Blame - docs/dyn/servicemanagement_v1.services.consumers.html - platform/external/python/google-api-python-client

2017-03-13 12:12:03 -0400

[diff] [blame]

76

<h2>Instance Methods</h2>

77

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

78

<code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

79

<p class="firstline">Gets the access control policy for a resource.</p>

80

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

81

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

82

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

83

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

84

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

85

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

86

<h3>Method Details</h3>

87

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

88

<code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

89

<pre>Gets the access control policy for a resource.

90

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

95

See the operation documentation for the appropriate value for this field. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

96

body: object, The request body.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

97

The object takes the form of:

98

99

{ # Request message for `GetIamPolicy` method.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

100

"options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to

101

# `GetIamPolicy`. This field is only used by Cloud IAM.

102

"requestedPolicyVersion": 42, # Optional. The policy format version to be returned.

103

#

104

# Valid values are 0, 1, and 3. Requests specifying an invalid value will be

105

# rejected.

106

#

107

# Requests for policies with any conditional bindings must specify version 3.

108

# Policies without any conditional bindings may specify any valid value or

109

# leave the field unset.

110

},

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

111

}

112

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

113

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

120

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

121

{ # An Identity and Access Management (IAM) policy, which specifies access

122

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

123

#

124

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

125

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

126

# `members` to a single `role`. Members can be user accounts, service accounts,

127

# Google groups, and domains (such as G Suite). A `role` is a named list of

128

# permissions; each `role` can be an IAM predefined role or a user-created

129

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

130

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

131

# Optionally, a `binding` can specify a `condition`, which is a logical

132

# expression that allows access to a resource only if the expression evaluates

133

# to `true`. A condition can add constraints based on attributes of the

134

# request, the resource, or both.

135

#

136

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

141

# "role": "roles/resourcemanager.organizationAdmin",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

142

# "members": [

143

# "user:mike@example.com",

144

# "group:admins@example.com",

145

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

146

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

147

# ]

148

# },

149

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

150

# "role": "roles/resourcemanager.organizationViewer",

151

# "members": ["user:eve@example.com"],

152

# "condition": {

153

# "title": "expirable access",

154

# "description": "Does not grant access after Sep 2020",

155

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

156

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

157

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

158

# ],

159

# "etag": "BwWWja0YfJA=",

160

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

161

# }

162

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

163

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

168

# - group:admins@example.com

169

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

170

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

171

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

172

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

173

# - user:eve@example.com

174

# role: roles/resourcemanager.organizationViewer

175

# condition:

176

# title: expirable access

177

# description: Does not grant access after Sep 2020

178

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

179

# - etag: BwWWja0YfJA=

180

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

181

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

182

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

183

# [IAM documentation](https://cloud.google.com/iam/docs/).

184

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

185

# `condition` that determines how and when the `bindings` are applied. Each

186

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

187

{ # Associates `members` with a `role`.

188

"role": "A String", # Role that is assigned to `members`.

189

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

190

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

191

# NOTE: An unsatisfied condition will not allow user access via current

192

# binding. Different bindings, including their conditions, are examined

193

# independently.

194

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

195

# are documented at https://github.com/google/cel-spec.

196

#

197

# Example (Comparison):

198

#

199

# title: "Summary size limit"

200

# description: "Determines if a summary is less than 100 chars"

201

# expression: "document.summary.size() < 100"

202

#

203

# Example (Equality):

204

#

205

# title: "Requestor is owner"

206

# description: "Determines if requestor is the document owner"

207

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

212

# description: "Determine whether the document should be publicly visible"

213

# expression: "document.type != 'private' && document.type != 'internal'"

214

#

215

# Example (Data Manipulation):

216

#

217

# title: "Notification string"

218

# description: "Create a notification string with a timestamp."

219

# expression: "'New message received at ' + string(document.create_time)"

220

#

221

# The exact variables and functions that may be referenced within an expression

222

# are determined by the service that evaluates it. See the service

223

# documentation for additional information.

224

"description": "A String", # Optional. Description of the expression. This is a longer text which

225

# describes the expression, e.g. when hovered over it in a UI.

226

"expression": "A String", # Textual representation of an expression in Common Expression Language

