| <html><body> | |
| <style> | |
| body, h1, h2, h3, div, span, p, pre, a { | |
| margin: 0; | |
| padding: 0; | |
| border: 0; | |
| font-weight: inherit; | |
| font-style: inherit; | |
| font-size: 100%; | |
| font-family: inherit; | |
| vertical-align: baseline; | |
| } | |
| body { | |
| font-size: 13px; | |
| padding: 1em; | |
| } | |
| h1 { | |
| font-size: 26px; | |
| margin-bottom: 1em; | |
| } | |
| h2 { | |
| font-size: 24px; | |
| margin-bottom: 1em; | |
| } | |
| h3 { | |
| font-size: 20px; | |
| margin-bottom: 1em; | |
| margin-top: 1em; | |
| } | |
| pre, code { | |
| line-height: 1.5; | |
| font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace; | |
| } | |
| pre { | |
| margin-top: 0.5em; | |
| } | |
| h1, h2, h3, p { | |
| font-family: Arial, sans serif; | |
| } | |
| h1, h2, h3 { | |
| border-bottom: solid #CCC 1px; | |
| } | |
| .toc_element { | |
| margin-top: 0.5em; | |
| } | |
| .firstline { | |
| margin-left: 2 em; | |
| } | |
| .method { | |
| margin-top: 1em; | |
| border: solid 1px #CCC; | |
| padding: 1em; | |
| background: #EEE; | |
| } | |
| .details { | |
| font-weight: bold; | |
| font-size: 14px; | |
| } | |
| </style> | |
| <h1><a href="compute_beta.html">Compute Engine API</a> . <a href="compute_beta.licenseCodes.html">licenseCodes</a></h1> | |
| <h2>Instance Methods</h2> | |
| <p class="toc_element"> | |
| <code><a href="#close">close()</a></code></p> | |
| <p class="firstline">Close httplib2 connections.</p> | |
| <p class="toc_element"> | |
| <code><a href="#get">get(project, licenseCode, x__xgafv=None)</a></code></p> | |
| <p class="firstline">Return a specified license code. License codes are mirrored across</p> | |
| <p class="toc_element"> | |
| <code><a href="#getIamPolicy">getIamPolicy(project, resource, optionsRequestedPolicyVersion=None, x__xgafv=None)</a></code></p> | |
| <p class="firstline">Gets the access control policy for a resource. May be empty if no such</p> | |
| <p class="toc_element"> | |
| <code><a href="#setIamPolicy">setIamPolicy(project, resource, body=None, x__xgafv=None)</a></code></p> | |
| <p class="firstline">Sets the access control policy on the specified resource.</p> | |
| <p class="toc_element"> | |
| <code><a href="#testIamPermissions">testIamPermissions(project, resource, body=None, x__xgafv=None)</a></code></p> | |
| <p class="firstline">Returns permissions that a caller has on the specified resource.</p> | |
| <h3>Method Details</h3> | |
| <div class="method"> | |
| <code class="details" id="close">close()</code> | |
| <pre>Close httplib2 connections.</pre> | |
| </div> | |
| <div class="method"> | |
| <code class="details" id="get">get(project, licenseCode, x__xgafv=None)</code> | |
| <pre>Return a specified license code. License codes are mirrored across | |
| all projects that have permissions to read the License Code. | |
| *Caution* This resource is intended | |
| for use only by third-party partners who are creatingCloud Marketplace | |
| images. | |
| Args: | |
| project: string, Project ID for this request. (required) | |
| licenseCode: string, Number corresponding to the License code resource to return. (required) | |
| x__xgafv: string, V1 error format. | |
| Allowed values | |
| 1 - v1 error format | |
| 2 - v2 error format | |
| Returns: | |
| An object of the form: | |
| { # Represents a License Code resource. | |
| # | |
| # A License Code is a unique identifier used to represent alicense | |
| # resource. | |
| # *Caution* This resource is intended for | |
| # use only by third-party partners who are creatingCloud Marketplace | |
| # images. | |
| "allowedReplacementLicenses": [ # Specifies licenseCodes of licenses that can replace this license. Note: | |
| # such replacements are allowed even if removable_from_disk is false. | |
| "A String", | |
| ], | |
| "appendableToDisk": True or False, # If true, this license can be appended to an existing disk's set of | |
| # licenses. | |
| "creationTimestamp": "A String", # Output only. [Output Only] Creation timestamp inRFC3339 | |
| # text format. | |
| "description": "A String", # Output only. [Output Only] Description of this License Code. | |
| "id": "A String", # Output only. [Output Only] The unique identifier for the resource. This identifier is | |
| # defined by the server. | |
| "incompatibleLicenses": [ # Specifies licenseCodes of licenses that are incompatible with this license. | |
| # If a license is incompatible with this license, it cannot be attached to | |
| # the same disk or image. | |
| "A String", | |
| ], | |
| "kind": "compute#licenseCode", # Output only. [Output Only] Type of resource. Always compute#licenseCode for | |
| # licenses. | |
| "licenseAlias": [ # [Output Only] URL and description aliases of Licenses with the same | |
| # License Code. | |
| { | |
| "description": "A String", # Output only. [Output Only] Description of this License Code. | |
| "selfLink": "A String", # Output only. [Output Only] URL of license corresponding to this License Code. | |
| }, | |
| ], | |
| "minimumRetention": { # A Duration represents a fixed-length span of time represented # If set, this license will be unable to be removed or replaced once attached | |
| # to a disk until the minimum_retention period has passed. | |
| # as a count of seconds and fractions of seconds at nanosecond | |
| # resolution. It is independent of any calendar and concepts like "day" | |
| # or "month". Range is approximately 10,000 years. | |
| "nanos": 42, # Span of time that's a fraction of a second at nanosecond resolution. | |
| # Durations less than one second are represented with a 0 | |
| # `seconds` field and a positive `nanos` field. Must be from 0 | |
| # to 999,999,999 inclusive. | |
| "seconds": "A String", # Span of time at a resolution of a second. Must be from 0 | |
| # to 315,576,000,000 inclusive. Note: these bounds are computed from: | |
| # 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years | |
| }, | |
| "multiTenantOnly": True or False, # If true, this license can only be used on VMs on multi tenant nodes. | |
| "name": "A String", # Output only. [Output Only] Name of the resource. The name is 1-20 characters long and | |
| # must be a valid 64 bit integer. | |
| "osLicense": True or False, # If true, indicates this is an OS license. Only one OS license can be | |
| # attached to a disk or image at a time. | |
| "removableFromDisk": True or False, # If true, this license can be removed from a disk's set of licenses, with no | |
| # replacement license needed. | |
| "requiredCoattachedLicenses": [ # Specifies the set of permissible coattached licenseCodes of licenses that | |
| # satisfy the coattachment requirement of this license. At least one license | |
| # from the set must be attached to the same disk or image as this license. | |
| "A String", | |
| ], | |
| "selfLink": "A String", # Output only. [Output Only] Server-defined URL for the resource. | |
| "soleTenantOnly": True or False, # If true, this license can only be used on VMs on sole tenant nodes. | |
| "state": "A String", # Output only. [Output Only] Current state of this License Code. | |
| "transferable": True or False, # Output only. [Output Only] If true, the license will remain attached when creating | |
