Blame - docs/dyn/cloudresourcemanager_v1.folders.html - platform/external/python/google-api-python-client

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

340

# resource.

341

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

342

# configuration is acceptable.

343

#

344

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

345

# with `constraint_default` set to `ALLOW`. A `Policy` for that

346

# `Constraint` exhibits the following behavior:

347

# - If the `Policy` at this resource has enforced set to `false`, serial

348

# port connection attempts will be allowed.

349

# - If the `Policy` at this resource has enforced set to `true`, serial

350

# port connection attempts will be refused.

351

# - If the `Policy` at this resource is `RestoreDefault`, serial port

352

# connection attempts will be allowed.

353

# - If no `Policy` is set at this resource or anywhere higher in the

354

# resource hierarchy, serial port connection attempts will be allowed.

355

# - If no `Policy` is set at this resource, but one exists higher in the

356

# resource hierarchy, the behavior is as if the`Policy` were set at

357

# this resource.

358

#

359

# The following examples demonstrate the different possible layerings:

360

#

361

# Example 1 (nearest `Constraint` wins):

362

# `organizations/foo` has a `Policy` with:

363

# {enforced: false}

364

# `projects/bar` has no `Policy` set.

365

# The constraint at `projects/bar` and `organizations/foo` will not be

366

# enforced.

367

#

368

# Example 2 (enforcement gets replaced):

369

# `organizations/foo` has a `Policy` with:

370

# {enforced: false}

371

# `projects/bar` has a `Policy` with:

372

# {enforced: true}

373

# The constraint at `organizations/foo` is not enforced.

374

# The constraint at `projects/bar` is enforced.

375

#

376

# Example 3 (RestoreDefault):

377

# `organizations/foo` has a `Policy` with:

378

# {enforced: true}

379

# `projects/bar` has a `Policy` with:

380

# {RestoreDefault: {}}

381

# The constraint at `organizations/foo` is enforced.

382

# The constraint at `projects/bar` is not enforced, because

383

# `constraint_default` for the `Constraint` is `ALLOW`.

384

},

385

"version": 42, # Version of the `Policy`. Default version is 0;

386

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

387

# concurrency control.

388

#

389

# When the `Policy` is returned from either a `GetPolicy` or a

390

# `ListOrgPolicy` request, this `etag` indicates the version of the current

391

# `Policy` to use when executing a read-modify-write loop.

392

#

393

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

394

# `etag` will be unset.

395

#

396

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

397

# that was returned from a `GetOrgPolicy` request as part of a

398

# read-modify-write loop for concurrency control. Not setting the `etag`in a

399

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="getEffectiveOrgPolicyV1">getEffectiveOrgPolicyV1(resource, body, x__xgafv=None)</code>

406

<pre>Gets the effective `Policy` on a resource. This is the result of merging

407

`Policies` in the resource hierarchy. The returned `Policy` will not have

408

an `etag`set because it is a computed `Policy` across multiple resources.

409

410

Args:

411

resource: string, The name of the resource to start computing the effective `Policy`. (required)

412

body: object, The request body. (required)

413

The object takes the form of:

414

415

{ # The request sent to the GetEffectiveOrgPolicy method.

416

"constraint": "A String", # The name of the `Constraint` to compute the effective `Policy`.

417

}

418

419

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

426

427

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

428

# for configurations of Cloud Platform resources.

429

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

430

# server, not specified by the caller, and represents the last time a call to

431

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

432

# be ignored.

433

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

434

# `constraints/serviceuser.services`.

435

#

436

# Immutable after creation.

437

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

438

# `Constraint` type.

439

# `constraint_default` enforcement behavior of the specific `Constraint` at

440

# this resource.

441

#

442

# Suppose that `constraint_default` is set to `ALLOW` for the

443

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

444

# foo.com sets a `Policy` at their Organization resource node that restricts

445

# the allowed service activations to deny all service activations. They

446

# could then set a `Policy` with the `policy_type` `restore_default` on

447

# several experimental projects, restoring the `constraint_default`

448

# enforcement of the `Constraint` for only those projects, allowing those

449

# projects to have all services activated.

450

},

451

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

452

# resource.

453

#

454

# A `ListPolicy` can define specific values that are allowed or denied by

455

# setting either the `allowed_values` or `denied_values` fields. It can also

456

# be used to allow or deny all values, by setting the `all_values` field. If

457

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

458

# or `denied_values` must be set (attempting to set both or neither will

459

# result in a failed request). If `all_values` is set to either `ALLOW` or

460

# `DENY`, `allowed_values` and `denied_values` must be unset.

461

"allValues": "A String", # The policy all_values state.

462

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

463

# set for `allowed_values` and `all_values` is set to

464

# `ALL_VALUES_UNSPECIFIED`.

465

"A String",

466

],

467

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

468

#

469

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

470

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

471

# set to `true`, then the values from the effective `Policy` of the parent

472

# resource are inherited, meaning the values set in this `Policy` are

473

# added to the values inherited up the hierarchy.

474

#

475

# Setting `Policy` hierarchies that inherit both allowed values and denied

476

# values isn't recommended in most circumstances to keep the configuration

477

# simple and understandable. However, it is possible to set a `Policy` with

478

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

479

# In this case, the values that are allowed must be in `allowed_values` and

480

# not present in `denied_values`.

481

#

482

# For example, suppose you have a `Constraint`

483

# `constraints/serviceuser.services`, which has a `constraint_type` of

484

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

485

# Suppose that at the Organization level, a `Policy` is applied that

486

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

487

# `Policy` is applied to a project below the Organization that has

488

# `inherit_from_parent` set to `false` and field all_values set to DENY,

489

# then an attempt to activate any API will be denied.

490

#

491

# The following examples demonstrate different possible layerings:

492

#

493

# Example 1 (no inherited values):

494

# `organizations/foo` has a `Policy` with values:

495

# {allowed_values: “E1” allowed_values:”E2”}

496

# ``projects/bar`` has `inherit_from_parent` `false` and values:

497

# {allowed_values: "E3" allowed_values: "E4"}

498

# The accepted values at `organizations/foo` are `E1`, `E2`.

499

# The accepted values at `projects/bar` are `E3`, and `E4`.

500

#

501

# Example 2 (inherited values):

502

# `organizations/foo` has a `Policy` with values:

503

# {allowed_values: “E1” allowed_values:”E2”}

504

# `projects/bar` has a `Policy` with values:

505

# {value: “E3” value: ”E4” inherit_from_parent: true}

506

# The accepted values at `organizations/foo` are `E1`, `E2`.

507

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

508

#

509

# Example 3 (inheriting both allowed and denied values):

510

# `organizations/foo` has a `Policy` with values:

511

# {allowed_values: "E1" allowed_values: "E2"}

512

# `projects/bar` has a `Policy` with:

513

# {denied_values: "E1"}

514

# The accepted values at `organizations/foo` are `E1`, `E2`.

515

# The value accepted at `projects/bar` is `E2`.

516

#

517

# Example 4 (RestoreDefault):

518

# `organizations/foo` has a `Policy` with values:

519

# {allowed_values: “E1” allowed_values:”E2”}

520

# `projects/bar` has a `Policy` with values:

521

# {RestoreDefault: {}}

522

# The accepted values at `organizations/foo` are `E1`, `E2`.

523

# The accepted values at `projects/bar` are either all or none depending on

524

# the value of `constraint_default` (if `ALLOW`, all; if

525

# `DENY`, none).

526

#

527

# Example 5 (no policy inherits parent policy):

528

# `organizations/foo` has no `Policy` set.

529

# `projects/bar` has no `Policy` set.

530

# The accepted values at both levels are either all or none depending on

531

# the value of `constraint_default` (if `ALLOW`, all; if

532

# `DENY`, none).

533

#

534

# Example 6 (ListConstraint allowing all):

535

# `organizations/foo` has a `Policy` with values:

536

# {allowed_values: “E1” allowed_values: ”E2”}

537

# `projects/bar` has a `Policy` with:

538

# {all: ALLOW}

539

# The accepted values at `organizations/foo` are `E1`, E2`.

540

# Any value is accepted at `projects/bar`.

541

#

542

# Example 7 (ListConstraint allowing none):

543

# `organizations/foo` has a `Policy` with values:

544

# {allowed_values: “E1” allowed_values: ”E2”}

545

# `projects/bar` has a `Policy` with:

546

# {all: DENY}

547

# The accepted values at `organizations/foo` are `E1`, E2`.

548

# No value is accepted at `projects/bar`.

549

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

550

# that matches the value specified in this `Policy`. If `suggested_value`

551

# is not set, it will inherit the value specified higher in the hierarchy,

552

# unless `inherit_from_parent` is `false`.

553

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

554

# set for `denied_values` and `all_values` is set to

555

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

560

# resource.

561

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

562

# configuration is acceptable.

563

#

564

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

565

# with `constraint_default` set to `ALLOW`. A `Policy` for that

566

# `Constraint` exhibits the following behavior:

567

# - If the `Policy` at this resource has enforced set to `false`, serial

568

# port connection attempts will be allowed.

569

# - If the `Policy` at this resource has enforced set to `true`, serial

570

# port connection attempts will be refused.

571

# - If the `Policy` at this resource is `RestoreDefault`, serial port

572

# connection attempts will be allowed.

573

# - If no `Policy` is set at this resource or anywhere higher in the

574

# resource hierarchy, serial port connection attempts will be allowed.

575

# - If no `Policy` is set at this resource, but one exists higher in the

576

# resource hierarchy, the behavior is as if the`Policy` were set at

577

# this resource.

578

#

579

# The following examples demonstrate the different possible layerings:

580

#

581

# Example 1 (nearest `Constraint` wins):

582

# `organizations/foo` has a `Policy` with:

583

# {enforced: false}

584

# `projects/bar` has no `Policy` set.

585

# The constraint at `projects/bar` and `organizations/foo` will not be

586

# enforced.

587

#

588

# Example 2 (enforcement gets replaced):

589

# `organizations/foo` has a `Policy` with:

590

# {enforced: false}

591

# `projects/bar` has a `Policy` with:

592

# {enforced: true}

593

# The constraint at `organizations/foo` is not enforced.

594

# The constraint at `projects/bar` is enforced.

595

#

596

# Example 3 (RestoreDefault):

597

# `organizations/foo` has a `Policy` with:

598

# {enforced: true}

599

# `projects/bar` has a `Policy` with:

600

# {RestoreDefault: {}}

601

# The constraint at `organizations/foo` is enforced.

602

# The constraint at `projects/bar` is not enforced, because

603

# `constraint_default` for the `Constraint` is `ALLOW`.

604

},

605

"version": 42, # Version of the `Policy`. Default version is 0;