227

# syntax.

228

"location": "A String", # Optional. String indicating the location of the expression for error

229

# reporting, e.g. a file name and a position in the file.

230

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

231

# its purpose. This can be used e.g. in UIs which allow to enter the

232

# expression.

233

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

234

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

235

# `members` can have the following values:

236

#

237

# * `allUsers`: A special identifier that represents anyone who is

238

# on the internet; with or without a Google account.

239

#

240

# * `allAuthenticatedUsers`: A special identifier that represents anyone

241

# who is authenticated with a Google account or a service account.

242

#

243

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

244

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

245

#

246

#

247

# * `serviceAccount:{emailid}`: An email address that represents a service

248

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

249

#

250

# * `group:{emailid}`: An email address that represents a Google group.

251

# For example, `admins@example.com`.

252

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

253

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

254

# identifier) representing a user that has been recently deleted. For

255

# example, `alice@example.com?uid=123456789012345678901`. If the user is

256

# recovered, this value reverts to `user:{emailid}` and the recovered user

257

# retains the role in the binding.

258

#

259

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

260

# unique identifier) representing a service account that has been recently

261

# deleted. For example,

262

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

263

# If the service account is undeleted, this value reverts to

264

# `serviceAccount:{emailid}` and the undeleted service account retains the

265

# role in the binding.

266

#

267

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

268

# identifier) representing a Google group that has been recently

269

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

270

# the group is recovered, this value reverts to `group:{emailid}` and the

271

# recovered group retains the role in the binding.

272

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

273

#

274

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

275

# users of that domain. For example, `google.com` or `example.com`.

276

#

277

"A String",

278

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

279

},

280

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

281

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

282

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

283

# The configuration determines which permission types are logged, and what

284

# identities, if any, are exempted from logging.

285

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

286

#

287

# If there are AuditConfigs for both `allServices` and a specific service,

288

# the union of the two AuditConfigs is used for that service: the log_types

289

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

290

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

291

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

292

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

293

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

294

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

295

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

296

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

297

# "service": "allServices"

298

# "audit_log_configs": [

299

# {

300

# "log_type": "DATA_READ",

301

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

302

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

307

# },

308

# {

309

# "log_type": "ADMIN_READ",

310

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

311

# ]

312

# },

313

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

314

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

315

# "audit_log_configs": [

316

# {

317

# "log_type": "DATA_READ",

318

# },

319

# {

320

# "log_type": "DATA_WRITE",

321

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

322

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

323

# ]

324

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

329

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

330

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

331

# logging. It also exempts jose@example.com from DATA_READ logging, and

332

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

333

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

334

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

339

# {

340

# "log_type": "DATA_READ",

341

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

342

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

352

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

353

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

354

# permission.

355

# Follows the same format of Binding.members.

356

"A String",

357

],

358

"logType": "A String", # The log type that this config enables.

359

},

360

],

361

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

362

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

363

# `allServices` is a special value that covers all services.

364

},

365

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

366

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

367

# prevent simultaneous updates of a policy from overwriting each other.

368

# It is strongly suggested that systems make use of the `etag` in the

369

# read-modify-write cycle to perform policy updates in order to avoid race

370

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

371

# systems are expected to put that etag in the request to `setIamPolicy` to

372

# ensure that their change will be applied to the same version of the policy.

373

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

374

# **Important:** If you use IAM Conditions, you must include the `etag` field

375

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

376

# you to overwrite a version `3` policy with a version `1` policy, and all of

377

# the conditions in the version `3` policy are lost.

378

"version": 42, # Specifies the format of the policy.

379

#

380

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

381

# are rejected.

382

#

383

# Any operation that affects conditional role bindings must specify version

384

# `3`. This requirement applies to the following operations:

385

#

386

# * Getting a policy that includes a conditional role binding

387

# * Adding a conditional role binding to a policy

388

# * Changing a conditional role binding in a policy

389

# * Removing any role binding, with or without a condition, from a policy

390

# that includes conditions

391

#

392

# **Important:** If you use IAM Conditions, you must include the `etag` field

393

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

394

# you to overwrite a version `3` policy with a version `1` policy, and all of

395

# the conditions in the version `3` policy are lost.

396

#

397

# If a policy does not include any conditions, operations on that policy may

398

# specify any valid version or leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

403

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

404

<pre>Sets the access control policy on the specified resource. Replaces any

405

existing policy.

