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1954

# [IAM documentation](https://cloud.google.com/iam/docs/).

1955

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

1956

# `condition` that determines how and when the `bindings` are applied. Each

1957

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1958

{ # Associates `members` with a `role`.

1959

"role": "A String", # Role that is assigned to `members`.

1960

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1961

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

1962

# `members` can have the following values:

1963

#

1964

# * `allUsers`: A special identifier that represents anyone who is

1965

# on the internet; with or without a Google account.

1966

#

1967

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1968

# who is authenticated with a Google account or a service account.

1969

#

1970

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1971

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

1972

#

1973

#

1974

# * `serviceAccount:{emailid}`: An email address that represents a service

1975

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1976

#

1977

# * `group:{emailid}`: An email address that represents a Google group.

1978

# For example, `admins@example.com`.

1979

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1980

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1981

# identifier) representing a user that has been recently deleted. For

1982

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1983

# recovered, this value reverts to `user:{emailid}` and the recovered user

1984

# retains the role in the binding.

1985

#

1986

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1987

# unique identifier) representing a service account that has been recently

1988

# deleted. For example,

1989

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1990

# If the service account is undeleted, this value reverts to

1991

# `serviceAccount:{emailid}` and the undeleted service account retains the

1992

# role in the binding.

1993

#

1994

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1995

# identifier) representing a Google group that has been recently

1996

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1997

# the group is recovered, this value reverts to `group:{emailid}` and the

1998

# recovered group retains the role in the binding.

1999

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2000

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2001

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2002

# users of that domain. For example, `google.com` or `example.com`.

2003

#

2004

"A String",

2005

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2006

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2007

# NOTE: An unsatisfied condition will not allow user access via current

2008

# binding. Different bindings, including their conditions, are examined

2009

# independently.

2010

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2011

# are documented at https://github.com/google/cel-spec.

2012

#

2013

# Example (Comparison):

2014

#

2015

# title: "Summary size limit"

2016

# description: "Determines if a summary is less than 100 chars"

2017

# expression: "document.summary.size() < 100"

2018

#

2019

# Example (Equality):

2020

#

2021

# title: "Requestor is owner"

2022

# description: "Determines if requestor is the document owner"

2023

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2028

# description: "Determine whether the document should be publicly visible"

2029

# expression: "document.type != 'private' && document.type != 'internal'"

2030

#

2031

# Example (Data Manipulation):

2032

#

2033

# title: "Notification string"

2034

# description: "Create a notification string with a timestamp."

2035

# expression: "'New message received at ' + string(document.create_time)"

2036

#

2037

# The exact variables and functions that may be referenced within an expression

2038

# are determined by the service that evaluates it. See the service

2039

# documentation for additional information.

2040

"description": "A String", # Optional. Description of the expression. This is a longer text which

2041

# describes the expression, e.g. when hovered over it in a UI.

2042

"expression": "A String", # Textual representation of an expression in Common Expression Language

2043

# syntax.

2044

"location": "A String", # Optional. String indicating the location of the expression for error

2045

# reporting, e.g. a file name and a position in the file.

2046

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2047

# its purpose. This can be used e.g. in UIs which allow to enter the

2048

# expression.

2049

},

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2050

},

2051

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2052

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

2053

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2054

# The configuration determines which permission types are logged, and what

2055

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2056

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2057

#

2058

# If there are AuditConfigs for both `allServices` and a specific service,

2059

# the union of the two AuditConfigs is used for that service: the log_types

2060

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2061

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2062

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2063

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2064

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2065

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2066

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2067

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2068

# "service": "allServices"

2069

# "audit_log_configs": [

2070

# {

2071

# "log_type": "DATA_READ",

2072

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2073

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

2078

# },

2079

# {

2080

# "log_type": "ADMIN_READ",

2081

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2082

# ]

2083

# },

2084

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2085

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2086

# "audit_log_configs": [

2087

# {

2088

# "log_type": "DATA_READ",

2089

# },

2090

# {

2091

# "log_type": "DATA_WRITE",

2092

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2093

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2094

# ]

2095

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2100

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2101

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2102

# logging. It also exempts jose@example.com from DATA_READ logging, and

2103

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2104

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2105

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2110

# {

2111

# "log_type": "DATA_READ",

2112

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2113

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2123

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2124

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2125

# permission.

2126

# Follows the same format of Binding.members.

2127

"A String",

2128

],

2129

"logType": "A String", # The log type that this config enables.

2130

},

2131

],

2132

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2133

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2134

# `allServices` is a special value that covers all services.

2135

},

2136

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2137

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2138

# prevent simultaneous updates of a policy from overwriting each other.

2139

# It is strongly suggested that systems make use of the `etag` in the

2140

# read-modify-write cycle to perform policy updates in order to avoid race

2141

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2142

# systems are expected to put that etag in the request to `setIamPolicy` to

2143

# ensure that their change will be applied to the same version of the policy.

2144

#

2145

# **Important:** If you use IAM Conditions, you must include the `etag` field

2146

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2147

# you to overwrite a version `3` policy with a version `1` policy, and all of

2148

# the conditions in the version `3` policy are lost.

2149

"version": 42, # Specifies the format of the policy.