606

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

607

# concurrency control.

608

#

609

# When the `Policy` is returned from either a `GetPolicy` or a

610

# `ListOrgPolicy` request, this `etag` indicates the version of the current

611

# `Policy` to use when executing a read-modify-write loop.

612

#

613

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

614

# `etag` will be unset.

615

#

616

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

617

# that was returned from a `GetOrgPolicy` request as part of a

618

# read-modify-write loop for concurrency control. Not setting the `etag`in a

619

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="getOrgPolicy">getOrgPolicy(resource, body, x__xgafv=None)</code>

626

<pre>Gets a `Policy` on a resource.

627

628

If no `Policy` is set on the resource, a `Policy` is returned with default

629

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

630

`etag` value can be used with `SetOrgPolicy()` to create or update a

631

`Policy` during read-modify-write.

632

633

Args:

634

resource: string, Name of the resource the `Policy` is set on. (required)

635

body: object, The request body. (required)

636

The object takes the form of:

637

638

{ # The request sent to the GetOrgPolicy method.

639

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

640

}

641

642

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

649

650

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

651

# for configurations of Cloud Platform resources.

652

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

653

# server, not specified by the caller, and represents the last time a call to

654

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

655

# be ignored.

656

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

657

# `constraints/serviceuser.services`.

658

#

659

# Immutable after creation.

660

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

661

# `Constraint` type.

662

# `constraint_default` enforcement behavior of the specific `Constraint` at

663

# this resource.

664

#

665

# Suppose that `constraint_default` is set to `ALLOW` for the

666

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

667

# foo.com sets a `Policy` at their Organization resource node that restricts

668

# the allowed service activations to deny all service activations. They

669

# could then set a `Policy` with the `policy_type` `restore_default` on

670

# several experimental projects, restoring the `constraint_default`

671

# enforcement of the `Constraint` for only those projects, allowing those

672

# projects to have all services activated.

673

},

674

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

675

# resource.

676

#

677

# A `ListPolicy` can define specific values that are allowed or denied by

678

# setting either the `allowed_values` or `denied_values` fields. It can also

679

# be used to allow or deny all values, by setting the `all_values` field. If

680

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

681

# or `denied_values` must be set (attempting to set both or neither will

682

# result in a failed request). If `all_values` is set to either `ALLOW` or

683

# `DENY`, `allowed_values` and `denied_values` must be unset.

684

"allValues": "A String", # The policy all_values state.

685

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

686

# set for `allowed_values` and `all_values` is set to

687

# `ALL_VALUES_UNSPECIFIED`.

688

"A String",

689

],

690

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

691

#

692

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

693

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

694

# set to `true`, then the values from the effective `Policy` of the parent

695

# resource are inherited, meaning the values set in this `Policy` are

696

# added to the values inherited up the hierarchy.

697

#

698

# Setting `Policy` hierarchies that inherit both allowed values and denied

699

# values isn't recommended in most circumstances to keep the configuration

700

# simple and understandable. However, it is possible to set a `Policy` with

701

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

702

# In this case, the values that are allowed must be in `allowed_values` and

703

# not present in `denied_values`.

704

#

705

# For example, suppose you have a `Constraint`

706

# `constraints/serviceuser.services`, which has a `constraint_type` of

707

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

708

# Suppose that at the Organization level, a `Policy` is applied that

709

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

710

# `Policy` is applied to a project below the Organization that has

711

# `inherit_from_parent` set to `false` and field all_values set to DENY,

712

# then an attempt to activate any API will be denied.

713

#

714

# The following examples demonstrate different possible layerings:

715

#

716

# Example 1 (no inherited values):

717

# `organizations/foo` has a `Policy` with values:

718

# {allowed_values: “E1” allowed_values:”E2”}

719

# ``projects/bar`` has `inherit_from_parent` `false` and values:

720

# {allowed_values: "E3" allowed_values: "E4"}

721

# The accepted values at `organizations/foo` are `E1`, `E2`.

722

# The accepted values at `projects/bar` are `E3`, and `E4`.

723

#

724

# Example 2 (inherited values):

725

# `organizations/foo` has a `Policy` with values:

726

# {allowed_values: “E1” allowed_values:”E2”}

727

# `projects/bar` has a `Policy` with values:

728

# {value: “E3” value: ”E4” inherit_from_parent: true}

729

# The accepted values at `organizations/foo` are `E1`, `E2`.

730

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

731

#

732

# Example 3 (inheriting both allowed and denied values):

733

# `organizations/foo` has a `Policy` with values:

734

# {allowed_values: "E1" allowed_values: "E2"}

735

# `projects/bar` has a `Policy` with:

736

# {denied_values: "E1"}

737

# The accepted values at `organizations/foo` are `E1`, `E2`.

738

# The value accepted at `projects/bar` is `E2`.

739

#

740

# Example 4 (RestoreDefault):

741

# `organizations/foo` has a `Policy` with values:

742

# {allowed_values: “E1” allowed_values:”E2”}

743

# `projects/bar` has a `Policy` with values:

744

# {RestoreDefault: {}}

745

# The accepted values at `organizations/foo` are `E1`, `E2`.

746

# The accepted values at `projects/bar` are either all or none depending on

747

# the value of `constraint_default` (if `ALLOW`, all; if

748

# `DENY`, none).

749

#

750

# Example 5 (no policy inherits parent policy):

751

# `organizations/foo` has no `Policy` set.

752

# `projects/bar` has no `Policy` set.

753

# The accepted values at both levels are either all or none depending on

754

# the value of `constraint_default` (if `ALLOW`, all; if

755

# `DENY`, none).

756

#

757

# Example 6 (ListConstraint allowing all):

758

# `organizations/foo` has a `Policy` with values:

759

# {allowed_values: “E1” allowed_values: ”E2”}

760

# `projects/bar` has a `Policy` with:

761

# {all: ALLOW}

762

# The accepted values at `organizations/foo` are `E1`, E2`.

763

# Any value is accepted at `projects/bar`.

764

#

765

# Example 7 (ListConstraint allowing none):

766

# `organizations/foo` has a `Policy` with values:

767

# {allowed_values: “E1” allowed_values: ”E2”}

768

# `projects/bar` has a `Policy` with:

769

# {all: DENY}

770

# The accepted values at `organizations/foo` are `E1`, E2`.

771

# No value is accepted at `projects/bar`.

772

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

773

# that matches the value specified in this `Policy`. If `suggested_value`

774

# is not set, it will inherit the value specified higher in the hierarchy,

775

# unless `inherit_from_parent` is `false`.

776

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

777

# set for `denied_values` and `all_values` is set to

778

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

783

# resource.

784

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

785

# configuration is acceptable.

786

#

787

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

788

# with `constraint_default` set to `ALLOW`. A `Policy` for that

789

# `Constraint` exhibits the following behavior:

790

# - If the `Policy` at this resource has enforced set to `false`, serial

791

# port connection attempts will be allowed.

792

# - If the `Policy` at this resource has enforced set to `true`, serial

793

# port connection attempts will be refused.

794

# - If the `Policy` at this resource is `RestoreDefault`, serial port

795

# connection attempts will be allowed.

796

# - If no `Policy` is set at this resource or anywhere higher in the

797

# resource hierarchy, serial port connection attempts will be allowed.

798

# - If no `Policy` is set at this resource, but one exists higher in the

799

# resource hierarchy, the behavior is as if the`Policy` were set at

800

# this resource.

801

#

802

# The following examples demonstrate the different possible layerings:

803

#

804

# Example 1 (nearest `Constraint` wins):

805

# `organizations/foo` has a `Policy` with:

806

# {enforced: false}

807

# `projects/bar` has no `Policy` set.

808

# The constraint at `projects/bar` and `organizations/foo` will not be

809

# enforced.

810

#

811

# Example 2 (enforcement gets replaced):

812

# `organizations/foo` has a `Policy` with:

813

# {enforced: false}

814

# `projects/bar` has a `Policy` with:

815

# {enforced: true}

816

# The constraint at `organizations/foo` is not enforced.

817

# The constraint at `projects/bar` is enforced.

818

#

819

# Example 3 (RestoreDefault):

820

# `organizations/foo` has a `Policy` with:

821

# {enforced: true}

822

# `projects/bar` has a `Policy` with:

823

# {RestoreDefault: {}}

824

# The constraint at `organizations/foo` is enforced.

825

# The constraint at `projects/bar` is not enforced, because

826

# `constraint_default` for the `Constraint` is `ALLOW`.

827

},

828

"version": 42, # Version of the `Policy`. Default version is 0;

829

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

830

# concurrency control.

831

#

832

# When the `Policy` is returned from either a `GetPolicy` or a

833

# `ListOrgPolicy` request, this `etag` indicates the version of the current

834

# `Policy` to use when executing a read-modify-write loop.

835

#

836

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

837

# `etag` will be unset.

838

#

839

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

840

# that was returned from a `GetOrgPolicy` request as part of a

841

# read-modify-write loop for concurrency control. Not setting the `etag`in a

842

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="getOrgPolicyV1">getOrgPolicyV1(resource, body, x__xgafv=None)</code>

849

<pre>Gets a `Policy` on a resource.