| # images or snapshots from disks. Otherwise, the license is not transferred. | |
| "updateTimestamp": "A String", # Output only. [Output Only] Last update timestamp inRFC3339 | |
| # text format. | |
| }</pre> | |
| </div> | |
| <div class="method"> | |
| <code class="details" id="getIamPolicy">getIamPolicy(project, resource, optionsRequestedPolicyVersion=None, x__xgafv=None)</code> | |
| <pre>Gets the access control policy for a resource. May be empty if no such | |
| policy or resource exists. | |
| *Caution* This resource is intended | |
| for use only by third-party partners who are creatingCloud Marketplace | |
| images. | |
| Args: | |
| project: string, Project ID for this request. (required) | |
| resource: string, Name or id of the resource for this request. (required) | |
| optionsRequestedPolicyVersion: integer, Requested IAM Policy version. | |
| x__xgafv: string, V1 error format. | |
| Allowed values | |
| 1 - v1 error format | |
| 2 - v2 error format | |
| Returns: | |
| An object of the form: | |
| { # An Identity and Access Management (IAM) policy, which specifies access | |
| # controls for Google Cloud resources. | |
| # | |
| # | |
| # A `Policy` is a collection of `bindings`. A `binding` binds one or more | |
| # `members`, or principals, to a single `role`. Principals can be user | |
| # accounts, service accounts, Google groups, and domains (such as G Suite). A | |
| # `role` is a named list of permissions; each `role` can be an IAM predefined | |
| # role or a user-created custom role. | |
| # | |
| # For some types of Google Cloud resources, a `binding` can also specify a | |
| # `condition`, which is a logical expression that allows access to a resource | |
| # only if the expression evaluates to `true`. A condition can add constraints | |
| # based on attributes of the request, the resource, or both. To learn which | |
| # resources support conditions in their IAM policies, see the | |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # | |
| # **JSON example:** | |
| # | |
| # ``` | |
| # { | |
| # "bindings": [ | |
| # { | |
| # "role": "roles/resourcemanager.organizationAdmin", | |
| # "members": [ | |
| # "user:mike@example.com", | |
| # "group:admins@example.com", | |
| # "domain:google.com", | |
| # "serviceAccount:my-project-id@appspot.gserviceaccount.com" | |
| # ] | |
| # }, | |
| # { | |
| # "role": "roles/resourcemanager.organizationViewer", | |
| # "members": [ | |
| # "user:eve@example.com" | |
| # ], | |
| # "condition": { | |
| # "title": "expirable access", | |
| # "description": "Does not grant access after Sep 2020", | |
| # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", | |
| # } | |
| # } | |
| # ], | |
| # "etag": "BwWWja0YfJA=", | |
| # "version": 3 | |
| # } | |
| # ``` | |
| # | |
| # **YAML example:** | |
| # | |
| # ``` | |
| # bindings: | |
| # - members: | |
| # - user:mike@example.com | |
| # - group:admins@example.com | |
| # - domain:google.com | |
| # - serviceAccount:my-project-id@appspot.gserviceaccount.com | |
| # role: roles/resourcemanager.organizationAdmin | |
| # - members: | |
| # - user:eve@example.com | |
| # role: roles/resourcemanager.organizationViewer | |
| # condition: | |
| # title: expirable access | |
| # description: Does not grant access after Sep 2020 | |
| # expression: request.time < timestamp('2020-10-01T00:00:00.000Z') | |
| # etag: BwWWja0YfJA= | |
| # version: 3 | |
| # ``` | |
| # | |
| # For a description of IAM and its features, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/). | |
| "auditConfigs": [ # Specifies cloud audit logging configuration for this policy. | |
| { # Specifies the audit configuration for a service. | |
| # The configuration determines which permission types are logged, and what | |
| # identities, if any, are exempted from logging. | |
| # An AuditConfig must have one or more AuditLogConfigs. | |
| # | |
| # If there are AuditConfigs for both `allServices` and a specific service, | |
| # the union of the two AuditConfigs is used for that service: the log_types | |
| # specified in each AuditConfig are enabled, and the exempted_members in each | |
| # AuditLogConfig are exempted. | |
| # | |
| # Example Policy with multiple AuditConfigs: | |
| # | |
| # { | |
| # "audit_configs": [ | |
| # { | |
| # "service": "allServices", | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ", | |
| # "exempted_members": [ | |
| # "user:jose@example.com" | |
| # ] | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE" | |
| # }, | |
| # { | |
| # "log_type": "ADMIN_READ" | |
| # } | |
| # ] | |
| # }, | |
| # { | |
| # "service": "sampleservice.googleapis.com", | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ" | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE", | |
| # "exempted_members": [ | |
| # "user:aliya@example.com" | |
| # ] | |
| # } | |
| # ] | |
| # } | |
| # ] | |
| # } | |
| # | |
| # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ | |
| # logging. It also exempts `jose@example.com` from DATA_READ logging, and | |
| # `aliya@example.com` from DATA_WRITE logging. | |
| "auditLogConfigs": [ # The configuration for logging of each type of permission. | |
| { # Provides the configuration for logging a type of permissions. | |
| # Example: | |
| # | |
| # { | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ", | |
| # "exempted_members": [ | |
| # "user:jose@example.com" | |
| # ] | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE" | |
| # } | |
| # ] | |
| # } | |
| # | |
| # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting | |
| # jose@example.com from DATA_READ logging. | |
| "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of | |
| # permission. | |
| # Follows the same format of Binding.members. | |
| "A String", | |
| ], | |
| "logType": "A String", # The log type that this config enables. | |
| }, | |
| ], | |
| "service": "A String", # Specifies a service that will be enabled for audit logging. | |
| # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. | |
| # `allServices` is a special value that covers all services. | |
| }, | |
| ], | |
| "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, | |
| # may specify a `condition` that determines how and when the `bindings` are | |
| # applied. Each of the `bindings` must contain at least one principal. | |
| # | |
| # The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 | |
| # of these principals can be Google groups. Each occurrence of a principal | |
| # counts towards these limits. For example, if the `bindings` grant 50 | |
| # different roles to `user:alice@example.com`, and not to any other | |
| # principal, then you can add another 1,450 principals to the `bindings` in | |
| # the `Policy`. | |
| { # Associates `members`, or principals, with a `role`. | |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. | |
| # | |
| # If the condition evaluates to `true`, then this binding applies to the | |
| # current request. | |
| # | |
| # If the condition evaluates to `false`, then this binding does not apply to | |
| # the current request. However, a different role binding might grant the same | |