2150

#

2151

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

2152

# are rejected.

2153

#

2154

# Any operation that affects conditional role bindings must specify version

2155

# `3`. This requirement applies to the following operations:

2156

#

2157

# * Getting a policy that includes a conditional role binding

2158

# * Adding a conditional role binding to a policy

2159

# * Changing a conditional role binding in a policy

2160

# * Removing any role binding, with or without a condition, from a policy

2161

# that includes conditions

2162

#

2163

# **Important:** If you use IAM Conditions, you must include the `etag` field

2164

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2165

# you to overwrite a version `3` policy with a version `1` policy, and all of

2166

# the conditions in the version `3` policy are lost.

2167

#

2168

# If a policy does not include any conditions, operations on that policy may

2169

# specify any valid version or leave the field unset.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2170

},

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2171

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2172

# the fields in the mask will be modified. If no mask is provided, the

2173

# following default mask is used:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2174

#

2175

# `paths: "bindings, etag"`

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2176

}

2177

2178

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2179

Allowed values

2180

1 - v1 error format

2181

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2182

2183

Returns:

2184

An object of the form:

2185

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2186

{ # An Identity and Access Management (IAM) policy, which specifies access

2187

# controls for Google Cloud resources.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2188

#

2189

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2190

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

2191

# `members` to a single `role`. Members can be user accounts, service accounts,

2192

# Google groups, and domains (such as G Suite). A `role` is a named list of

2193

# permissions; each `role` can be an IAM predefined role or a user-created

2194

# custom role.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2195

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2196

# Optionally, a `binding` can specify a `condition`, which is a logical

2197

# expression that allows access to a resource only if the expression evaluates

2198

# to `true`. A condition can add constraints based on attributes of the

2199

# request, the resource, or both.

2200

#

2201

# **JSON example:**

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2206

# "role": "roles/resourcemanager.organizationAdmin",

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2207

# "members": [

2208

# "user:mike@example.com",

2209

# "group:admins@example.com",

2210

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2211

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2212

# ]

2213

# },

2214

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2215

# "role": "roles/resourcemanager.organizationViewer",

2216

# "members": ["user:eve@example.com"],

2217

# "condition": {

2218

# "title": "expirable access",

2219

# "description": "Does not grant access after Sep 2020",

2220

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

2221

# }

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2222

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2223

# ],

2224

# "etag": "BwWWja0YfJA=",

2225

# "version": 3

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2226

# }

2227

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2228

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

2233

# - group:admins@example.com

2234

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2235

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

2236

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2237

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2238

# - user:eve@example.com

2239

# role: roles/resourcemanager.organizationViewer

2240

# condition:

2241

# title: expirable access

2242

# description: Does not grant access after Sep 2020

2243

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

2244

# - etag: BwWWja0YfJA=

2245

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2246

#

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2247

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2248

# [IAM documentation](https://cloud.google.com/iam/docs/).

2249

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

2250

# `condition` that determines how and when the `bindings` are applied. Each

2251

# of the `bindings` must contain at least one member.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2252

{ # Associates `members` with a `role`.

2253

"role": "A String", # Role that is assigned to `members`.