406

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

407

Can return Public Errors: NOT_FOUND, INVALID_ARGUMENT and PERMISSION_DENIED

408

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

409

Args:

410

resource: string, REQUIRED: The resource for which the policy is being specified.

411

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

412

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

413

The object takes the form of:

414

415

{ # Request message for `SetIamPolicy` method.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

416

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

417

# the policy is limited to a few 10s of KB. An empty policy is a

418

# valid policy but certain Cloud Platform services (such as Projects)

419

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

420

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

421

#

422

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

423

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

424

# `members` to a single `role`. Members can be user accounts, service accounts,

425

# Google groups, and domains (such as G Suite). A `role` is a named list of

426

# permissions; each `role` can be an IAM predefined role or a user-created

427

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

428

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

429

# Optionally, a `binding` can specify a `condition`, which is a logical

430

# expression that allows access to a resource only if the expression evaluates

431

# to `true`. A condition can add constraints based on attributes of the

432

# request, the resource, or both.

433

#

434

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

439

# "role": "roles/resourcemanager.organizationAdmin",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

440

# "members": [

441

# "user:mike@example.com",

442

# "group:admins@example.com",

443

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

444

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

445

# ]

446

# },

447

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

448

# "role": "roles/resourcemanager.organizationViewer",

449

# "members": ["user:eve@example.com"],

450

# "condition": {

451

# "title": "expirable access",

452

# "description": "Does not grant access after Sep 2020",

453

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

454

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

455

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

456

# ],

457

# "etag": "BwWWja0YfJA=",

458

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

459

# }

460

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

461

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

466

# - group:admins@example.com

467

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

468

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

469

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

470

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

471

# - user:eve@example.com

472

# role: roles/resourcemanager.organizationViewer

473

# condition:

474

# title: expirable access

475

# description: Does not grant access after Sep 2020

476

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

477

# - etag: BwWWja0YfJA=

478

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

479

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

480

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

481

# [IAM documentation](https://cloud.google.com/iam/docs/).

482

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

483

# `condition` that determines how and when the `bindings` are applied. Each

484

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

485

{ # Associates `members` with a `role`.

486

"role": "A String", # Role that is assigned to `members`.

487

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

488

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

489

# NOTE: An unsatisfied condition will not allow user access via current

490

# binding. Different bindings, including their conditions, are examined

491

# independently.

492

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

493

# are documented at https://github.com/google/cel-spec.

494

#

495

# Example (Comparison):

496

#

497

# title: "Summary size limit"

498

# description: "Determines if a summary is less than 100 chars"

499

# expression: "document.summary.size() < 100"

500

#

501

# Example (Equality):

502

#

503

# title: "Requestor is owner"

504

# description: "Determines if requestor is the document owner"

505

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

510

# description: "Determine whether the document should be publicly visible"

511

# expression: "document.type != 'private' && document.type != 'internal'"

512

#

513

# Example (Data Manipulation):

514

#

515

# title: "Notification string"

516

# description: "Create a notification string with a timestamp."

517

# expression: "'New message received at ' + string(document.create_time)"

518

#

519

# The exact variables and functions that may be referenced within an expression

520

# are determined by the service that evaluates it. See the service

521

# documentation for additional information.

522

"description": "A String", # Optional. Description of the expression. This is a longer text which

523

# describes the expression, e.g. when hovered over it in a UI.

524

"expression": "A String", # Textual representation of an expression in Common Expression Language

525

# syntax.

526

"location": "A String", # Optional. String indicating the location of the expression for error