850

851

If no `Policy` is set on the resource, a `Policy` is returned with default

852

values including `POLICY_TYPE_NOT_SET` for the `policy_type oneof`. The

853

`etag` value can be used with `SetOrgPolicy()` to create or update a

854

`Policy` during read-modify-write.

855

856

Args:

857

resource: string, Name of the resource the `Policy` is set on. (required)

858

body: object, The request body. (required)

859

The object takes the form of:

860

861

{ # The request sent to the GetOrgPolicy method.

862

"constraint": "A String", # Name of the `Constraint` to get the `Policy`.

863

}

864

865

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

872

873

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

874

# for configurations of Cloud Platform resources.

875

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

876

# server, not specified by the caller, and represents the last time a call to

877

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

878

# be ignored.

879

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

880

# `constraints/serviceuser.services`.

881

#

882

# Immutable after creation.

883

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

884

# `Constraint` type.

885

# `constraint_default` enforcement behavior of the specific `Constraint` at

886

# this resource.

887

#

888

# Suppose that `constraint_default` is set to `ALLOW` for the

889

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

890

# foo.com sets a `Policy` at their Organization resource node that restricts

891

# the allowed service activations to deny all service activations. They

892

# could then set a `Policy` with the `policy_type` `restore_default` on

893

# several experimental projects, restoring the `constraint_default`

894

# enforcement of the `Constraint` for only those projects, allowing those

895

# projects to have all services activated.

896

},

897

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

898

# resource.

899

#

900

# A `ListPolicy` can define specific values that are allowed or denied by

901

# setting either the `allowed_values` or `denied_values` fields. It can also

902

# be used to allow or deny all values, by setting the `all_values` field. If

903

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

904

# or `denied_values` must be set (attempting to set both or neither will

905

# result in a failed request). If `all_values` is set to either `ALLOW` or

906

# `DENY`, `allowed_values` and `denied_values` must be unset.

907

"allValues": "A String", # The policy all_values state.

908

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

909

# set for `allowed_values` and `all_values` is set to

910

# `ALL_VALUES_UNSPECIFIED`.

911

"A String",

912

],

913

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

914

#

915

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

916

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

917

# set to `true`, then the values from the effective `Policy` of the parent

918

# resource are inherited, meaning the values set in this `Policy` are

919

# added to the values inherited up the hierarchy.

920

#

921

# Setting `Policy` hierarchies that inherit both allowed values and denied

922

# values isn't recommended in most circumstances to keep the configuration

923

# simple and understandable. However, it is possible to set a `Policy` with

924

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

925

# In this case, the values that are allowed must be in `allowed_values` and

926

# not present in `denied_values`.

927

#

928

# For example, suppose you have a `Constraint`

929

# `constraints/serviceuser.services`, which has a `constraint_type` of

930

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

931

# Suppose that at the Organization level, a `Policy` is applied that

932

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

933

# `Policy` is applied to a project below the Organization that has

934

# `inherit_from_parent` set to `false` and field all_values set to DENY,

935

# then an attempt to activate any API will be denied.

936

#

937

# The following examples demonstrate different possible layerings:

938

#

939

# Example 1 (no inherited values):

940

# `organizations/foo` has a `Policy` with values:

941

# {allowed_values: “E1” allowed_values:”E2”}

942

# ``projects/bar`` has `inherit_from_parent` `false` and values:

943

# {allowed_values: "E3" allowed_values: "E4"}

944

# The accepted values at `organizations/foo` are `E1`, `E2`.

945

# The accepted values at `projects/bar` are `E3`, and `E4`.

946

#

947

# Example 2 (inherited values):

948

# `organizations/foo` has a `Policy` with values:

949

# {allowed_values: “E1” allowed_values:”E2”}

950

# `projects/bar` has a `Policy` with values:

951

# {value: “E3” value: ”E4” inherit_from_parent: true}

952

# The accepted values at `organizations/foo` are `E1`, `E2`.

953

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

954

#

955

# Example 3 (inheriting both allowed and denied values):

956

# `organizations/foo` has a `Policy` with values:

957

# {allowed_values: "E1" allowed_values: "E2"}

958

# `projects/bar` has a `Policy` with:

959

# {denied_values: "E1"}

960

# The accepted values at `organizations/foo` are `E1`, `E2`.

961

# The value accepted at `projects/bar` is `E2`.

962

#

963

# Example 4 (RestoreDefault):

964

# `organizations/foo` has a `Policy` with values:

965

# {allowed_values: “E1” allowed_values:”E2”}

966

# `projects/bar` has a `Policy` with values:

967

# {RestoreDefault: {}}

968

# The accepted values at `organizations/foo` are `E1`, `E2`.

969

# The accepted values at `projects/bar` are either all or none depending on

970

# the value of `constraint_default` (if `ALLOW`, all; if

971

# `DENY`, none).

972

#

973

# Example 5 (no policy inherits parent policy):

974

# `organizations/foo` has no `Policy` set.

975

# `projects/bar` has no `Policy` set.

976

# The accepted values at both levels are either all or none depending on

977

# the value of `constraint_default` (if `ALLOW`, all; if

978

# `DENY`, none).

979

#

980

# Example 6 (ListConstraint allowing all):

981

# `organizations/foo` has a `Policy` with values:

982

# {allowed_values: “E1” allowed_values: ”E2”}

983

# `projects/bar` has a `Policy` with:

984

# {all: ALLOW}

985

# The accepted values at `organizations/foo` are `E1`, E2`.

986

# Any value is accepted at `projects/bar`.

987

#

988

# Example 7 (ListConstraint allowing none):

989

# `organizations/foo` has a `Policy` with values:

990

# {allowed_values: “E1” allowed_values: ”E2”}

991

# `projects/bar` has a `Policy` with:

992

# {all: DENY}

993

# The accepted values at `organizations/foo` are `E1`, E2`.

994

# No value is accepted at `projects/bar`.

995

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

996

# that matches the value specified in this `Policy`. If `suggested_value`

997

# is not set, it will inherit the value specified higher in the hierarchy,

998

# unless `inherit_from_parent` is `false`.

999

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1000

# set for `denied_values` and `all_values` is set to

1001

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1006

# resource.

1007

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1008

# configuration is acceptable.

1009

#

1010

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1011

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1012

# `Constraint` exhibits the following behavior:

1013

# - If the `Policy` at this resource has enforced set to `false`, serial

1014

# port connection attempts will be allowed.

1015

# - If the `Policy` at this resource has enforced set to `true`, serial

1016

# port connection attempts will be refused.

1017

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1018

# connection attempts will be allowed.

1019

# - If no `Policy` is set at this resource or anywhere higher in the

1020

# resource hierarchy, serial port connection attempts will be allowed.

1021

# - If no `Policy` is set at this resource, but one exists higher in the

1022

# resource hierarchy, the behavior is as if the`Policy` were set at

1023

# this resource.

1024

#

1025

# The following examples demonstrate the different possible layerings:

1026

#

1027

# Example 1 (nearest `Constraint` wins):

1028

# `organizations/foo` has a `Policy` with:

1029

# {enforced: false}

1030

# `projects/bar` has no `Policy` set.

1031

# The constraint at `projects/bar` and `organizations/foo` will not be

1032

# enforced.

1033

#

1034

# Example 2 (enforcement gets replaced):

1035

# `organizations/foo` has a `Policy` with:

1036

# {enforced: false}

1037

# `projects/bar` has a `Policy` with:

1038

# {enforced: true}

1039

# The constraint at `organizations/foo` is not enforced.

1040

# The constraint at `projects/bar` is enforced.

1041

#

1042

# Example 3 (RestoreDefault):

1043

# `organizations/foo` has a `Policy` with:

1044

# {enforced: true}

1045

# `projects/bar` has a `Policy` with:

1046

# {RestoreDefault: {}}

1047

# The constraint at `organizations/foo` is enforced.

1048

# The constraint at `projects/bar` is not enforced, because

1049

# `constraint_default` for the `Constraint` is `ALLOW`.

1050

},

1051

"version": 42, # Version of the `Policy`. Default version is 0;

1052

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1053

# concurrency control.

1054

#

1055

# When the `Policy` is returned from either a `GetPolicy` or a

1056

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1057

# `Policy` to use when executing a read-modify-write loop.

1058

#

1059

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1060

# `etag` will be unset.

1061

#

1062

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1063

# that was returned from a `GetOrgPolicy` request as part of a

1064

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1065

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints">listAvailableOrgPolicyConstraints(resource, body, x__xgafv=None)</code>

1072

<pre>Lists `Constraints` that could be applied on the specified resource.