| # role to one or more of the principals in this binding. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM | |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL | |
| # are documented at https://github.com/google/cel-spec. | |
| # | |
| # Example (Comparison): | |
| # | |
| # title: "Summary size limit" | |
| # description: "Determines if a summary is less than 100 chars" | |
| # expression: "document.summary.size() < 100" | |
| # | |
| # Example (Equality): | |
| # | |
| # title: "Requestor is owner" | |
| # description: "Determines if requestor is the document owner" | |
| # expression: "document.owner == request.auth.claims.email" | |
| # | |
| # Example (Logic): | |
| # | |
| # title: "Public documents" | |
| # description: "Determine whether the document should be publicly visible" | |
| # expression: "document.type != 'private' && document.type != 'internal'" | |
| # | |
| # Example (Data Manipulation): | |
| # | |
| # title: "Notification string" | |
| # description: "Create a notification string with a timestamp." | |
| # expression: "'New message received at ' + string(document.create_time)" | |
| # | |
| # The exact variables and functions that may be referenced within an expression | |
| # are determined by the service that evaluates it. See the service | |
| # documentation for additional information. | |
| "description": "A String", # Optional. Description of the expression. This is a longer text which | |
| # describes the expression, e.g. when hovered over it in a UI. | |
| "expression": "A String", # Textual representation of an expression in Common Expression Language | |
| # syntax. | |
| "location": "A String", # Optional. String indicating the location of the expression for error | |
| # reporting, e.g. a file name and a position in the file. | |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing | |
| # its purpose. This can be used e.g. in UIs which allow to enter the | |
| # expression. | |
| }, | |
| "members": [ # Specifies the principals requesting access for a Google Cloud resource. | |
| # `members` can have the following values: | |
| # | |
| # * `allUsers`: A special identifier that represents anyone who is | |
| # on the internet; with or without a Google account. | |
| # | |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone | |
| # who is authenticated with a Google account or a service account. | |
| # Does not include identities that come from external identity providers | |
| # (IdPs) through identity federation. | |
| # | |
| # * `user:{emailid}`: An email address that represents a specific Google | |
| # account. For example, `alice@example.com` . | |
| # | |
| # | |
| # * `serviceAccount:{emailid}`: An email address that represents a Google | |
| # service account. For example, | |
| # `my-other-app@appspot.gserviceaccount.com`. | |
| # | |
| # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An | |
| # identifier for a | |
| # [Kubernetes service | |
| # account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). | |
| # For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. | |
| # | |
| # * `group:{emailid}`: An email address that represents a Google group. | |
| # For example, `admins@example.com`. | |
| # | |
| # | |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the | |
| # users of that domain. For example, `google.com` or `example.com`. | |
| # | |
| # | |
| # | |
| # | |
| # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workforce identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: | |
| # All workforce identities in a group. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All workforce identities with a specific attribute value. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: | |
| # All identities in a workforce identity pool. | |
| # | |
| # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workload identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: | |
| # A workload identity pool group. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All identities in a workload identity pool with a certain attribute. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: | |
| # All identities in a workload identity pool. | |
| # | |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a user that has been recently deleted. For | |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is | |
| # recovered, this value reverts to `user:{emailid}` and the recovered user | |
| # retains the role in the binding. | |
| # | |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus | |
| # unique identifier) representing a service account that has been recently | |
| # deleted. For example, | |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. | |
| # If the service account is undeleted, this value reverts to | |
| # `serviceAccount:{emailid}` and the undeleted service account retains the | |
| # role in the binding. | |
| # | |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a Google group that has been recently | |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If | |
| # the group is recovered, this value reverts to `group:{emailid}` and the | |
| # recovered group retains the role in the binding. | |
| # | |
| # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # Deleted single identity in a workforce identity pool. For example, | |
| # `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`. | |
| "A String", | |
| ], | |
| "role": "A String", # Role that is assigned to the list of `members`, or principals. | |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. | |
| # | |
| # For an overview of the IAM roles and permissions, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For | |
| # a list of the available pre-defined roles, see | |
| # [here](https://cloud.google.com/iam/docs/understanding-roles). | |
| }, | |
| ], | |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help | |
| # prevent simultaneous updates of a policy from overwriting each other. | |
| # It is strongly suggested that systems make use of the `etag` in the | |
| # read-modify-write cycle to perform policy updates in order to avoid race | |
| # conditions: An `etag` is returned in the response to `getIamPolicy`, and | |
| # systems are expected to put that etag in the request to `setIamPolicy` to | |
| # ensure that their change will be applied to the same version of the policy. | |
| # | |
| # **Important:** If you use IAM Conditions, you must include the `etag` field | |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows | |
| # you to overwrite a version `3` policy with a version `1` policy, and all of | |
| # the conditions in the version `3` policy are lost. | |
| "version": 42, # Specifies the format of the policy. | |
| # | |
| # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value | |
| # are rejected. | |
| # | |
| # Any operation that affects conditional role bindings must specify version | |
| # `3`. This requirement applies to the following operations: | |
| # | |
| # * Getting a policy that includes a conditional role binding | |
| # * Adding a conditional role binding to a policy | |
| # * Changing a conditional role binding in a policy | |
| # * Removing any role binding, with or without a condition, from a policy | |