527

# reporting, e.g. a file name and a position in the file.

528

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

529

# its purpose. This can be used e.g. in UIs which allow to enter the

530

# expression.

531

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

532

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

533

# `members` can have the following values:

534

#

535

# * `allUsers`: A special identifier that represents anyone who is

536

# on the internet; with or without a Google account.

537

#

538

# * `allAuthenticatedUsers`: A special identifier that represents anyone

539

# who is authenticated with a Google account or a service account.

540

#

541

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

542

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

543

#

544

#

545

# * `serviceAccount:{emailid}`: An email address that represents a service

546

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

547

#

548

# * `group:{emailid}`: An email address that represents a Google group.

549

# For example, `admins@example.com`.

550

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

551

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

552

# identifier) representing a user that has been recently deleted. For

553

# example, `alice@example.com?uid=123456789012345678901`. If the user is

554

# recovered, this value reverts to `user:{emailid}` and the recovered user

555

# retains the role in the binding.

556

#

557

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

558

# unique identifier) representing a service account that has been recently

559

# deleted. For example,

560

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

561

# If the service account is undeleted, this value reverts to

562

# `serviceAccount:{emailid}` and the undeleted service account retains the

563

# role in the binding.

564

#

565

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

566

# identifier) representing a Google group that has been recently

567

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

568

# the group is recovered, this value reverts to `group:{emailid}` and the

569

# recovered group retains the role in the binding.

570

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

571

#

572

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

573

# users of that domain. For example, `google.com` or `example.com`.

574

#

575

"A String",

576

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

577

},

578

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

579

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

580

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

581

# The configuration determines which permission types are logged, and what

582

# identities, if any, are exempted from logging.

583

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

584

#

585

# If there are AuditConfigs for both `allServices` and a specific service,

586

# the union of the two AuditConfigs is used for that service: the log_types

587

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

588

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

589

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

590

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

591

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

592

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

593

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

594

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

595

# "service": "allServices"

596

# "audit_log_configs": [

597

# {

598

# "log_type": "DATA_READ",

599

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

600

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

605

# },

606

# {

607

# "log_type": "ADMIN_READ",

608

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

609

# ]

610

# },

611

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

612

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

613

# "audit_log_configs": [

614

# {

615

# "log_type": "DATA_READ",

616

# },

617

# {

618

# "log_type": "DATA_WRITE",

619

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

620

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

621

# ]

622

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

627

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

628

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

629

# logging. It also exempts jose@example.com from DATA_READ logging, and

630

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

631

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

632

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

637

# {

638

# "log_type": "DATA_READ",

639

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

640

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

650

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

651

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

652

# permission.

653

# Follows the same format of Binding.members.

654

"A String",

655

],

656

"logType": "A String", # The log type that this config enables.

657

},

658

],

659

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

660

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

661

# `allServices` is a special value that covers all services.

662

},

663

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

664

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

665

# prevent simultaneous updates of a policy from overwriting each other.

666

# It is strongly suggested that systems make use of the `etag` in the

667

# read-modify-write cycle to perform policy updates in order to avoid race

668

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

669

# systems are expected to put that etag in the request to `setIamPolicy` to

670

# ensure that their change will be applied to the same version of the policy.

671

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

672

# **Important:** If you use IAM Conditions, you must include the `etag` field

673

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

674

# you to overwrite a version `3` policy with a version `1` policy, and all of

675

# the conditions in the version `3` policy are lost.

676

"version": 42, # Specifies the format of the policy.