1073

1074

Args:

1075

resource: string, Name of the resource to list `Constraints` for. (required)

1076

body: object, The request body. (required)

1077

The object takes the form of:

1078

1079

{ # The request sent to the [ListAvailableOrgPolicyConstraints]

1080

# google.cloud.OrgPolicy.v1.ListAvailableOrgPolicyConstraints] method.

1081

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1082

# and will be ignored. The server may at any point start using this field.

1083

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

1084

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1095

1096

{ # The response returned from the ListAvailableOrgPolicyConstraints method.

1097

# Returns all `Constraints` that could be set at this level of the hierarchy

1098

# (contrast with the response from `ListPolicies`, which returns all policies

1099

# which are set).

1100

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used.

1101

"constraints": [ # The collection of constraints that are settable on the request resource.

1102

{ # A `Constraint` describes a way in which a resource's configuration can be

1103

# restricted. For example, it controls which cloud services can be activated

1104

# across an organization, or whether a Compute Engine instance can have

1105

# serial port connections established. `Constraints` can be configured by the

1106

# organization's policy adminstrator to fit the needs of the organzation by

1107

# setting Policies for `Constraints` at different locations in the

1108

# organization's resource hierarchy. Policies are inherited down the resource

1109

# hierarchy from higher levels, but can also be overridden. For details about

1110

# the inheritance rules please read about

1111

# Policies.

1112

#

1113

# `Constraints` have a default behavior determined by the `constraint_default`

1114

# field, which is the enforcement behavior that is used in the absence of a

1115

# `Policy` being defined or inherited for the resource in question.

1116

"constraintDefault": "A String", # The evaluation behavior of this constraint in the absense of 'Policy'.

1117

"displayName": "A String", # The human readable name.

1118

#

1119

# Mutable.

1120

"name": "A String", # Immutable value, required to globally be unique. For example,

1121

# `constraints/serviceuser.services`

1122

"booleanConstraint": { # A `Constraint` that is either enforced or not. # Defines this constraint as being a BooleanConstraint.

1123

#

1124

# For example a constraint `constraints/compute.disableSerialPortAccess`.

1125

# If it is enforced on a VM instance, serial port connections will not be

1126

# opened to that instance.

1127

},

1128

"version": 42, # Version of the `Constraint`. Default version is 0;

1129

"listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are # Defines this constraint as being a ListConstraint.

1130

# configured by an Organization's policy administrator with a `Policy`.

1131

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1132

# that matches the value specified in this `Constraint`.

1133

},

1134

"description": "A String", # Detailed description of what this `Constraint` controls as well as how and

1135

# where it is enforced.

#

# Mutable.

},

],

}</pre>

</div>

<code class="details" id="listAvailableOrgPolicyConstraints_next">listAvailableOrgPolicyConstraints_next(previous_request, previous_response)</code>

1145

<pre>Retrieves the next page of results.

1146

1147

Args:

1148

previous_request: The request for the previous page. (required)

1149

previous_response: The response from the request for the previous page. (required)

1150

1151

Returns:

1152

A request object that you can call 'execute()' on to request the next

1153

page. Returns None if there are no more items in the collection.

</pre>

</div>

<code class="details" id="listOrgPolicies">listOrgPolicies(resource, body, x__xgafv=None)</code>

1159

<pre>Lists all the `Policies` set for a particular resource.

1160

1161

Args:

1162

resource: string, Name of the resource to list Policies for. (required)

1163

body: object, The request body. (required)

1164

The object takes the form of:

1165

1166

{ # The request sent to the ListOrgPolicies method.

1167

"pageToken": "A String", # Page token used to retrieve the next page. This is currently unsupported

1168

# and will be ignored. The server may at any point start using this field.

1169

"pageSize": 42, # Size of the pages to be returned. This is currently unsupported and will

1170

# be ignored. The server may at any point start using this field to limit

# page size.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1181

1182

{ # The response returned from the ListOrgPolicies method. It will be empty

1183

# if no `Policies` are set on the resource.

1184

"nextPageToken": "A String", # Page token used to retrieve the next page. This is currently not used, but

1185

# the server may at any point start supplying a valid token.

1186

"policies": [ # The `Policies` that are set on the resource. It will be empty if no

1187

# `Policies` are set.

1188

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1189

# for configurations of Cloud Platform resources.

1190

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1191

# server, not specified by the caller, and represents the last time a call to

1192

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1193

# be ignored.

1194

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1195

# `constraints/serviceuser.services`.

1196

#

1197

# Immutable after creation.

1198

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1199

# `Constraint` type.

1200

# `constraint_default` enforcement behavior of the specific `Constraint` at

1201

# this resource.

1202

#

1203

# Suppose that `constraint_default` is set to `ALLOW` for the

1204

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1205

# foo.com sets a `Policy` at their Organization resource node that restricts

1206

# the allowed service activations to deny all service activations. They

1207

# could then set a `Policy` with the `policy_type` `restore_default` on

1208

# several experimental projects, restoring the `constraint_default`

1209

# enforcement of the `Constraint` for only those projects, allowing those

1210

# projects to have all services activated.

1211

},

1212

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1213

# resource.

1214

#

1215

# A `ListPolicy` can define specific values that are allowed or denied by

1216

# setting either the `allowed_values` or `denied_values` fields. It can also

1217

# be used to allow or deny all values, by setting the `all_values` field. If

1218

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1219

# or `denied_values` must be set (attempting to set both or neither will

1220

# result in a failed request). If `all_values` is set to either `ALLOW` or

1221

# `DENY`, `allowed_values` and `denied_values` must be unset.

1222

"allValues": "A String", # The policy all_values state.