| # that includes conditions | |
| # | |
| # **Important:** If you use IAM Conditions, you must include the `etag` field | |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows | |
| # you to overwrite a version `3` policy with a version `1` policy, and all of | |
| # the conditions in the version `3` policy are lost. | |
| # | |
| # If a policy does not include any conditions, operations on that policy may | |
| # specify any valid version or leave the field unset. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| }</pre> | |
| </div> | |
| <div class="method"> | |
| <code class="details" id="setIamPolicy">setIamPolicy(project, resource, body=None, x__xgafv=None)</code> | |
| <pre>Sets the access control policy on the specified resource. | |
| Replaces any existing policy. | |
| *Caution* This resource is intended | |
| for use only by third-party partners who are creatingCloud Marketplace | |
| images. | |
| Args: | |
| project: string, Project ID for this request. (required) | |
| resource: string, Name or id of the resource for this request. (required) | |
| body: object, The request body. | |
| The object takes the form of: | |
| { | |
| "bindings": [ # Flatten Policy to create a backward compatible wire-format. | |
| # Deprecated. Use 'policy' to specify bindings. | |
| { # Associates `members`, or principals, with a `role`. | |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. | |
| # | |
| # If the condition evaluates to `true`, then this binding applies to the | |
| # current request. | |
| # | |
| # If the condition evaluates to `false`, then this binding does not apply to | |
| # the current request. However, a different role binding might grant the same | |
| # role to one or more of the principals in this binding. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM | |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL | |
| # are documented at https://github.com/google/cel-spec. | |
| # | |
| # Example (Comparison): | |
| # | |
| # title: "Summary size limit" | |
| # description: "Determines if a summary is less than 100 chars" | |
| # expression: "document.summary.size() < 100" | |
| # | |
| # Example (Equality): | |
| # | |
| # title: "Requestor is owner" | |
| # description: "Determines if requestor is the document owner" | |
| # expression: "document.owner == request.auth.claims.email" | |
| # | |
| # Example (Logic): | |
| # | |
| # title: "Public documents" | |
| # description: "Determine whether the document should be publicly visible" | |
| # expression: "document.type != 'private' && document.type != 'internal'" | |
| # | |
| # Example (Data Manipulation): | |
| # | |
| # title: "Notification string" | |
| # description: "Create a notification string with a timestamp." | |
| # expression: "'New message received at ' + string(document.create_time)" | |
| # | |
| # The exact variables and functions that may be referenced within an expression | |
| # are determined by the service that evaluates it. See the service | |
| # documentation for additional information. | |
| "description": "A String", # Optional. Description of the expression. This is a longer text which | |
| # describes the expression, e.g. when hovered over it in a UI. | |
| "expression": "A String", # Textual representation of an expression in Common Expression Language | |
| # syntax. | |
| "location": "A String", # Optional. String indicating the location of the expression for error | |
| # reporting, e.g. a file name and a position in the file. | |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing | |
| # its purpose. This can be used e.g. in UIs which allow to enter the | |
| # expression. | |
| }, | |
| "members": [ # Specifies the principals requesting access for a Google Cloud resource. | |
| # `members` can have the following values: | |
| # | |
| # * `allUsers`: A special identifier that represents anyone who is | |
| # on the internet; with or without a Google account. | |
| # | |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone | |
| # who is authenticated with a Google account or a service account. | |
| # Does not include identities that come from external identity providers | |
| # (IdPs) through identity federation. | |
| # | |
| # * `user:{emailid}`: An email address that represents a specific Google | |
| # account. For example, `alice@example.com` . | |
| # | |
| # | |
| # * `serviceAccount:{emailid}`: An email address that represents a Google | |
| # service account. For example, | |
| # `my-other-app@appspot.gserviceaccount.com`. | |
| # | |
| # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An | |
| # identifier for a | |
| # [Kubernetes service | |
| # account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). | |
| # For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. | |
| # | |
| # * `group:{emailid}`: An email address that represents a Google group. | |
| # For example, `admins@example.com`. | |
| # | |
| # | |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the | |
| # users of that domain. For example, `google.com` or `example.com`. | |
| # | |
| # | |
| # | |
| # | |
| # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workforce identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: | |
| # All workforce identities in a group. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All workforce identities with a specific attribute value. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: | |
| # All identities in a workforce identity pool. | |
| # | |
| # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workload identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: | |
| # A workload identity pool group. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All identities in a workload identity pool with a certain attribute. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: | |
| # All identities in a workload identity pool. | |
| # | |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a user that has been recently deleted. For | |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is | |
| # recovered, this value reverts to `user:{emailid}` and the recovered user | |
| # retains the role in the binding. | |
| # | |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus | |
| # unique identifier) representing a service account that has been recently | |
| # deleted. For example, | |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. | |
| # If the service account is undeleted, this value reverts to | |
| # `serviceAccount:{emailid}` and the undeleted service account retains the | |
| # role in the binding. | |
| # | |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a Google group that has been recently | |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If | |
| # the group is recovered, this value reverts to `group:{emailid}` and the | |
| # recovered group retains the role in the binding. | |
| # | |
| # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # Deleted single identity in a workforce identity pool. For example, | |
| # `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`. | |
| "A String", | |
| ], | |
| "role": "A String", # Role that is assigned to the list of `members`, or principals. | |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. | |