677

#

678

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

679

# are rejected.

680

#

681

# Any operation that affects conditional role bindings must specify version

682

# `3`. This requirement applies to the following operations:

683

#

684

# * Getting a policy that includes a conditional role binding

685

# * Adding a conditional role binding to a policy

686

# * Changing a conditional role binding in a policy

687

# * Removing any role binding, with or without a condition, from a policy

688

# that includes conditions

689

#

690

# **Important:** If you use IAM Conditions, you must include the `etag` field

691

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

692

# you to overwrite a version `3` policy with a version `1` policy, and all of

693

# the conditions in the version `3` policy are lost.

694

#

695

# If a policy does not include any conditions, operations on that policy may

696

# specify any valid version or leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

697

},

698

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

699

# the fields in the mask will be modified. If no mask is provided, the

700

# following default mask is used:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

701

# paths: "bindings, etag"

702

# This field is only used by Cloud IAM.

703

}

704

705

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

712

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

713

{ # An Identity and Access Management (IAM) policy, which specifies access

714

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

715

#

716

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

717

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

718

# `members` to a single `role`. Members can be user accounts, service accounts,

719

# Google groups, and domains (such as G Suite). A `role` is a named list of

720

# permissions; each `role` can be an IAM predefined role or a user-created

721

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

722

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

723

# Optionally, a `binding` can specify a `condition`, which is a logical

724

# expression that allows access to a resource only if the expression evaluates

725

# to `true`. A condition can add constraints based on attributes of the

726

# request, the resource, or both.

727

#

728

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

733

# "role": "roles/resourcemanager.organizationAdmin",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

734

# "members": [

735

# "user:mike@example.com",

736

# "group:admins@example.com",

737

# "domain:google.com",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

738

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

739

# ]

740

# },

741

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

742

# "role": "roles/resourcemanager.organizationViewer",

743

# "members": ["user:eve@example.com"],

744

# "condition": {

745

# "title": "expirable access",

746

# "description": "Does not grant access after Sep 2020",

747

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

748

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

749

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

750

# ],

751

# "etag": "BwWWja0YfJA=",

752

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

753

# }

754

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

755

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

760

# - group:admins@example.com

761

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

762

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

763

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

764

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

765

# - user:eve@example.com

766

# role: roles/resourcemanager.organizationViewer

767

# condition:

768

# title: expirable access

769

# description: Does not grant access after Sep 2020

770

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

771

# - etag: BwWWja0YfJA=

772

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

773

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

774

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

775

# [IAM documentation](https://cloud.google.com/iam/docs/).

776

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

777

# `condition` that determines how and when the `bindings` are applied. Each

778

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

779

{ # Associates `members` with a `role`.

780

"role": "A String", # Role that is assigned to `members`.

781

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

782

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

783

# NOTE: An unsatisfied condition will not allow user access via current

784

# binding. Different bindings, including their conditions, are examined

785

# independently.

786

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

787

# are documented at https://github.com/google/cel-spec.

788

#

789

# Example (Comparison):

790

#

791

# title: "Summary size limit"

792

# description: "Determines if a summary is less than 100 chars"

793

# expression: "document.summary.size() < 100"

794

#

795

# Example (Equality):

796

#

797

# title: "Requestor is owner"

798

# description: "Determines if requestor is the document owner"

799

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

804

# description: "Determine whether the document should be publicly visible"

805

# expression: "document.type != 'private' && document.type != 'internal'"

806

#

807

# Example (Data Manipulation):

808

#

809

# title: "Notification string"

810

# description: "Create a notification string with a timestamp."

811

# expression: "'New message received at ' + string(document.create_time)"

812

#

813

# The exact variables and functions that may be referenced within an expression

814

# are determined by the service that evaluates it. See the service

815

# documentation for additional information.

816

"description": "A String", # Optional. Description of the expression. This is a longer text which

817

# describes the expression, e.g. when hovered over it in a UI.

818

"expression": "A String", # Textual representation of an expression in Common Expression Language

819

# syntax.

820

"location": "A String", # Optional. String indicating the location of the expression for error

821

# reporting, e.g. a file name and a position in the file.

822

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

823

# its purpose. This can be used e.g. in UIs which allow to enter the

824

# expression.

825

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

826

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

827

# `members` can have the following values:

828

#

829

# * `allUsers`: A special identifier that represents anyone who is

830

# on the internet; with or without a Google account.

831

#

832

# * `allAuthenticatedUsers`: A special identifier that represents anyone

833

# who is authenticated with a Google account or a service account.

834

#

835

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

836

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

837

#

838

#

839

# * `serviceAccount:{emailid}`: An email address that represents a service

840

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

841

#

842

# * `group:{emailid}`: An email address that represents a Google group.

843

# For example, `admins@example.com`.

844

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

845

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

846

# identifier) representing a user that has been recently deleted. For

847

# example, `alice@example.com?uid=123456789012345678901`. If the user is

848

# recovered, this value reverts to `user:{emailid}` and the recovered user

849

# retains the role in the binding.

850

#

851

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

852

# unique identifier) representing a service account that has been recently

853

# deleted. For example,

854

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

855

# If the service account is undeleted, this value reverts to

856

# `serviceAccount:{emailid}` and the undeleted service account retains the

857

# role in the binding.

858

#

859

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

860

# identifier) representing a Google group that has been recently

861

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

862

# the group is recovered, this value reverts to `group:{emailid}` and the

863

# recovered group retains the role in the binding.

864

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

865

#

866

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

867

# users of that domain. For example, `google.com` or `example.com`.

868

#

869

"A String",

870

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

871

},

872

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

873

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

874

{ # Specifies the audit configuration for a service.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