1223

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1224

# set for `allowed_values` and `all_values` is set to

1225

# `ALL_VALUES_UNSPECIFIED`.

1226

"A String",

1227

],

1228

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1229

#

1230

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1231

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1232

# set to `true`, then the values from the effective `Policy` of the parent

1233

# resource are inherited, meaning the values set in this `Policy` are

1234

# added to the values inherited up the hierarchy.

1235

#

1236

# Setting `Policy` hierarchies that inherit both allowed values and denied

1237

# values isn't recommended in most circumstances to keep the configuration

1238

# simple and understandable. However, it is possible to set a `Policy` with

1239

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1240

# In this case, the values that are allowed must be in `allowed_values` and

1241

# not present in `denied_values`.

1242

#

1243

# For example, suppose you have a `Constraint`

1244

# `constraints/serviceuser.services`, which has a `constraint_type` of

1245

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1246

# Suppose that at the Organization level, a `Policy` is applied that

1247

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1248

# `Policy` is applied to a project below the Organization that has

1249

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1250

# then an attempt to activate any API will be denied.

1251

#

1252

# The following examples demonstrate different possible layerings:

1253

#

1254

# Example 1 (no inherited values):

1255

# `organizations/foo` has a `Policy` with values:

1256

# {allowed_values: “E1” allowed_values:”E2”}

1257

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1258

# {allowed_values: "E3" allowed_values: "E4"}

1259

# The accepted values at `organizations/foo` are `E1`, `E2`.

1260

# The accepted values at `projects/bar` are `E3`, and `E4`.

1261

#

1262

# Example 2 (inherited values):

1263

# `organizations/foo` has a `Policy` with values:

1264

# {allowed_values: “E1” allowed_values:”E2”}

1265

# `projects/bar` has a `Policy` with values:

1266

# {value: “E3” value: ”E4” inherit_from_parent: true}

1267

# The accepted values at `organizations/foo` are `E1`, `E2`.

1268

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1269

#

1270

# Example 3 (inheriting both allowed and denied values):

1271

# `organizations/foo` has a `Policy` with values:

1272

# {allowed_values: "E1" allowed_values: "E2"}

1273

# `projects/bar` has a `Policy` with:

1274

# {denied_values: "E1"}

1275

# The accepted values at `organizations/foo` are `E1`, `E2`.

1276

# The value accepted at `projects/bar` is `E2`.

1277

#

1278

# Example 4 (RestoreDefault):

1279

# `organizations/foo` has a `Policy` with values:

1280

# {allowed_values: “E1” allowed_values:”E2”}

1281

# `projects/bar` has a `Policy` with values:

1282

# {RestoreDefault: {}}

1283

# The accepted values at `organizations/foo` are `E1`, `E2`.

1284

# The accepted values at `projects/bar` are either all or none depending on

1285

# the value of `constraint_default` (if `ALLOW`, all; if

1286

# `DENY`, none).

1287

#

1288

# Example 5 (no policy inherits parent policy):

1289

# `organizations/foo` has no `Policy` set.

1290

# `projects/bar` has no `Policy` set.

1291

# The accepted values at both levels are either all or none depending on

1292

# the value of `constraint_default` (if `ALLOW`, all; if

1293

# `DENY`, none).

1294

#

1295

# Example 6 (ListConstraint allowing all):

1296

# `organizations/foo` has a `Policy` with values:

1297

# {allowed_values: “E1” allowed_values: ”E2”}

1298

# `projects/bar` has a `Policy` with:

1299

# {all: ALLOW}

1300

# The accepted values at `organizations/foo` are `E1`, E2`.

1301

# Any value is accepted at `projects/bar`.

1302

#

1303

# Example 7 (ListConstraint allowing none):

1304

# `organizations/foo` has a `Policy` with values:

1305

# {allowed_values: “E1” allowed_values: ”E2”}

1306

# `projects/bar` has a `Policy` with:

1307

# {all: DENY}

1308

# The accepted values at `organizations/foo` are `E1`, E2`.

1309

# No value is accepted at `projects/bar`.

1310

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1311

# that matches the value specified in this `Policy`. If `suggested_value`

1312

# is not set, it will inherit the value specified higher in the hierarchy,

1313

# unless `inherit_from_parent` is `false`.

1314

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1315

# set for `denied_values` and `all_values` is set to

1316

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1321

# resource.

1322

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1323

# configuration is acceptable.

1324

#

1325

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1326

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1327

# `Constraint` exhibits the following behavior:

1328

# - If the `Policy` at this resource has enforced set to `false`, serial

1329

# port connection attempts will be allowed.

1330

# - If the `Policy` at this resource has enforced set to `true`, serial

1331

# port connection attempts will be refused.

1332

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1333

# connection attempts will be allowed.

1334

# - If no `Policy` is set at this resource or anywhere higher in the

1335

# resource hierarchy, serial port connection attempts will be allowed.

1336

# - If no `Policy` is set at this resource, but one exists higher in the

1337

# resource hierarchy, the behavior is as if the`Policy` were set at

1338

# this resource.

1339

#

1340

# The following examples demonstrate the different possible layerings:

1341

#

1342

# Example 1 (nearest `Constraint` wins):

1343

# `organizations/foo` has a `Policy` with:

1344

# {enforced: false}

1345

# `projects/bar` has no `Policy` set.

1346

# The constraint at `projects/bar` and `organizations/foo` will not be

1347

# enforced.

1348

#

1349

# Example 2 (enforcement gets replaced):

1350

# `organizations/foo` has a `Policy` with:

1351

# {enforced: false}

1352

# `projects/bar` has a `Policy` with:

1353

# {enforced: true}

1354

# The constraint at `organizations/foo` is not enforced.

1355

# The constraint at `projects/bar` is enforced.

1356

#

1357

# Example 3 (RestoreDefault):

1358

# `organizations/foo` has a `Policy` with:

1359

# {enforced: true}

1360

# `projects/bar` has a `Policy` with:

1361

# {RestoreDefault: {}}

1362

# The constraint at `organizations/foo` is enforced.

1363

# The constraint at `projects/bar` is not enforced, because

1364

# `constraint_default` for the `Constraint` is `ALLOW`.

1365

},

1366

"version": 42, # Version of the `Policy`. Default version is 0;

1367

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1368

# concurrency control.

1369

#

1370

# When the `Policy` is returned from either a `GetPolicy` or a

1371

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1372

# `Policy` to use when executing a read-modify-write loop.

1373

#

1374

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1375

# `etag` will be unset.

1376

#

1377

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1378

# that was returned from a `GetOrgPolicy` request as part of a

1379

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1380

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

],

}</pre>

</div>

<code class="details" id="listOrgPolicies_next">listOrgPolicies_next(previous_request, previous_response)</code>

1389

<pre>Retrieves the next page of results.

1390

1391

Args:

1392

previous_request: The request for the previous page. (required)

1393

previous_response: The response from the request for the previous page. (required)

1394

1395

Returns:

1396

A request object that you can call 'execute()' on to request the next

1397

page. Returns None if there are no more items in the collection.

</pre>

</div>

<code class="details" id="setOrgPolicy">setOrgPolicy(resource, body, x__xgafv=None)</code>

1403

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

1404

that `Constraint` on the resource if one does not exist.

1405

1406

Not supplying an `etag` on the request `Policy` results in an unconditional

1407

write of the `Policy`.

1408

1409

Args:

1410

resource: string, Resource name of the resource to attach the `Policy`. (required)

1411

body: object, The request body. (required)

1412

The object takes the form of:

1413

1414

{ # The request sent to the SetOrgPolicyRequest method.

1415

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

1416

# for configurations of Cloud Platform resources.

1417

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1418

# server, not specified by the caller, and represents the last time a call to

1419

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1420

# be ignored.

1421

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1422

# `constraints/serviceuser.services`.

1423

#

1424

# Immutable after creation.

1425

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1426

# `Constraint` type.

1427

# `constraint_default` enforcement behavior of the specific `Constraint` at

1428

# this resource.

1429

#

1430

# Suppose that `constraint_default` is set to `ALLOW` for the

1431

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1432

# foo.com sets a `Policy` at their Organization resource node that restricts

1433

# the allowed service activations to deny all service activations. They

1434

# could then set a `Policy` with the `policy_type` `restore_default` on

1435

# several experimental projects, restoring the `constraint_default`

1436

# enforcement of the `Constraint` for only those projects, allowing those

1437

# projects to have all services activated.

1438

},

1439

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1440

# resource.

1441

#

1442

# A `ListPolicy` can define specific values that are allowed or denied by

1443

# setting either the `allowed_values` or `denied_values` fields. It can also

1444

# be used to allow or deny all values, by setting the `all_values` field. If

1445

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1446

# or `denied_values` must be set (attempting to set both or neither will

1447

# result in a failed request). If `all_values` is set to either `ALLOW` or

1448

# `DENY`, `allowed_values` and `denied_values` must be unset.

1449

"allValues": "A String", # The policy all_values state.