2254

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2255

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

2256

# `members` can have the following values:

2257

#

2258

# * `allUsers`: A special identifier that represents anyone who is

2259

# on the internet; with or without a Google account.

2260

#

2261

# * `allAuthenticatedUsers`: A special identifier that represents anyone

2262

# who is authenticated with a Google account or a service account.

2263

#

2264

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2265

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2266

#

2267

#

2268

# * `serviceAccount:{emailid}`: An email address that represents a service

2269

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

2270

#

2271

# * `group:{emailid}`: An email address that represents a Google group.

2272

# For example, `admins@example.com`.

2273

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2274

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

2275

# identifier) representing a user that has been recently deleted. For

2276

# example, `alice@example.com?uid=123456789012345678901`. If the user is

2277

# recovered, this value reverts to `user:{emailid}` and the recovered user

2278

# retains the role in the binding.

2279

#

2280

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

2281

# unique identifier) representing a service account that has been recently

2282

# deleted. For example,

2283

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

2284

# If the service account is undeleted, this value reverts to

2285

# `serviceAccount:{emailid}` and the undeleted service account retains the

2286

# role in the binding.

2287

#

2288

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

2289

# identifier) representing a Google group that has been recently

2290

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

2291

# the group is recovered, this value reverts to `group:{emailid}` and the

2292

# recovered group retains the role in the binding.

2293

#

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2294

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2295

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2296

# users of that domain. For example, `google.com` or `example.com`.

2297

#

2298

"A String",

2299

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2300

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

2301

# NOTE: An unsatisfied condition will not allow user access via current

2302

# binding. Different bindings, including their conditions, are examined

2303

# independently.

2304

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

2305

# are documented at https://github.com/google/cel-spec.

2306

#

2307

# Example (Comparison):

2308

#

2309

# title: "Summary size limit"

2310

# description: "Determines if a summary is less than 100 chars"

2311

# expression: "document.summary.size() < 100"

2312

#

2313

# Example (Equality):

2314

#

2315

# title: "Requestor is owner"

2316

# description: "Determines if requestor is the document owner"

2317

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

2322

# description: "Determine whether the document should be publicly visible"

2323

# expression: "document.type != 'private' && document.type != 'internal'"

2324

#

2325

# Example (Data Manipulation):

2326

#

2327

# title: "Notification string"

2328

# description: "Create a notification string with a timestamp."

2329

# expression: "'New message received at ' + string(document.create_time)"

2330

#

2331

# The exact variables and functions that may be referenced within an expression

2332

# are determined by the service that evaluates it. See the service

2333

# documentation for additional information.

2334

"description": "A String", # Optional. Description of the expression. This is a longer text which

2335

# describes the expression, e.g. when hovered over it in a UI.

2336

"expression": "A String", # Textual representation of an expression in Common Expression Language

2337

# syntax.

2338

"location": "A String", # Optional. String indicating the location of the expression for error

2339

# reporting, e.g. a file name and a position in the file.

2340

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

2341

# its purpose. This can be used e.g. in UIs which allow to enter the

2342

# expression.

2343

},

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2344

},

2345

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2346

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

2347

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2348

# The configuration determines which permission types are logged, and what

2349

# identities, if any, are exempted from logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2350

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2351

#

2352

# If there are AuditConfigs for both `allServices` and a specific service,

2353

# the union of the two AuditConfigs is used for that service: the log_types

2354

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2355

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2356

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2357

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2358

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2359

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2360

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2361

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2362

# "service": "allServices"

2363

# "audit_log_configs": [

2364

# {

2365

# "log_type": "DATA_READ",

2366

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2367

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

2372

# },

2373

# {

2374

# "log_type": "ADMIN_READ",

2375

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2376

# ]

2377

# },

2378

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2379

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2380

# "audit_log_configs": [

2381

# {

2382

# "log_type": "DATA_READ",

2383

# },

2384

# {

2385

# "log_type": "DATA_WRITE",

2386

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2387

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2388

# ]

2389

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

2394

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2395

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2396

# logging. It also exempts jose@example.com from DATA_READ logging, and

2397

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2398

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2399

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2404

# {

2405

# "log_type": "DATA_READ",

2406

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2407

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2417

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2418

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2419

# permission.

2420

# Follows the same format of Binding.members.

2421

"A String",

2422

],

2423

"logType": "A String", # The log type that this config enables.

2424

},

2425

],

2426

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2427

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2428

# `allServices` is a special value that covers all services.

2429

},

2430

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2431

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

2432

# prevent simultaneous updates of a policy from overwriting each other.

2433

# It is strongly suggested that systems make use of the `etag` in the

2434

# read-modify-write cycle to perform policy updates in order to avoid race

2435

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

2436

# systems are expected to put that etag in the request to `setIamPolicy` to

2437

# ensure that their change will be applied to the same version of the policy.

2438

#

2439

# **Important:** If you use IAM Conditions, you must include the `etag` field

2440

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2441

# you to overwrite a version `3` policy with a version `1` policy, and all of

2442

# the conditions in the version `3` policy are lost.

2443

"version": 42, # Specifies the format of the policy.

2444

#

2445

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

2446

# are rejected.

2447

#

2448

# Any operation that affects conditional role bindings must specify version

2449

# `3`. This requirement applies to the following operations:

2450

#

2451

# * Getting a policy that includes a conditional role binding

2452

# * Adding a conditional role binding to a policy

2453

# * Changing a conditional role binding in a policy

2454

# * Removing any role binding, with or without a condition, from a policy

2455

# that includes conditions

2456

#

2457

# **Important:** If you use IAM Conditions, you must include the `etag` field

2458

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

2459

# you to overwrite a version `3` policy with a version `1` policy, and all of

2460

# the conditions in the version `3` policy are lost.

2461

#

2462

# If a policy does not include any conditions, operations on that policy may

2463

# specify any valid version or leave the field unset.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2468

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2469

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

2470

that `Constraint` on the resource if one does not exist.

2471

2472

Not supplying an `etag` on the request `Policy` results in an unconditional

2473

write of the `Policy`.

2474

2475

Args:

2476

resource: string, Resource name of the resource to attach the `Policy`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2477

body: object, The request body.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2478

The object takes the form of:

2479

2480

{ # The request sent to the SetOrgPolicyRequest method.