| # | |
| # For an overview of the IAM roles and permissions, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For | |
| # a list of the available pre-defined roles, see | |
| # [here](https://cloud.google.com/iam/docs/understanding-roles). | |
| }, | |
| ], | |
| "etag": "A String", # Flatten Policy to create a backward compatible wire-format. | |
| # Deprecated. Use 'policy' to specify the etag. | |
| "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the 'resource'. The size of | |
| # the policy is limited to a few 10s of KB. An empty policy is in general a | |
| # valid policy but certain services (like Projects) might reject them. | |
| # controls for Google Cloud resources. | |
| # | |
| # | |
| # A `Policy` is a collection of `bindings`. A `binding` binds one or more | |
| # `members`, or principals, to a single `role`. Principals can be user | |
| # accounts, service accounts, Google groups, and domains (such as G Suite). A | |
| # `role` is a named list of permissions; each `role` can be an IAM predefined | |
| # role or a user-created custom role. | |
| # | |
| # For some types of Google Cloud resources, a `binding` can also specify a | |
| # `condition`, which is a logical expression that allows access to a resource | |
| # only if the expression evaluates to `true`. A condition can add constraints | |
| # based on attributes of the request, the resource, or both. To learn which | |
| # resources support conditions in their IAM policies, see the | |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # | |
| # **JSON example:** | |
| # | |
| # ``` | |
| # { | |
| # "bindings": [ | |
| # { | |
| # "role": "roles/resourcemanager.organizationAdmin", | |
| # "members": [ | |
| # "user:mike@example.com", | |
| # "group:admins@example.com", | |
| # "domain:google.com", | |
| # "serviceAccount:my-project-id@appspot.gserviceaccount.com" | |
| # ] | |
| # }, | |
| # { | |
| # "role": "roles/resourcemanager.organizationViewer", | |
| # "members": [ | |
| # "user:eve@example.com" | |
| # ], | |
| # "condition": { | |
| # "title": "expirable access", | |
| # "description": "Does not grant access after Sep 2020", | |
| # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", | |
| # } | |
| # } | |
| # ], | |
| # "etag": "BwWWja0YfJA=", | |
| # "version": 3 | |
| # } | |
| # ``` | |
| # | |
| # **YAML example:** | |
| # | |
| # ``` | |
| # bindings: | |
| # - members: | |
| # - user:mike@example.com | |
| # - group:admins@example.com | |
| # - domain:google.com | |
| # - serviceAccount:my-project-id@appspot.gserviceaccount.com | |
| # role: roles/resourcemanager.organizationAdmin | |
| # - members: | |
| # - user:eve@example.com | |
| # role: roles/resourcemanager.organizationViewer | |
| # condition: | |
| # title: expirable access | |
| # description: Does not grant access after Sep 2020 | |
| # expression: request.time < timestamp('2020-10-01T00:00:00.000Z') | |
| # etag: BwWWja0YfJA= | |
| # version: 3 | |
| # ``` | |
| # | |
| # For a description of IAM and its features, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/). | |
| "auditConfigs": [ # Specifies cloud audit logging configuration for this policy. | |
| { # Specifies the audit configuration for a service. | |
| # The configuration determines which permission types are logged, and what | |
| # identities, if any, are exempted from logging. | |
| # An AuditConfig must have one or more AuditLogConfigs. | |
| # | |
| # If there are AuditConfigs for both `allServices` and a specific service, | |
| # the union of the two AuditConfigs is used for that service: the log_types | |
| # specified in each AuditConfig are enabled, and the exempted_members in each | |
| # AuditLogConfig are exempted. | |
| # | |
| # Example Policy with multiple AuditConfigs: | |
| # | |
| # { | |
| # "audit_configs": [ | |
| # { | |
| # "service": "allServices", | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ", | |
| # "exempted_members": [ | |
| # "user:jose@example.com" | |
| # ] | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE" | |
| # }, | |
| # { | |
| # "log_type": "ADMIN_READ" | |
| # } | |
| # ] | |
| # }, | |
| # { | |
| # "service": "sampleservice.googleapis.com", | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ" | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE", | |
| # "exempted_members": [ | |
| # "user:aliya@example.com" | |
| # ] | |
| # } | |
| # ] | |
| # } | |
| # ] | |
| # } | |
| # | |
| # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ | |
| # logging. It also exempts `jose@example.com` from DATA_READ logging, and | |
| # `aliya@example.com` from DATA_WRITE logging. | |
| "auditLogConfigs": [ # The configuration for logging of each type of permission. | |
| { # Provides the configuration for logging a type of permissions. | |
| # Example: | |
| # | |
| # { | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ", | |
| # "exempted_members": [ | |
| # "user:jose@example.com" | |
| # ] | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE" | |
| # } | |
| # ] | |
| # } | |
| # | |
| # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting | |
| # jose@example.com from DATA_READ logging. | |
| "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of | |
| # permission. | |
| # Follows the same format of Binding.members. | |
| "A String", | |
| ], | |
| "logType": "A String", # The log type that this config enables. | |
| }, | |
| ], | |
| "service": "A String", # Specifies a service that will be enabled for audit logging. | |
| # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. | |
| # `allServices` is a special value that covers all services. | |
| }, | |
| ], | |
| "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, | |
| # may specify a `condition` that determines how and when the `bindings` are | |
| # applied. Each of the `bindings` must contain at least one principal. | |
| # | |
| # The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 | |
| # of these principals can be Google groups. Each occurrence of a principal | |
| # counts towards these limits. For example, if the `bindings` grant 50 | |
| # different roles to `user:alice@example.com`, and not to any other | |
| # principal, then you can add another 1,450 principals to the `bindings` in | |
| # the `Policy`. | |
| { # Associates `members`, or principals, with a `role`. | |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. | |
| # | |
| # If the condition evaluates to `true`, then this binding applies to the | |
| # current request. | |
| # | |
| # If the condition evaluates to `false`, then this binding does not apply to | |
| # the current request. However, a different role binding might grant the same | |
| # role to one or more of the principals in this binding. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM | |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL | |
| # are documented at https://github.com/google/cel-spec. | |
| # | |
| # Example (Comparison): | |
| # | |
| # title: "Summary size limit" | |
| # description: "Determines if a summary is less than 100 chars" | |
| # expression: "document.summary.size() < 100" | |
| # | |
| # Example (Equality): | |