1450

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1451

# set for `allowed_values` and `all_values` is set to

1452

# `ALL_VALUES_UNSPECIFIED`.

1453

"A String",

1454

],

1455

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1456

#

1457

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1458

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1459

# set to `true`, then the values from the effective `Policy` of the parent

1460

# resource are inherited, meaning the values set in this `Policy` are

1461

# added to the values inherited up the hierarchy.

1462

#

1463

# Setting `Policy` hierarchies that inherit both allowed values and denied

1464

# values isn't recommended in most circumstances to keep the configuration

1465

# simple and understandable. However, it is possible to set a `Policy` with

1466

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1467

# In this case, the values that are allowed must be in `allowed_values` and

1468

# not present in `denied_values`.

1469

#

1470

# For example, suppose you have a `Constraint`

1471

# `constraints/serviceuser.services`, which has a `constraint_type` of

1472

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1473

# Suppose that at the Organization level, a `Policy` is applied that

1474

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1475

# `Policy` is applied to a project below the Organization that has

1476

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1477

# then an attempt to activate any API will be denied.

1478

#

1479

# The following examples demonstrate different possible layerings:

1480

#

1481

# Example 1 (no inherited values):

1482

# `organizations/foo` has a `Policy` with values:

1483

# {allowed_values: “E1” allowed_values:”E2”}

1484

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1485

# {allowed_values: "E3" allowed_values: "E4"}

1486

# The accepted values at `organizations/foo` are `E1`, `E2`.

1487

# The accepted values at `projects/bar` are `E3`, and `E4`.

1488

#

1489

# Example 2 (inherited values):

1490

# `organizations/foo` has a `Policy` with values:

1491

# {allowed_values: “E1” allowed_values:”E2”}

1492

# `projects/bar` has a `Policy` with values:

1493

# {value: “E3” value: ”E4” inherit_from_parent: true}

1494

# The accepted values at `organizations/foo` are `E1`, `E2`.

1495

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1496

#

1497

# Example 3 (inheriting both allowed and denied values):

1498

# `organizations/foo` has a `Policy` with values:

1499

# {allowed_values: "E1" allowed_values: "E2"}

1500

# `projects/bar` has a `Policy` with:

1501

# {denied_values: "E1"}

1502

# The accepted values at `organizations/foo` are `E1`, `E2`.

1503

# The value accepted at `projects/bar` is `E2`.

1504

#

1505

# Example 4 (RestoreDefault):

1506

# `organizations/foo` has a `Policy` with values:

1507

# {allowed_values: “E1” allowed_values:”E2”}

1508

# `projects/bar` has a `Policy` with values:

1509

# {RestoreDefault: {}}

1510

# The accepted values at `organizations/foo` are `E1`, `E2`.

1511

# The accepted values at `projects/bar` are either all or none depending on

1512

# the value of `constraint_default` (if `ALLOW`, all; if

1513

# `DENY`, none).

1514

#

1515

# Example 5 (no policy inherits parent policy):

1516

# `organizations/foo` has no `Policy` set.

1517

# `projects/bar` has no `Policy` set.

1518

# The accepted values at both levels are either all or none depending on

1519

# the value of `constraint_default` (if `ALLOW`, all; if

1520

# `DENY`, none).

1521

#

1522

# Example 6 (ListConstraint allowing all):

1523

# `organizations/foo` has a `Policy` with values:

1524

# {allowed_values: “E1” allowed_values: ”E2”}

1525

# `projects/bar` has a `Policy` with:

1526

# {all: ALLOW}

1527

# The accepted values at `organizations/foo` are `E1`, E2`.

1528

# Any value is accepted at `projects/bar`.

1529

#

1530

# Example 7 (ListConstraint allowing none):

1531

# `organizations/foo` has a `Policy` with values:

1532

# {allowed_values: “E1” allowed_values: ”E2”}

1533

# `projects/bar` has a `Policy` with:

1534

# {all: DENY}

1535

# The accepted values at `organizations/foo` are `E1`, E2`.

1536

# No value is accepted at `projects/bar`.

1537

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1538

# that matches the value specified in this `Policy`. If `suggested_value`

1539

# is not set, it will inherit the value specified higher in the hierarchy,

1540

# unless `inherit_from_parent` is `false`.

1541

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1542

# set for `denied_values` and `all_values` is set to

1543

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1548

# resource.

1549

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1550

# configuration is acceptable.

1551

#

1552

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1553

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1554

# `Constraint` exhibits the following behavior:

1555

# - If the `Policy` at this resource has enforced set to `false`, serial

1556

# port connection attempts will be allowed.

1557

# - If the `Policy` at this resource has enforced set to `true`, serial

1558

# port connection attempts will be refused.

1559

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1560

# connection attempts will be allowed.

1561

# - If no `Policy` is set at this resource or anywhere higher in the

1562

# resource hierarchy, serial port connection attempts will be allowed.

1563

# - If no `Policy` is set at this resource, but one exists higher in the

1564

# resource hierarchy, the behavior is as if the`Policy` were set at

1565

# this resource.

1566

#

1567

# The following examples demonstrate the different possible layerings:

1568

#

1569

# Example 1 (nearest `Constraint` wins):

1570

# `organizations/foo` has a `Policy` with:

1571

# {enforced: false}

1572

# `projects/bar` has no `Policy` set.

1573

# The constraint at `projects/bar` and `organizations/foo` will not be

1574

# enforced.

1575

#

1576

# Example 2 (enforcement gets replaced):

1577

# `organizations/foo` has a `Policy` with:

1578

# {enforced: false}

1579

# `projects/bar` has a `Policy` with:

1580

# {enforced: true}

1581

# The constraint at `organizations/foo` is not enforced.

1582

# The constraint at `projects/bar` is enforced.

1583

#

1584

# Example 3 (RestoreDefault):

1585

# `organizations/foo` has a `Policy` with:

1586

# {enforced: true}

1587

# `projects/bar` has a `Policy` with:

1588

# {RestoreDefault: {}}

1589

# The constraint at `organizations/foo` is enforced.

1590

# The constraint at `projects/bar` is not enforced, because

1591

# `constraint_default` for the `Constraint` is `ALLOW`.

1592

},

1593

"version": 42, # Version of the `Policy`. Default version is 0;

1594

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1595

# concurrency control.

1596

#

1597

# When the `Policy` is returned from either a `GetPolicy` or a

1598

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1599

# `Policy` to use when executing a read-modify-write loop.

1600

#

1601

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1602

# `etag` will be unset.

1603

#

1604

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1605

# that was returned from a `GetOrgPolicy` request as part of a

1606

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1607

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1619

1620

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

1621

# for configurations of Cloud Platform resources.

1622

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1623

# server, not specified by the caller, and represents the last time a call to

1624

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1625

# be ignored.

1626

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1627

# `constraints/serviceuser.services`.

1628

#

1629

# Immutable after creation.

1630

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1631

# `Constraint` type.

1632

# `constraint_default` enforcement behavior of the specific `Constraint` at

1633

# this resource.

1634

#

1635

# Suppose that `constraint_default` is set to `ALLOW` for the

1636

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1637

# foo.com sets a `Policy` at their Organization resource node that restricts

1638

# the allowed service activations to deny all service activations. They

1639

# could then set a `Policy` with the `policy_type` `restore_default` on

1640

# several experimental projects, restoring the `constraint_default`

1641

# enforcement of the `Constraint` for only those projects, allowing those

1642

# projects to have all services activated.

1643

},

1644

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1645

# resource.

1646

#

1647

# A `ListPolicy` can define specific values that are allowed or denied by

1648

# setting either the `allowed_values` or `denied_values` fields. It can also

1649

# be used to allow or deny all values, by setting the `all_values` field. If

1650

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1651

# or `denied_values` must be set (attempting to set both or neither will

1652

# result in a failed request). If `all_values` is set to either `ALLOW` or

1653

# `DENY`, `allowed_values` and `denied_values` must be unset.

1654

"allValues": "A String", # The policy all_values state.

1655

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1656

# set for `allowed_values` and `all_values` is set to

1657

# `ALL_VALUES_UNSPECIFIED`.

1658

"A String",

1659

],

1660

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1661

#

1662

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1663

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1664

# set to `true`, then the values from the effective `Policy` of the parent

1665

# resource are inherited, meaning the values set in this `Policy` are

1666

# added to the values inherited up the hierarchy.

1667

#

1668

# Setting `Policy` hierarchies that inherit both allowed values and denied

1669

# values isn't recommended in most circumstances to keep the configuration

1670

# simple and understandable. However, it is possible to set a `Policy` with

1671

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1672

# In this case, the values that are allowed must be in `allowed_values` and

1673

# not present in `denied_values`.

1674

#

1675

# For example, suppose you have a `Constraint`

1676

# `constraints/serviceuser.services`, which has a `constraint_type` of

1677

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1678

# Suppose that at the Organization level, a `Policy` is applied that

1679

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1680

# `Policy` is applied to a project below the Organization that has

1681

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1682

# then an attempt to activate any API will be denied.

1683

#

1684

# The following examples demonstrate different possible layerings:

1685

#

1686

# Example 1 (no inherited values):

1687

# `organizations/foo` has a `Policy` with values:

1688

# {allowed_values: “E1” allowed_values:”E2”}

1689

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1690

# {allowed_values: "E3" allowed_values: "E4"}

1691

# The accepted values at `organizations/foo` are `E1`, `E2`.

1692

# The accepted values at `projects/bar` are `E3`, and `E4`.

1693

#

1694

# Example 2 (inherited values):

1695

# `organizations/foo` has a `Policy` with values:

1696

# {allowed_values: “E1” allowed_values:”E2”}

1697

# `projects/bar` has a `Policy` with values:

1698

# {value: “E3” value: ”E4” inherit_from_parent: true}

1699

# The accepted values at `organizations/foo` are `E1`, `E2`.

1700

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1701

#

1702

# Example 3 (inheriting both allowed and denied values):

1703

# `organizations/foo` has a `Policy` with values:

1704

# {allowed_values: "E1" allowed_values: "E2"}

1705

# `projects/bar` has a `Policy` with:

1706

# {denied_values: "E1"}

1707

# The accepted values at `organizations/foo` are `E1`, `E2`.

1708

# The value accepted at `projects/bar` is `E2`.

1709

#

1710

# Example 4 (RestoreDefault):

1711

# `organizations/foo` has a `Policy` with values:

1712

# {allowed_values: “E1” allowed_values:”E2”}

1713

# `projects/bar` has a `Policy` with values:

1714

# {RestoreDefault: {}}

1715

# The accepted values at `organizations/foo` are `E1`, `E2`.

1716

# The accepted values at `projects/bar` are either all or none depending on

1717

# the value of `constraint_default` (if `ALLOW`, all; if

1718

# `DENY`, none).

1719

#

1720

# Example 5 (no policy inherits parent policy):

1721

# `organizations/foo` has no `Policy` set.

1722

# `projects/bar` has no `Policy` set.

1723

# The accepted values at both levels are either all or none depending on

1724

# the value of `constraint_default` (if `ALLOW`, all; if

1725

# `DENY`, none).

1726

#

1727

# Example 6 (ListConstraint allowing all):

1728

# `organizations/foo` has a `Policy` with values:

1729

# {allowed_values: “E1” allowed_values: ”E2”}

1730

# `projects/bar` has a `Policy` with:

1731

# {all: ALLOW}

1732

# The accepted values at `organizations/foo` are `E1`, E2`.

1733

# Any value is accepted at `projects/bar`.

1734

#

1735

# Example 7 (ListConstraint allowing none):

1736

# `organizations/foo` has a `Policy` with values:

1737

# {allowed_values: “E1” allowed_values: ”E2”}

1738

# `projects/bar` has a `Policy` with:

1739

# {all: DENY}

1740

# The accepted values at `organizations/foo` are `E1`, E2`.

1741

# No value is accepted at `projects/bar`.

1742

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1743

# that matches the value specified in this `Policy`. If `suggested_value`

1744

# is not set, it will inherit the value specified higher in the hierarchy,

1745

# unless `inherit_from_parent` is `false`.

1746

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1747

# set for `denied_values` and `all_values` is set to

1748

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1753

# resource.

1754

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1755

# configuration is acceptable.

1756

#

1757

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1758

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1759

# `Constraint` exhibits the following behavior:

1760

# - If the `Policy` at this resource has enforced set to `false`, serial

1761

# port connection attempts will be allowed.

1762

# - If the `Policy` at this resource has enforced set to `true`, serial

1763

# port connection attempts will be refused.

1764

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1765

# connection attempts will be allowed.

1766

# - If no `Policy` is set at this resource or anywhere higher in the

1767

# resource hierarchy, serial port connection attempts will be allowed.

1768

# - If no `Policy` is set at this resource, but one exists higher in the

1769

# resource hierarchy, the behavior is as if the`Policy` were set at

1770

# this resource.

1771

#

1772

# The following examples demonstrate the different possible layerings:

1773

#

1774

# Example 1 (nearest `Constraint` wins):

1775

# `organizations/foo` has a `Policy` with:

1776

# {enforced: false}

1777

# `projects/bar` has no `Policy` set.

1778

# The constraint at `projects/bar` and `organizations/foo` will not be

1779

# enforced.

1780

#

1781

# Example 2 (enforcement gets replaced):

1782

# `organizations/foo` has a `Policy` with:

1783

# {enforced: false}

1784

# `projects/bar` has a `Policy` with:

1785

# {enforced: true}

1786

# The constraint at `organizations/foo` is not enforced.

1787

# The constraint at `projects/bar` is enforced.

1788

#

1789

# Example 3 (RestoreDefault):

1790

# `organizations/foo` has a `Policy` with:

1791

# {enforced: true}

1792

# `projects/bar` has a `Policy` with:

1793

# {RestoreDefault: {}}

1794

# The constraint at `organizations/foo` is enforced.

1795

# The constraint at `projects/bar` is not enforced, because

1796

# `constraint_default` for the `Constraint` is `ALLOW`.

1797

},

1798

"version": 42, # Version of the `Policy`. Default version is 0;

1799

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

1800

# concurrency control.

1801

#

1802

# When the `Policy` is returned from either a `GetPolicy` or a

1803

# `ListOrgPolicy` request, this `etag` indicates the version of the current

1804

# `Policy` to use when executing a read-modify-write loop.

1805

#

1806

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

1807

# `etag` will be unset.

1808

#

1809

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

1810

# that was returned from a `GetOrgPolicy` request as part of a

1811

# read-modify-write loop for concurrency control. Not setting the `etag`in a

1812

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

<code class="details" id="setOrgPolicyV1">setOrgPolicyV1(resource, body, x__xgafv=None)</code>

1819

<pre>Updates the specified `Policy` on the resource. Creates a new `Policy` for

1820

that `Constraint` on the resource if one does not exist.