2481

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

2482

# for configurations of Cloud Platform resources.

2483

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

2484

# server, not specified by the caller, and represents the last time a call to

2485

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2486

# be ignored.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2487

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2488

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2489

# `constraints/serviceuser.services`.

2490

#

2491

# Immutable after creation.

2492

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

2493

# `Constraint` type.

2494

# `constraint_default` enforcement behavior of the specific `Constraint` at

2495

# this resource.

2496

#

2497

# Suppose that `constraint_default` is set to `ALLOW` for the

2498

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2499

# foo.com sets a `Policy` at their Organization resource node that restricts

2500

# the allowed service activations to deny all service activations. They

2501

# could then set a `Policy` with the `policy_type` `restore_default` on

2502

# several experimental projects, restoring the `constraint_default`

2503

# enforcement of the `Constraint` for only those projects, allowing those

2504

# projects to have all services activated.

2505

},

2506

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

2507

# resource.

2508

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2509

# `ListPolicy` can define specific values and subtrees of Cloud Resource

2510

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

2511

# are allowed or denied by setting the `allowed_values` and `denied_values`

2512

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

2513

# The `under:` prefix is used to denote resource subtree values.

2514

# The `is:` prefix is used to denote specific values, and is required only

2515

# if the value contains a ":". Values prefixed with "is:" are treated the

2516

# same as values with no prefix.

2517

# Ancestry subtrees must be in one of the following formats:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2518

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

2519

# - "folders/<folder-id>", e.g. "folders/1234"

2520

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2521

# The `supports_under` field of the associated `Constraint` defines whether

2522

# ancestry prefixes can be used. You can set `allowed_values` and

2523

# `denied_values` in the same `Policy` if `all_values` is

2524

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

2525

# values. If `all_values` is set to either `ALLOW` or `DENY`,

2526

# `allowed_values` and `denied_values` must be unset.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2527

"allValues": "A String", # The policy all_values state.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2528