875

# The configuration determines which permission types are logged, and what

876

# identities, if any, are exempted from logging.

877

# An AuditConfig must have one or more AuditLogConfigs.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

878

#

879

# If there are AuditConfigs for both `allServices` and a specific service,

880

# the union of the two AuditConfigs is used for that service: the log_types

881

# specified in each AuditConfig are enabled, and the exempted_members in each

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

882

# AuditLogConfig are exempted.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

883

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

884

# Example Policy with multiple AuditConfigs:

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

885

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

886

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

887

# "audit_configs": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

888

# {

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

889

# "service": "allServices"

890

# "audit_log_configs": [

891

# {

892

# "log_type": "DATA_READ",

893

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

894

# "user:jose@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

899

# },

900

# {

901

# "log_type": "ADMIN_READ",

902

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

903

# ]

904

# },

905

# {

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

906

# "service": "sampleservice.googleapis.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

907

# "audit_log_configs": [

908

# {

909

# "log_type": "DATA_READ",

910

# },

911

# {

912

# "log_type": "DATA_WRITE",

913

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

914

# "user:aliya@example.com"

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

915

# ]

916

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# }

# ]

# }

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

921

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

922

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

923

# logging. It also exempts jose@example.com from DATA_READ logging, and

924

# aliya@example.com from DATA_WRITE logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

925

"auditLogConfigs": [ # The configuration for logging of each type of permission.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

926

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

931

# {

932

# "log_type": "DATA_READ",

933

# "exempted_members": [

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

934

# "user:jose@example.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

944

# jose@example.com from DATA_READ logging.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

945

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

946

# permission.

947

# Follows the same format of Binding.members.

948

"A String",

949

],

950

"logType": "A String", # The log type that this config enables.

951

},

952

],

953

"service": "A String", # Specifies a service that will be enabled for audit logging.

Sai Cheemalapati

2017-06-06 18:46:08 -0400

[diff] [blame]

954

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

955

# `allServices` is a special value that covers all services.

956

},

957

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

958

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

959

# prevent simultaneous updates of a policy from overwriting each other.

960

# It is strongly suggested that systems make use of the `etag` in the

961

# read-modify-write cycle to perform policy updates in order to avoid race

962

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

963

# systems are expected to put that etag in the request to `setIamPolicy` to

964

# ensure that their change will be applied to the same version of the policy.

965

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

966

# **Important:** If you use IAM Conditions, you must include the `etag` field

967

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

968

# you to overwrite a version `3` policy with a version `1` policy, and all of

969

# the conditions in the version `3` policy are lost.

970

"version": 42, # Specifies the format of the policy.

971

#

972

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

973

# are rejected.

974

#

975

# Any operation that affects conditional role bindings must specify version

976

# `3`. This requirement applies to the following operations:

977

#

978

# * Getting a policy that includes a conditional role binding

979

# * Adding a conditional role binding to a policy

980

# * Changing a conditional role binding in a policy

981

# * Removing any role binding, with or without a condition, from a policy

982

# that includes conditions

983

#

984

# **Important:** If you use IAM Conditions, you must include the `etag` field

985

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

986

# you to overwrite a version `3` policy with a version `1` policy, and all of

987

# the conditions in the version `3` policy are lost.

988

#

989

# If a policy does not include any conditions, operations on that policy may

990

# specify any valid version or leave the field unset.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

995

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

996

<pre>Returns permissions that a caller has on the specified resource.

997

If the resource does not exist, this will return an empty set of

998

permissions, not a NOT_FOUND error.

999

1000

Note: This operation is designed to be used for building permission-aware

1001

UIs and command-line tools, not for authorization checking. This operation

1002

may "fail open" without warning.

1003

1004

Args:

1005

resource: string, REQUIRED: The resource for which the policy detail is being requested.

1006

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

1007

body: object, The request body.

Sai Cheemalapati