1821

1822

Not supplying an `etag` on the request `Policy` results in an unconditional

1823

write of the `Policy`.

1824

1825

Args:

1826

resource: string, Resource name of the resource to attach the `Policy`. (required)

1827

body: object, The request body. (required)

1828

The object takes the form of:

1829

1830

{ # The request sent to the SetOrgPolicyRequest method.

1831

"policy": { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` # `Policy` to set on the resource.

1832

# for configurations of Cloud Platform resources.

1833

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

1834

# server, not specified by the caller, and represents the last time a call to

1835

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

1836

# be ignored.

1837

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

1838

# `constraints/serviceuser.services`.

1839

#

1840

# Immutable after creation.

1841

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

1842

# `Constraint` type.

1843

# `constraint_default` enforcement behavior of the specific `Constraint` at

1844

# this resource.

1845

#

1846

# Suppose that `constraint_default` is set to `ALLOW` for the

1847

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

1848

# foo.com sets a `Policy` at their Organization resource node that restricts

1849

# the allowed service activations to deny all service activations. They

1850

# could then set a `Policy` with the `policy_type` `restore_default` on

1851

# several experimental projects, restoring the `constraint_default`

1852

# enforcement of the `Constraint` for only those projects, allowing those

1853

# projects to have all services activated.

1854

},

1855

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

1856

# resource.

1857

#

1858

# A `ListPolicy` can define specific values that are allowed or denied by

1859

# setting either the `allowed_values` or `denied_values` fields. It can also

1860

# be used to allow or deny all values, by setting the `all_values` field. If

1861

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

1862

# or `denied_values` must be set (attempting to set both or neither will

1863

# result in a failed request). If `all_values` is set to either `ALLOW` or

1864

# `DENY`, `allowed_values` and `denied_values` must be unset.

1865

"allValues": "A String", # The policy all_values state.

1866

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

1867

# set for `allowed_values` and `all_values` is set to

1868

# `ALL_VALUES_UNSPECIFIED`.

1869

"A String",

1870

],

1871

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

1872

#

1873

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

1874

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

1875

# set to `true`, then the values from the effective `Policy` of the parent

1876

# resource are inherited, meaning the values set in this `Policy` are

1877

# added to the values inherited up the hierarchy.

1878

#

1879

# Setting `Policy` hierarchies that inherit both allowed values and denied

1880

# values isn't recommended in most circumstances to keep the configuration

1881

# simple and understandable. However, it is possible to set a `Policy` with

1882

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

1883

# In this case, the values that are allowed must be in `allowed_values` and

1884

# not present in `denied_values`.

1885

#

1886

# For example, suppose you have a `Constraint`

1887

# `constraints/serviceuser.services`, which has a `constraint_type` of

1888

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

1889

# Suppose that at the Organization level, a `Policy` is applied that

1890

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

1891

# `Policy` is applied to a project below the Organization that has

1892

# `inherit_from_parent` set to `false` and field all_values set to DENY,

1893

# then an attempt to activate any API will be denied.

1894

#

1895

# The following examples demonstrate different possible layerings:

1896

#

1897

# Example 1 (no inherited values):

1898

# `organizations/foo` has a `Policy` with values:

1899

# {allowed_values: “E1” allowed_values:”E2”}

1900

# ``projects/bar`` has `inherit_from_parent` `false` and values:

1901

# {allowed_values: "E3" allowed_values: "E4"}

1902

# The accepted values at `organizations/foo` are `E1`, `E2`.

1903

# The accepted values at `projects/bar` are `E3`, and `E4`.

1904

#

1905

# Example 2 (inherited values):

1906

# `organizations/foo` has a `Policy` with values:

1907

# {allowed_values: “E1” allowed_values:”E2”}

1908

# `projects/bar` has a `Policy` with values:

1909

# {value: “E3” value: ”E4” inherit_from_parent: true}

1910

# The accepted values at `organizations/foo` are `E1`, `E2`.

1911

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

1912

#

1913

# Example 3 (inheriting both allowed and denied values):

1914

# `organizations/foo` has a `Policy` with values:

1915

# {allowed_values: "E1" allowed_values: "E2"}

1916

# `projects/bar` has a `Policy` with:

1917

# {denied_values: "E1"}

1918

# The accepted values at `organizations/foo` are `E1`, `E2`.

1919

# The value accepted at `projects/bar` is `E2`.

1920

#

1921

# Example 4 (RestoreDefault):

1922

# `organizations/foo` has a `Policy` with values:

1923

# {allowed_values: “E1” allowed_values:”E2”}

1924

# `projects/bar` has a `Policy` with values:

1925

# {RestoreDefault: {}}

1926

# The accepted values at `organizations/foo` are `E1`, `E2`.

1927

# The accepted values at `projects/bar` are either all or none depending on

1928

# the value of `constraint_default` (if `ALLOW`, all; if

1929

# `DENY`, none).

1930

#

1931

# Example 5 (no policy inherits parent policy):

1932

# `organizations/foo` has no `Policy` set.

1933

# `projects/bar` has no `Policy` set.

1934

# The accepted values at both levels are either all or none depending on

1935

# the value of `constraint_default` (if `ALLOW`, all; if

1936

# `DENY`, none).

1937

#

1938

# Example 6 (ListConstraint allowing all):

1939

# `organizations/foo` has a `Policy` with values:

1940

# {allowed_values: “E1” allowed_values: ”E2”}

1941

# `projects/bar` has a `Policy` with:

1942

# {all: ALLOW}

1943

# The accepted values at `organizations/foo` are `E1`, E2`.

1944

# Any value is accepted at `projects/bar`.

1945

#

1946

# Example 7 (ListConstraint allowing none):

1947

# `organizations/foo` has a `Policy` with values:

1948

# {allowed_values: “E1” allowed_values: ”E2”}

1949

# `projects/bar` has a `Policy` with:

1950

# {all: DENY}

1951

# The accepted values at `organizations/foo` are `E1`, E2`.

1952

# No value is accepted at `projects/bar`.

1953

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

1954

# that matches the value specified in this `Policy`. If `suggested_value`

1955

# is not set, it will inherit the value specified higher in the hierarchy,

1956

# unless `inherit_from_parent` is `false`.

1957

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

1958

# set for `denied_values` and `all_values` is set to

1959

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

1964

# resource.

1965

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

1966

# configuration is acceptable.

1967

#

1968

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

1969

# with `constraint_default` set to `ALLOW`. A `Policy` for that

1970

# `Constraint` exhibits the following behavior:

1971

# - If the `Policy` at this resource has enforced set to `false`, serial

1972

# port connection attempts will be allowed.

1973

# - If the `Policy` at this resource has enforced set to `true`, serial

1974

# port connection attempts will be refused.

1975

# - If the `Policy` at this resource is `RestoreDefault`, serial port

1976

# connection attempts will be allowed.

1977

# - If no `Policy` is set at this resource or anywhere higher in the

1978

# resource hierarchy, serial port connection attempts will be allowed.

1979

# - If no `Policy` is set at this resource, but one exists higher in the

1980

# resource hierarchy, the behavior is as if the`Policy` were set at

1981

# this resource.

1982

#

1983

# The following examples demonstrate the different possible layerings:

1984

#

1985

# Example 1 (nearest `Constraint` wins):

1986

# `organizations/foo` has a `Policy` with:

1987

# {enforced: false}

1988

# `projects/bar` has no `Policy` set.

1989

# The constraint at `projects/bar` and `organizations/foo` will not be

1990

# enforced.

1991

#

1992

# Example 2 (enforcement gets replaced):

1993

# `organizations/foo` has a `Policy` with:

1994

# {enforced: false}

1995

# `projects/bar` has a `Policy` with:

1996

# {enforced: true}

1997

# The constraint at `organizations/foo` is not enforced.

1998

# The constraint at `projects/bar` is enforced.

1999

#

2000

# Example 3 (RestoreDefault):

2001

# `organizations/foo` has a `Policy` with:

2002

# {enforced: true}

2003

# `projects/bar` has a `Policy` with:

2004

# {RestoreDefault: {}}

2005

# The constraint at `organizations/foo` is enforced.

2006

# The constraint at `projects/bar` is not enforced, because

2007

# `constraint_default` for the `Constraint` is `ALLOW`.

2008

},

2009

"version": 42, # Version of the `Policy`. Default version is 0;