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2529

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2530

"A String",

2531

],

2532

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

2533

#

2534

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

2535

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2536

# set to `true`, then the values from the effective `Policy` of the parent

2537

# resource are inherited, meaning the values set in this `Policy` are

2538

# added to the values inherited up the hierarchy.

2539

#

2540

# Setting `Policy` hierarchies that inherit both allowed values and denied

2541

# values isn't recommended in most circumstances to keep the configuration

2542

# simple and understandable. However, it is possible to set a `Policy` with

2543

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2544

# In this case, the values that are allowed must be in `allowed_values` and

2545

# not present in `denied_values`.

2546

#

2547

# For example, suppose you have a `Constraint`

2548

# `constraints/serviceuser.services`, which has a `constraint_type` of

2549

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2550

# Suppose that at the Organization level, a `Policy` is applied that

2551

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2552

# `Policy` is applied to a project below the Organization that has

2553

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2554

# then an attempt to activate any API will be denied.

2555

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2556

# The following examples demonstrate different possible layerings for

2557

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2558

#

2559

# Example 1 (no inherited values):

2560

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2561

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2562

# `projects/bar` has `inherit_from_parent` `false` and values:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2563

# {allowed_values: "E3" allowed_values: "E4"}

2564

# The accepted values at `organizations/foo` are `E1`, `E2`.

2565

# The accepted values at `projects/bar` are `E3`, and `E4`.

2566

#

2567

# Example 2 (inherited values):

2568

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2569

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2570

# `projects/bar` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2571

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2572

# The accepted values at `organizations/foo` are `E1`, `E2`.

2573

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2574

#

2575

# Example 3 (inheriting both allowed and denied values):

2576

# `organizations/foo` has a `Policy` with values:

2577

# {allowed_values: "E1" allowed_values: "E2"}

2578

# `projects/bar` has a `Policy` with:

2579

# {denied_values: "E1"}

2580

# The accepted values at `organizations/foo` are `E1`, `E2`.

2581

# The value accepted at `projects/bar` is `E2`.

2582

#

2583

# Example 4 (RestoreDefault):

2584

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2585

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2586

# `projects/bar` has a `Policy` with values:

2587

# {RestoreDefault: {}}

2588

# The accepted values at `organizations/foo` are `E1`, `E2`.

2589

# The accepted values at `projects/bar` are either all or none depending on

2590

# the value of `constraint_default` (if `ALLOW`, all; if

2591

# `DENY`, none).

2592

#

2593

# Example 5 (no policy inherits parent policy):

2594

# `organizations/foo` has no `Policy` set.

2595

# `projects/bar` has no `Policy` set.

2596

# The accepted values at both levels are either all or none depending on

2597

# the value of `constraint_default` (if `ALLOW`, all; if

2598

# `DENY`, none).

2599

#

2600

# Example 6 (ListConstraint allowing all):

2601

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2602

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2603

# `projects/bar` has a `Policy` with:

2604

# {all: ALLOW}

2605

# The accepted values at `organizations/foo` are `E1`, E2`.

2606

# Any value is accepted at `projects/bar`.

2607

#

2608

# Example 7 (ListConstraint allowing none):

2609

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2610

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2611

# `projects/bar` has a `Policy` with:

2612

# {all: DENY}

2613

# The accepted values at `organizations/foo` are `E1`, E2`.

2614

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2615

#

2616

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

2617

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2618

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2619

# `organizations/foo` has a `Policy` with values:

2620

# {allowed_values: "under:organizations/O1"}

2621

# `projects/bar` has a `Policy` with:

2622

# {allowed_values: "under:projects/P3"}

2623

# {denied_values: "under:folders/F2"}

2624

# The accepted values at `organizations/foo` are `organizations/O1`,

2625

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

2626

# `projects/P3`.

2627

# The accepted values at `projects/bar` are `organizations/O1`,

2628

# `folders/F1`, `projects/P1`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2629

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2630

# that matches the value specified in this `Policy`. If `suggested_value`

2631

# is not set, it will inherit the value specified higher in the hierarchy,

2632

# unless `inherit_from_parent` is `false`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2633

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2634

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2635

"A String",

2636

],

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2637

},

2638

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

2639

# resource.

2640

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

2641

# configuration is acceptable.

2642

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2643

# Suppose you have a `Constraint`

2644

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

2645

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

2646

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2647

# - If the `Policy` at this resource has enforced set to `false`, serial

2648

# port connection attempts will be allowed.

2649

# - If the `Policy` at this resource has enforced set to `true`, serial

2650

# port connection attempts will be refused.

2651

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2652

# connection attempts will be allowed.

2653

# - If no `Policy` is set at this resource or anywhere higher in the

2654

# resource hierarchy, serial port connection attempts will be allowed.

2655

# - If no `Policy` is set at this resource, but one exists higher in the

2656

# resource hierarchy, the behavior is as if the`Policy` were set at

2657

# this resource.

2658

#

2659

# The following examples demonstrate the different possible layerings:

2660

#

2661

# Example 1 (nearest `Constraint` wins):

2662

# `organizations/foo` has a `Policy` with:

2663

# {enforced: false}

2664

# `projects/bar` has no `Policy` set.

2665

# The constraint at `projects/bar` and `organizations/foo` will not be

2666

# enforced.

2667

#

2668

# Example 2 (enforcement gets replaced):

2669

# `organizations/foo` has a `Policy` with:

2670

# {enforced: false}

2671

# `projects/bar` has a `Policy` with:

2672

# {enforced: true}

2673

# The constraint at `organizations/foo` is not enforced.

2674

# The constraint at `projects/bar` is enforced.

2675

#

2676

# Example 3 (RestoreDefault):

2677

# `organizations/foo` has a `Policy` with:

2678

# {enforced: true}

2679

# `projects/bar` has a `Policy` with:

2680

# {RestoreDefault: {}}

2681

# The constraint at `organizations/foo` is enforced.

2682

# The constraint at `projects/bar` is not enforced, because

2683

# `constraint_default` for the `Constraint` is `ALLOW`.

2684

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2685

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2686

# concurrency control.

2687

#

2688

# When the `Policy` is returned from either a `GetPolicy` or a

2689

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2690

# `Policy` to use when executing a read-modify-write loop.

2691

#

2692

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2693

# `etag` will be unset.

2694

#

2695

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2696

# that was returned from a `GetOrgPolicy` request as part of a

2697

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2698

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2710

2711

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

2712

# for configurations of Cloud Platform resources.

2713

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

2714

# server, not specified by the caller, and represents the last time a call to

2715

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2716

# be ignored.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2717

"version": 42, # Version of the `Policy`. Default version is 0;

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2718

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2719

# `constraints/serviceuser.services`.

2720

#

2721

# Immutable after creation.

2722

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

2723

# `Constraint` type.

2724

# `constraint_default` enforcement behavior of the specific `Constraint` at

2725

# this resource.

2726

#

2727

# Suppose that `constraint_default` is set to `ALLOW` for the

2728

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2729

# foo.com sets a `Policy` at their Organization resource node that restricts

2730

# the allowed service activations to deny all service activations. They

2731

# could then set a `Policy` with the `policy_type` `restore_default` on

2732

# several experimental projects, restoring the `constraint_default`

2733

# enforcement of the `Constraint` for only those projects, allowing those

2734

# projects to have all services activated.

2735

},

2736

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

2737

# resource.

2738

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2739

# `ListPolicy` can define specific values and subtrees of Cloud Resource

2740

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

2741

# are allowed or denied by setting the `allowed_values` and `denied_values`

2742

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

2743

# The `under:` prefix is used to denote resource subtree values.

2744

# The `is:` prefix is used to denote specific values, and is required only

2745

# if the value contains a ":". Values prefixed with "is:" are treated the

2746

# same as values with no prefix.

2747

# Ancestry subtrees must be in one of the following formats:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2748

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

2749

# - "folders/<folder-id>", e.g. "folders/1234"

2750

# - "organizations/<organization-id>", e.g. "organizations/1234"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2751

# The `supports_under` field of the associated `Constraint` defines whether

2752

# ancestry prefixes can be used. You can set `allowed_values` and

2753

# `denied_values` in the same `Policy` if `all_values` is

2754

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

2755

# values. If `all_values` is set to either `ALLOW` or `DENY`,

2756

# `allowed_values` and `denied_values` must be unset.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2757

"allValues": "A String", # The policy all_values state.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2758