| # | |
| # title: "Requestor is owner" | |
| # description: "Determines if requestor is the document owner" | |
| # expression: "document.owner == request.auth.claims.email" | |
| # | |
| # Example (Logic): | |
| # | |
| # title: "Public documents" | |
| # description: "Determine whether the document should be publicly visible" | |
| # expression: "document.type != 'private' && document.type != 'internal'" | |
| # | |
| # Example (Data Manipulation): | |
| # | |
| # title: "Notification string" | |
| # description: "Create a notification string with a timestamp." | |
| # expression: "'New message received at ' + string(document.create_time)" | |
| # | |
| # The exact variables and functions that may be referenced within an expression | |
| # are determined by the service that evaluates it. See the service | |
| # documentation for additional information. | |
| "description": "A String", # Optional. Description of the expression. This is a longer text which | |
| # describes the expression, e.g. when hovered over it in a UI. | |
| "expression": "A String", # Textual representation of an expression in Common Expression Language | |
| # syntax. | |
| "location": "A String", # Optional. String indicating the location of the expression for error | |
| # reporting, e.g. a file name and a position in the file. | |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing | |
| # its purpose. This can be used e.g. in UIs which allow to enter the | |
| # expression. | |
| }, | |
| "members": [ # Specifies the principals requesting access for a Google Cloud resource. | |
| # `members` can have the following values: | |
| # | |
| # * `allUsers`: A special identifier that represents anyone who is | |
| # on the internet; with or without a Google account. | |
| # | |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone | |
| # who is authenticated with a Google account or a service account. | |
| # Does not include identities that come from external identity providers | |
| # (IdPs) through identity federation. | |
| # | |
| # * `user:{emailid}`: An email address that represents a specific Google | |
| # account. For example, `alice@example.com` . | |
| # | |
| # | |
| # * `serviceAccount:{emailid}`: An email address that represents a Google | |
| # service account. For example, | |
| # `my-other-app@appspot.gserviceaccount.com`. | |
| # | |
| # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An | |
| # identifier for a | |
| # [Kubernetes service | |
| # account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). | |
| # For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. | |
| # | |
| # * `group:{emailid}`: An email address that represents a Google group. | |
| # For example, `admins@example.com`. | |
| # | |
| # | |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the | |
| # users of that domain. For example, `google.com` or `example.com`. | |
| # | |
| # | |
| # | |
| # | |
| # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workforce identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: | |
| # All workforce identities in a group. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All workforce identities with a specific attribute value. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: | |
| # All identities in a workforce identity pool. | |
| # | |
| # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workload identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: | |
| # A workload identity pool group. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All identities in a workload identity pool with a certain attribute. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: | |
| # All identities in a workload identity pool. | |
| # | |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a user that has been recently deleted. For | |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is | |
| # recovered, this value reverts to `user:{emailid}` and the recovered user | |
| # retains the role in the binding. | |
| # | |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus | |
| # unique identifier) representing a service account that has been recently | |
| # deleted. For example, | |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. | |
| # If the service account is undeleted, this value reverts to | |
| # `serviceAccount:{emailid}` and the undeleted service account retains the | |
| # role in the binding. | |
| # | |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a Google group that has been recently | |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If | |
| # the group is recovered, this value reverts to `group:{emailid}` and the | |
| # recovered group retains the role in the binding. | |
| # | |
| # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # Deleted single identity in a workforce identity pool. For example, | |
| # `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`. | |
| "A String", | |
| ], | |
| "role": "A String", # Role that is assigned to the list of `members`, or principals. | |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. | |
| # | |
| # For an overview of the IAM roles and permissions, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For | |
| # a list of the available pre-defined roles, see | |
| # [here](https://cloud.google.com/iam/docs/understanding-roles). | |
| }, | |
| ], | |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help | |
| # prevent simultaneous updates of a policy from overwriting each other. | |
| # It is strongly suggested that systems make use of the `etag` in the | |
| # read-modify-write cycle to perform policy updates in order to avoid race | |
| # conditions: An `etag` is returned in the response to `getIamPolicy`, and | |
| # systems are expected to put that etag in the request to `setIamPolicy` to | |
| # ensure that their change will be applied to the same version of the policy. | |
| # | |
| # **Important:** If you use IAM Conditions, you must include the `etag` field | |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows | |
| # you to overwrite a version `3` policy with a version `1` policy, and all of | |
| # the conditions in the version `3` policy are lost. | |
| "version": 42, # Specifies the format of the policy. | |
| # | |
| # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value | |
| # are rejected. | |
| # | |
| # Any operation that affects conditional role bindings must specify version | |
| # `3`. This requirement applies to the following operations: | |
| # | |
| # * Getting a policy that includes a conditional role binding | |
| # * Adding a conditional role binding to a policy | |
| # * Changing a conditional role binding in a policy | |
| # * Removing any role binding, with or without a condition, from a policy | |
| # that includes conditions | |
| # | |
| # **Important:** If you use IAM Conditions, you must include the `etag` field | |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows | |
| # you to overwrite a version `3` policy with a version `1` policy, and all of | |
| # the conditions in the version `3` policy are lost. | |
| # | |
| # If a policy does not include any conditions, operations on that policy may | |