2010

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2011

# concurrency control.

2012

#

2013

# When the `Policy` is returned from either a `GetPolicy` or a

2014

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2015

# `Policy` to use when executing a read-modify-write loop.

2016

#

2017

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2018

# `etag` will be unset.

2019

#

2020

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2021

# that was returned from a `GetOrgPolicy` request as part of a

2022

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2023

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2035

2036

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

2037

# for configurations of Cloud Platform resources.

2038

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

2039

# server, not specified by the caller, and represents the last time a call to

2040

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

2041

# be ignored.

2042

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

2043

# `constraints/serviceuser.services`.

2044

#

2045

# Immutable after creation.

2046

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

2047

# `Constraint` type.

2048

# `constraint_default` enforcement behavior of the specific `Constraint` at

2049

# this resource.

2050

#

2051

# Suppose that `constraint_default` is set to `ALLOW` for the

2052

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

2053

# foo.com sets a `Policy` at their Organization resource node that restricts

2054

# the allowed service activations to deny all service activations. They

2055

# could then set a `Policy` with the `policy_type` `restore_default` on

2056

# several experimental projects, restoring the `constraint_default`

2057

# enforcement of the `Constraint` for only those projects, allowing those

2058

# projects to have all services activated.

2059

},

2060

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

2061

# resource.

2062

#

2063

# A `ListPolicy` can define specific values that are allowed or denied by

2064

# setting either the `allowed_values` or `denied_values` fields. It can also

2065

# be used to allow or deny all values, by setting the `all_values` field. If

2066

# `all_values` is `ALL_VALUES_UNSPECIFIED`, exactly one of `allowed_values`

2067

# or `denied_values` must be set (attempting to set both or neither will

2068

# result in a failed request). If `all_values` is set to either `ALLOW` or

2069

# `DENY`, `allowed_values` and `denied_values` must be unset.

2070

"allValues": "A String", # The policy all_values state.

2071

"deniedValues": [ # List of values denied at this resource. Can only be set if no values are

2072

# set for `allowed_values` and `all_values` is set to

2073

# `ALL_VALUES_UNSPECIFIED`.

2074

"A String",

2075

],

2076

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

2077

#

2078

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

2079

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

2080

# set to `true`, then the values from the effective `Policy` of the parent

2081

# resource are inherited, meaning the values set in this `Policy` are

2082

# added to the values inherited up the hierarchy.

2083

#

2084

# Setting `Policy` hierarchies that inherit both allowed values and denied

2085

# values isn't recommended in most circumstances to keep the configuration

2086

# simple and understandable. However, it is possible to set a `Policy` with

2087

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

2088

# In this case, the values that are allowed must be in `allowed_values` and

2089

# not present in `denied_values`.

2090

#

2091

# For example, suppose you have a `Constraint`

2092

# `constraints/serviceuser.services`, which has a `constraint_type` of

2093

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

2094

# Suppose that at the Organization level, a `Policy` is applied that

2095

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

2096

# `Policy` is applied to a project below the Organization that has

2097

# `inherit_from_parent` set to `false` and field all_values set to DENY,

2098

# then an attempt to activate any API will be denied.

2099

#

2100

# The following examples demonstrate different possible layerings:

2101

#

2102

# Example 1 (no inherited values):

2103

# `organizations/foo` has a `Policy` with values:

2104

# {allowed_values: “E1” allowed_values:”E2”}

2105

# ``projects/bar`` has `inherit_from_parent` `false` and values:

2106

# {allowed_values: "E3" allowed_values: "E4"}

2107

# The accepted values at `organizations/foo` are `E1`, `E2`.

2108

# The accepted values at `projects/bar` are `E3`, and `E4`.

2109

#

2110

# Example 2 (inherited values):

2111

# `organizations/foo` has a `Policy` with values:

2112

# {allowed_values: “E1” allowed_values:”E2”}

2113

# `projects/bar` has a `Policy` with values:

2114

# {value: “E3” value: ”E4” inherit_from_parent: true}

2115

# The accepted values at `organizations/foo` are `E1`, `E2`.

2116

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

2117

#

2118

# Example 3 (inheriting both allowed and denied values):

2119

# `organizations/foo` has a `Policy` with values:

2120

# {allowed_values: "E1" allowed_values: "E2"}

2121

# `projects/bar` has a `Policy` with:

2122

# {denied_values: "E1"}

2123

# The accepted values at `organizations/foo` are `E1`, `E2`.

2124

# The value accepted at `projects/bar` is `E2`.

2125

#

2126

# Example 4 (RestoreDefault):

2127

# `organizations/foo` has a `Policy` with values:

2128

# {allowed_values: “E1” allowed_values:”E2”}

2129

# `projects/bar` has a `Policy` with values:

2130

# {RestoreDefault: {}}

2131

# The accepted values at `organizations/foo` are `E1`, `E2`.

2132

# The accepted values at `projects/bar` are either all or none depending on

2133

# the value of `constraint_default` (if `ALLOW`, all; if

2134

# `DENY`, none).

2135

#

2136

# Example 5 (no policy inherits parent policy):

2137

# `organizations/foo` has no `Policy` set.

2138

# `projects/bar` has no `Policy` set.

2139

# The accepted values at both levels are either all or none depending on

2140

# the value of `constraint_default` (if `ALLOW`, all; if

2141

# `DENY`, none).

2142

#

2143

# Example 6 (ListConstraint allowing all):

2144

# `organizations/foo` has a `Policy` with values:

2145

# {allowed_values: “E1” allowed_values: ”E2”}

2146

# `projects/bar` has a `Policy` with:

2147

# {all: ALLOW}

2148

# The accepted values at `organizations/foo` are `E1`, E2`.

2149

# Any value is accepted at `projects/bar`.

2150

#

2151

# Example 7 (ListConstraint allowing none):

2152

# `organizations/foo` has a `Policy` with values:

2153

# {allowed_values: “E1” allowed_values: ”E2”}

2154

# `projects/bar` has a `Policy` with:

2155

# {all: DENY}

2156

# The accepted values at `organizations/foo` are `E1`, E2`.

2157

# No value is accepted at `projects/bar`.

2158

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

2159

# that matches the value specified in this `Policy`. If `suggested_value`

2160

# is not set, it will inherit the value specified higher in the hierarchy,

2161

# unless `inherit_from_parent` is `false`.

2162

"allowedValues": [ # List of values allowed at this resource. an only be set if no values are

2163

# set for `denied_values` and `all_values` is set to

2164

# `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

2169

# resource.

2170

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

2171

# configuration is acceptable.

2172

#

2173

# Suppose you have a `Constraint` `constraints/compute.disableSerialPortAccess`

2174

# with `constraint_default` set to `ALLOW`. A `Policy` for that

2175

# `Constraint` exhibits the following behavior:

2176

# - If the `Policy` at this resource has enforced set to `false`, serial

2177

# port connection attempts will be allowed.

2178

# - If the `Policy` at this resource has enforced set to `true`, serial

2179

# port connection attempts will be refused.

2180

# - If the `Policy` at this resource is `RestoreDefault`, serial port

2181

# connection attempts will be allowed.

2182

# - If no `Policy` is set at this resource or anywhere higher in the

2183

# resource hierarchy, serial port connection attempts will be allowed.

2184

# - If no `Policy` is set at this resource, but one exists higher in the

2185

# resource hierarchy, the behavior is as if the`Policy` were set at

2186

# this resource.

2187

#

2188

# The following examples demonstrate the different possible layerings:

2189

#

2190

# Example 1 (nearest `Constraint` wins):

2191

# `organizations/foo` has a `Policy` with:

2192

# {enforced: false}

2193

# `projects/bar` has no `Policy` set.

2194

# The constraint at `projects/bar` and `organizations/foo` will not be

2195

# enforced.

2196

#

2197

# Example 2 (enforcement gets replaced):

2198

# `organizations/foo` has a `Policy` with:

2199

# {enforced: false}

2200

# `projects/bar` has a `Policy` with:

2201

# {enforced: true}

2202

# The constraint at `organizations/foo` is not enforced.

2203

# The constraint at `projects/bar` is enforced.

2204

#

2205

# Example 3 (RestoreDefault):

2206

# `organizations/foo` has a `Policy` with:

2207

# {enforced: true}

2208

# `projects/bar` has a `Policy` with:

2209

# {RestoreDefault: {}}

2210

# The constraint at `organizations/foo` is enforced.

2211

# The constraint at `projects/bar` is not enforced, because

2212

# `constraint_default` for the `Constraint` is `ALLOW`.

2213

},

2214

"version": 42, # Version of the `Policy`. Default version is 0;

2215

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

2216

# concurrency control.

2217

#

2218

# When the `Policy` is returned from either a `GetPolicy` or a

2219

# `ListOrgPolicy` request, this `etag` indicates the version of the current

2220

# `Policy` to use when executing a read-modify-write loop.

2221

#

2222

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

2223

# `etag` will be unset.

2224

#

2225

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

2226

# that was returned from a `GetOrgPolicy` request as part of a

2227

# read-modify-write loop for concurrency control. Not setting the `etag`in a

2228

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

}</pre>

</div>

</body></html>