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2759

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2760

"A String",

2761

],

2762

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

2763

#

2764

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

2765

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2766

# set to `true`, then the values from the effective `Policy` of the parent

2767

# resource are inherited, meaning the values set in this `Policy` are

2768

# added to the values inherited up the hierarchy.

2769

#

2770

# Setting `Policy` hierarchies that inherit both allowed values and denied

2771

# values isn't recommended in most circumstances to keep the configuration

2772

# simple and understandable. However, it is possible to set a `Policy` with

2773

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2774

# In this case, the values that are allowed must be in `allowed_values` and

2775

# not present in `denied_values`.

2776

#

2777

# For example, suppose you have a `Constraint`

2778

# `constraints/serviceuser.services`, which has a `constraint_type` of

2779

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2780

# Suppose that at the Organization level, a `Policy` is applied that

2781

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2782

# `Policy` is applied to a project below the Organization that has

2783

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2784

# then an attempt to activate any API will be denied.

2785

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2786

# The following examples demonstrate different possible layerings for

2787

# `projects/bar` parented by `organizations/foo`:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2788

#

2789

# Example 1 (no inherited values):

2790

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2791

# {allowed_values: "E1" allowed_values:"E2"}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2792

# `projects/bar` has `inherit_from_parent` `false` and values:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2793

# {allowed_values: "E3" allowed_values: "E4"}

2794

# The accepted values at `organizations/foo` are `E1`, `E2`.

2795

# The accepted values at `projects/bar` are `E3`, and `E4`.

2796

#

2797

# Example 2 (inherited values):

2798

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2799

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2800

# `projects/bar` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2801

# {value: "E3" value: "E4" inherit_from_parent: true}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2802

# The accepted values at `organizations/foo` are `E1`, `E2`.

2803

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2804

#

2805

# Example 3 (inheriting both allowed and denied values):

2806

# `organizations/foo` has a `Policy` with values:

2807

# {allowed_values: "E1" allowed_values: "E2"}

2808

# `projects/bar` has a `Policy` with:

2809

# {denied_values: "E1"}

2810

# The accepted values at `organizations/foo` are `E1`, `E2`.

2811

# The value accepted at `projects/bar` is `E2`.

2812

#

2813

# Example 4 (RestoreDefault):

2814

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2815

# {allowed_values: "E1" allowed_values:"E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2816

# `projects/bar` has a `Policy` with values:

2817

# {RestoreDefault: {}}

2818

# The accepted values at `organizations/foo` are `E1`, `E2`.

2819

# The accepted values at `projects/bar` are either all or none depending on

2820

# the value of `constraint_default` (if `ALLOW`, all; if

2821

# `DENY`, none).

2822

#

2823

# Example 5 (no policy inherits parent policy):

2824

# `organizations/foo` has no `Policy` set.

2825

# `projects/bar` has no `Policy` set.

2826

# The accepted values at both levels are either all or none depending on

2827

# the value of `constraint_default` (if `ALLOW`, all; if

2828

# `DENY`, none).

2829

#

2830

# Example 6 (ListConstraint allowing all):

2831

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2832

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2833

# `projects/bar` has a `Policy` with:

2834

# {all: ALLOW}

2835

# The accepted values at `organizations/foo` are `E1`, E2`.

2836

# Any value is accepted at `projects/bar`.

2837

#

2838

# Example 7 (ListConstraint allowing none):

2839

# `organizations/foo` has a `Policy` with values:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2840

# {allowed_values: "E1" allowed_values: "E2"}

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2841

# `projects/bar` has a `Policy` with:

2842

# {all: DENY}

2843

# The accepted values at `organizations/foo` are `E1`, E2`.

2844

# No value is accepted at `projects/bar`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2845

#

2846

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

2847

# Given the following resource hierarchy

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2848

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2849

# `organizations/foo` has a `Policy` with values:

2850

# {allowed_values: "under:organizations/O1"}

2851

# `projects/bar` has a `Policy` with:

2852

# {allowed_values: "under:projects/P3"}

2853

# {denied_values: "under:folders/F2"}

2854

# The accepted values at `organizations/foo` are `organizations/O1`,

2855

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

2856

# `projects/P3`.

2857

# The accepted values at `projects/bar` are `organizations/O1`,

2858

# `folders/F1`, `projects/P1`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2859

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2860

# that matches the value specified in this `Policy`. If `suggested_value`

2861

# is not set, it will inherit the value specified higher in the hierarchy,

2862

# unless `inherit_from_parent` is `false`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2863

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2864

# is set to `ALL_VALUES_UNSPECIFIED`.

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

2869

# resource.

2870

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

2871

# configuration is acceptable.

2872

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2873

# Suppose you have a `Constraint`

2874

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

2875

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

2876

# behavior:

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2877

# - If the `Policy` at this resource has enforced set to `false`, serial

2878

# port connection attempts will be allowed.

2879

# - If the `Policy` at this resource has enforced set to `true`, serial

2880