| # specify any valid version or leave the field unset. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| }, | |
| } | |
| x__xgafv: string, V1 error format. | |
| Allowed values | |
| 1 - v1 error format | |
| 2 - v2 error format | |
| Returns: | |
| An object of the form: | |
| { # An Identity and Access Management (IAM) policy, which specifies access | |
| # controls for Google Cloud resources. | |
| # | |
| # | |
| # A `Policy` is a collection of `bindings`. A `binding` binds one or more | |
| # `members`, or principals, to a single `role`. Principals can be user | |
| # accounts, service accounts, Google groups, and domains (such as G Suite). A | |
| # `role` is a named list of permissions; each `role` can be an IAM predefined | |
| # role or a user-created custom role. | |
| # | |
| # For some types of Google Cloud resources, a `binding` can also specify a | |
| # `condition`, which is a logical expression that allows access to a resource | |
| # only if the expression evaluates to `true`. A condition can add constraints | |
| # based on attributes of the request, the resource, or both. To learn which | |
| # resources support conditions in their IAM policies, see the | |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # | |
| # **JSON example:** | |
| # | |
| # ``` | |
| # { | |
| # "bindings": [ | |
| # { | |
| # "role": "roles/resourcemanager.organizationAdmin", | |
| # "members": [ | |
| # "user:mike@example.com", | |
| # "group:admins@example.com", | |
| # "domain:google.com", | |
| # "serviceAccount:my-project-id@appspot.gserviceaccount.com" | |
| # ] | |
| # }, | |
| # { | |
| # "role": "roles/resourcemanager.organizationViewer", | |
| # "members": [ | |
| # "user:eve@example.com" | |
| # ], | |
| # "condition": { | |
| # "title": "expirable access", | |
| # "description": "Does not grant access after Sep 2020", | |
| # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", | |
| # } | |
| # } | |
| # ], | |
| # "etag": "BwWWja0YfJA=", | |
| # "version": 3 | |
| # } | |
| # ``` | |
| # | |
| # **YAML example:** | |
| # | |
| # ``` | |
| # bindings: | |
| # - members: | |
| # - user:mike@example.com | |
| # - group:admins@example.com | |
| # - domain:google.com | |
| # - serviceAccount:my-project-id@appspot.gserviceaccount.com | |
| # role: roles/resourcemanager.organizationAdmin | |
| # - members: | |
| # - user:eve@example.com | |
| # role: roles/resourcemanager.organizationViewer | |
| # condition: | |
| # title: expirable access | |
| # description: Does not grant access after Sep 2020 | |
| # expression: request.time < timestamp('2020-10-01T00:00:00.000Z') | |
| # etag: BwWWja0YfJA= | |
| # version: 3 | |
| # ``` | |
| # | |
| # For a description of IAM and its features, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/). | |
| "auditConfigs": [ # Specifies cloud audit logging configuration for this policy. | |
| { # Specifies the audit configuration for a service. | |
| # The configuration determines which permission types are logged, and what | |
| # identities, if any, are exempted from logging. | |
| # An AuditConfig must have one or more AuditLogConfigs. | |
| # | |
| # If there are AuditConfigs for both `allServices` and a specific service, | |
| # the union of the two AuditConfigs is used for that service: the log_types | |
| # specified in each AuditConfig are enabled, and the exempted_members in each | |
| # AuditLogConfig are exempted. | |
| # | |
| # Example Policy with multiple AuditConfigs: | |
| # | |
| # { | |
| # "audit_configs": [ | |
| # { | |
| # "service": "allServices", | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ", | |
| # "exempted_members": [ | |
| # "user:jose@example.com" | |
| # ] | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE" | |
| # }, | |
| # { | |
| # "log_type": "ADMIN_READ" | |
| # } | |
| # ] | |
| # }, | |
| # { | |
| # "service": "sampleservice.googleapis.com", | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ" | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE", | |
| # "exempted_members": [ | |
| # "user:aliya@example.com" | |
| # ] | |
| # } | |
| # ] | |
| # } | |
| # ] | |
| # } | |
| # | |
| # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ | |
| # logging. It also exempts `jose@example.com` from DATA_READ logging, and | |
| # `aliya@example.com` from DATA_WRITE logging. | |
| "auditLogConfigs": [ # The configuration for logging of each type of permission. | |
| { # Provides the configuration for logging a type of permissions. | |
| # Example: | |
| # | |
| # { | |
| # "audit_log_configs": [ | |
| # { | |
| # "log_type": "DATA_READ", | |
| # "exempted_members": [ | |
| # "user:jose@example.com" | |
| # ] | |
| # }, | |
| # { | |
| # "log_type": "DATA_WRITE" | |
| # } | |
| # ] | |
| # } | |
| # | |
| # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting | |
| # jose@example.com from DATA_READ logging. | |
| "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of | |
| # permission. | |
| # Follows the same format of Binding.members. | |
| "A String", | |
| ], | |
| "logType": "A String", # The log type that this config enables. | |
| }, | |
| ], | |
| "service": "A String", # Specifies a service that will be enabled for audit logging. | |
| # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. | |
| # `allServices` is a special value that covers all services. | |
| }, | |
| ], | |
| "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, | |
| # may specify a `condition` that determines how and when the `bindings` are | |
| # applied. Each of the `bindings` must contain at least one principal. | |
| # | |
| # The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 | |
| # of these principals can be Google groups. Each occurrence of a principal | |
| # counts towards these limits. For example, if the `bindings` grant 50 | |
| # different roles to `user:alice@example.com`, and not to any other | |
| # principal, then you can add another 1,450 principals to the `bindings` in | |
| # the `Policy`. | |
| { # Associates `members`, or principals, with a `role`. | |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. | |
| # | |
| # If the condition evaluates to `true`, then this binding applies to the | |
| # current request. | |
| # | |
| # If the condition evaluates to `false`, then this binding does not apply to | |
| # the current request. However, a different role binding might grant the same | |
| # role to one or more of the principals in this binding. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM | |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL | |
| # are documented at https://github.com/google/cel-spec. | |
| # | |
| # Example (Comparison): | |
| # | |
| # title: "Summary size limit" | |
| # description: "Determines if a summary is less than 100 chars" | |
| # expression: "document.summary.size() < 100" | |
| # | |
| # Example (Equality): | |
| # | |
| # title: "Requestor is owner" | |
| # description: "Determines if requestor is the document owner" | |
| # expression: "document.owner == request.auth.claims.email" | |
| # | |
| # Example (Logic): | |
| # | |
| # title: "Public documents" | |
| # description: "Determine whether the document should be publicly visible" | |