# port connection attempts will be refused.

2881

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2882

# connection attempts will be allowed.

2883

# - If no `Policy` is set at this resource or anywhere higher in the

2884

# resource hierarchy, serial port connection attempts will be allowed.

2885

# - If no `Policy` is set at this resource, but one exists higher in the

2886

# resource hierarchy, the behavior is as if the`Policy` were set at

2887

# this resource.

2888

#

2889

# The following examples demonstrate the different possible layerings:

2890

#

2891

# Example 1 (nearest `Constraint` wins):

2892

# `organizations/foo` has a `Policy` with:

2893

# {enforced: false}

2894

# `projects/bar` has no `Policy` set.

2895

# The constraint at `projects/bar` and `organizations/foo` will not be

2896

# enforced.

2897

#

2898

# Example 2 (enforcement gets replaced):

2899

# `organizations/foo` has a `Policy` with:

2900

# {enforced: false}

2901

# `projects/bar` has a `Policy` with:

2902

# {enforced: true}

2903

# The constraint at `organizations/foo` is not enforced.

2904

# The constraint at `projects/bar` is enforced.

2905

#

2906

# Example 3 (RestoreDefault):

2907

# `organizations/foo` has a `Policy` with:

2908

# {enforced: true}

2909

# `projects/bar` has a `Policy` with:

2910

# {RestoreDefault: {}}

2911

# The constraint at `organizations/foo` is enforced.

2912

# The constraint at `projects/bar` is not enforced, because

2913

# `constraint_default` for the `Constraint` is `ALLOW`.

2914

},

Sai Cheemalapati

2017-03-24 15:06:46 -0700

[diff] [blame]

2915

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2916

# concurrency control.

2917

#

2918

# When the `Policy` is returned from either a `GetPolicy` or a

2919

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2920

# `Policy` to use when executing a read-modify-write loop.

2921

#

2922

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2923

# `etag` will be unset.

2924

#

2925

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2926

# that was returned from a `GetOrgPolicy` request as part of a

2927

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2928

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2934

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2935

<pre>Returns permissions that a caller has on the specified Project.

2936

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2937

There are no permissions required for making this API call.

2938

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2939

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2940

resource: string, REQUIRED: The resource for which the policy detail is being requested.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2941

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

2942

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2943

The object takes the form of:

2944

2945

{ # Request message for `TestIamPermissions` method.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2946

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

2947

# wildcards (such as '*' or 'storage.*') are not allowed. For more

2948

# information see

2949

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

"A String",

],

}

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2955

Allowed values

2956

1 - v1 error format

2957

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2958

2959

Returns:

2960

An object of the form:

2961

2962

{ # Response message for `TestIamPermissions` method.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2963

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

2964

# allowed.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

"A String",

],

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2971

<code class="details" id="undelete">undelete(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2972

<pre>Restores the Project identified by the specified

2973

`project_id` (for example, `my-project-123`).

2974

You can only use this method for a Project that has a lifecycle state of

2975

DELETE_REQUESTED.

2976

After deletion starts, the Project cannot be restored.

2977

2978

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2979

2980

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2981

projectId: string, The project ID (for example, `foo-bar-123`).

2982

2983

Required. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2984

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2985

The object takes the form of:

2986

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2987

{ # The request sent to the UndeleteProject

2988

# method.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2989

}

2990

2991

x__xgafv: string, V1 error format.

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2992

Allowed values

2993

1 - v1 error format

2994

2 - v2 error format

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

2995

2996

Returns:

2997

An object of the form:

2998

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

2999

{ # A generic empty message that you can re-use to avoid defining duplicated

3000

# empty messages in your APIs. A typical example is to use it as the request

3001

# or the response type of an API method. For instance:

3002

#

3003

# service Foo {

3004

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

3005

# }

3006

#

3007

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

3012

<code class="details" id="update">update(projectId, body=None, x__xgafv=None)</code>

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3013

<pre>Updates the attributes of the Project identified by the specified

3014

`project_id` (for example, `my-project-123`).

3015

3016

The caller must have modify permissions for this Project.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3017

3018

Args:

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3019

projectId: string, The project ID (for example, `my-project-123`).

3020

3021

Required. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

3022

body: object, The request body.

Jon Wayne Parrott

2016-05-19 10:54:38 -0700

[diff] [blame]

3023

The object takes the form of:

3024

Jon Wayne Parrott

2017-01-06 09:58:29 -0800

[diff] [blame]

3025

{ # A Project is a high-level Google Cloud Platform entity. It is a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

3026

# container for ACLs, APIs, App Engine Apps, VMs, and other

3027

# Google Cloud Platform resources.

3028

"name": "A String", # The optional user-assigned display name of the Project.

3029

# When present it must be between 4 to 30 characters.

3030

# Allowed characters are: lowercase and uppercase letters, numbers,

3031

# hyphen, single-quote, double-quote, space, and exclamation point.

3032

#

3033

# Example: <code>My Project</code>

3034

# Read-write.

3035

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

3036

#

3037

# Supported parent types include "organization" and "folder". Once set, the

3038

# parent cannot be cleared. The `parent` can be set on creation or using the

3039

# `UpdateProject` method; the end user must have the

3040

# `resourcemanager.projects.create` permission on the parent.

3041

#

3042

# Read-write.

3043

# Cloud Platform is a generic term for something you (a developer) may want to

3044

# interact with through one of our API's. Some examples are an App Engine app,

3045

# a Compute Engine instance, a Cloud SQL database, and so on.

3046

"type": "A String", # Required field representing the resource type this id is for.

3047

# At present, the valid types are: "organization", "folder", and "project".

3048

"id": "A String", # Required field for the type-specific id. This should correspond to the id

3049

# used in the type-specific API's.

3050

},

3051

"projectId": "A String", # The unique, user-assigned ID of the Project.

3052

# It must be 6 to 30 lowercase letters, digits, or hyphens.

3053

# It must start with a letter.

3054

# Trailing hyphens are prohibited.

3055

#

3056

# Example: <code>tokyo-rain-123</code>

3057

# Read-only after creation.

3058

"labels": { # The labels associated with this Project.

3059

#

3060

# Label keys must be between 1 and 63 characters long and must conform

3061

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

3062

#

3063

# Label values must be between 0 and 63 characters long and must conform

3064

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

3065

# value can be empty.

3066

#

3067

# No more than 256 labels can be associated with a given resource.

3068

#

3069

# Clients should store labels in a representation such as JSON that does not

3070

# depend on specific characters being disallowed.

3071

#

3072

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"projectNumber": "A String", # The number uniquely identifying the project.

3077

#

3078

# Example: <code>415104041262</code>

3079

# Read-only.

3080

"lifecycleState": "A String", # The Project lifecycle state.

3081

#

3082

# Read-only.

3083

"createTime": "A String", # Creation time.

3084

#

3085

# Read-only.

3086

}

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

3087

3088

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

3095

3096

{ # A Project is a high-level Google Cloud Platform entity. It is a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

3097

# container for ACLs, APIs, App Engine Apps, VMs, and other

3098

# Google Cloud Platform resources.

3099

"name": "A String", # The optional user-assigned display name of the Project.

3100

# When present it must be between 4 to 30 characters.

3101

# Allowed characters are: lowercase and uppercase letters, numbers,

3102

# hyphen, single-quote, double-quote, space, and exclamation point.

3103

#

3104

# Example: <code>My Project</code>

3105

# Read-write.

3106

"parent": { # A container to reference an id for any resource type. A `resource` in Google # An optional reference to a parent Resource.

3107

#

3108

# Supported parent types include "organization" and "folder". Once set, the

3109

# parent cannot be cleared. The `parent` can be set on creation or using the

3110

# `UpdateProject` method; the end user must have the

3111

# `resourcemanager.projects.create` permission on the parent.

3112

#

3113

# Read-write.

3114

# Cloud Platform is a generic term for something you (a developer) may want to

3115

# interact with through one of our API's. Some examples are an App Engine app,

3116

# a Compute Engine instance, a Cloud SQL database, and so on.

3117

"type": "A String", # Required field representing the resource type this id is for.

3118

# At present, the valid types are: "organization", "folder", and "project".

3119

"id": "A String", # Required field for the type-specific id. This should correspond to the id

3120

# used in the type-specific API's.

3121

},

3122

"projectId": "A String", # The unique, user-assigned ID of the Project.

3123

# It must be 6 to 30 lowercase letters, digits, or hyphens.

3124

# It must start with a letter.

3125

# Trailing hyphens are prohibited.

3126

#

3127

# Example: <code>tokyo-rain-123</code>

3128

# Read-only after creation.

3129

"labels": { # The labels associated with this Project.

3130

#

3131

# Label keys must be between 1 and 63 characters long and must conform

3132

# to the following regular expression: \[a-z\](\[-a-z0-9\]*\[a-z0-9\])?.

3133

#

3134

# Label values must be between 0 and 63 characters long and must conform

3135

# to the regular expression (\[a-z\](\[-a-z0-9\]*\[a-z0-9\])?)?. A label

3136

# value can be empty.

3137

#

3138

# No more than 256 labels can be associated with a given resource.

3139

#

3140

# Clients should store labels in a representation such as JSON that does not

3141

# depend on specific characters being disallowed.

3142

#

3143

# Example: <code>"environment" : "dev"</code>

# Read-write.

"a_key": "A String",

},

"projectNumber": "A String", # The number uniquely identifying the project.

3148

#

3149

# Example: <code>415104041262</code>

3150

# Read-only.

3151

"lifecycleState": "A String", # The Project lifecycle state.

3152

#

3153

# Read-only.

3154

"createTime": "A String", # Creation time.

3155

#

3156

# Read-only.

3157

}</pre>

Jon Wayne Parrott