| # expression: "document.type != 'private' && document.type != 'internal'" | |
| # | |
| # Example (Data Manipulation): | |
| # | |
| # title: "Notification string" | |
| # description: "Create a notification string with a timestamp." | |
| # expression: "'New message received at ' + string(document.create_time)" | |
| # | |
| # The exact variables and functions that may be referenced within an expression | |
| # are determined by the service that evaluates it. See the service | |
| # documentation for additional information. | |
| "description": "A String", # Optional. Description of the expression. This is a longer text which | |
| # describes the expression, e.g. when hovered over it in a UI. | |
| "expression": "A String", # Textual representation of an expression in Common Expression Language | |
| # syntax. | |
| "location": "A String", # Optional. String indicating the location of the expression for error | |
| # reporting, e.g. a file name and a position in the file. | |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing | |
| # its purpose. This can be used e.g. in UIs which allow to enter the | |
| # expression. | |
| }, | |
| "members": [ # Specifies the principals requesting access for a Google Cloud resource. | |
| # `members` can have the following values: | |
| # | |
| # * `allUsers`: A special identifier that represents anyone who is | |
| # on the internet; with or without a Google account. | |
| # | |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone | |
| # who is authenticated with a Google account or a service account. | |
| # Does not include identities that come from external identity providers | |
| # (IdPs) through identity federation. | |
| # | |
| # * `user:{emailid}`: An email address that represents a specific Google | |
| # account. For example, `alice@example.com` . | |
| # | |
| # | |
| # * `serviceAccount:{emailid}`: An email address that represents a Google | |
| # service account. For example, | |
| # `my-other-app@appspot.gserviceaccount.com`. | |
| # | |
| # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An | |
| # identifier for a | |
| # [Kubernetes service | |
| # account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). | |
| # For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. | |
| # | |
| # * `group:{emailid}`: An email address that represents a Google group. | |
| # For example, `admins@example.com`. | |
| # | |
| # | |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the | |
| # users of that domain. For example, `google.com` or `example.com`. | |
| # | |
| # | |
| # | |
| # | |
| # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workforce identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: | |
| # All workforce identities in a group. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All workforce identities with a specific attribute value. | |
| # | |
| # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: | |
| # All identities in a workforce identity pool. | |
| # | |
| # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: | |
| # A single identity in a workload identity pool. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: | |
| # A workload identity pool group. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: | |
| # All identities in a workload identity pool with a certain attribute. | |
| # | |
| # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: | |
| # All identities in a workload identity pool. | |
| # | |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a user that has been recently deleted. For | |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is | |
| # recovered, this value reverts to `user:{emailid}` and the recovered user | |
| # retains the role in the binding. | |
| # | |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus | |
| # unique identifier) representing a service account that has been recently | |
| # deleted. For example, | |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. | |
| # If the service account is undeleted, this value reverts to | |
| # `serviceAccount:{emailid}` and the undeleted service account retains the | |
| # role in the binding. | |
| # | |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique | |
| # identifier) representing a Google group that has been recently | |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If | |
| # the group is recovered, this value reverts to `group:{emailid}` and the | |
| # recovered group retains the role in the binding. | |
| # | |
| # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: | |
| # Deleted single identity in a workforce identity pool. For example, | |
| # `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`. | |
| "A String", | |
| ], | |
| "role": "A String", # Role that is assigned to the list of `members`, or principals. | |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. | |
| # | |
| # For an overview of the IAM roles and permissions, see the | |
| # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For | |
| # a list of the available pre-defined roles, see | |
| # [here](https://cloud.google.com/iam/docs/understanding-roles). | |
| }, | |
| ], | |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help | |
| # prevent simultaneous updates of a policy from overwriting each other. | |
| # It is strongly suggested that systems make use of the `etag` in the | |
| # read-modify-write cycle to perform policy updates in order to avoid race | |
| # conditions: An `etag` is returned in the response to `getIamPolicy`, and | |
| # systems are expected to put that etag in the request to `setIamPolicy` to | |
| # ensure that their change will be applied to the same version of the policy. | |
| # | |
| # **Important:** If you use IAM Conditions, you must include the `etag` field | |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows | |
| # you to overwrite a version `3` policy with a version `1` policy, and all of | |
| # the conditions in the version `3` policy are lost. | |
| "version": 42, # Specifies the format of the policy. | |
| # | |
| # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value | |
| # are rejected. | |
| # | |
| # Any operation that affects conditional role bindings must specify version | |
| # `3`. This requirement applies to the following operations: | |
| # | |
| # * Getting a policy that includes a conditional role binding | |
| # * Adding a conditional role binding to a policy | |
| # * Changing a conditional role binding in a policy | |
| # * Removing any role binding, with or without a condition, from a policy | |
| # that includes conditions | |
| # | |
| # **Important:** If you use IAM Conditions, you must include the `etag` field | |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows | |
| # you to overwrite a version `3` policy with a version `1` policy, and all of | |
| # the conditions in the version `3` policy are lost. | |
| # | |
| # If a policy does not include any conditions, operations on that policy may | |
| # specify any valid version or leave the field unset. | |
| # | |
| # To learn which resources support conditions in their IAM policies, see the | |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). | |
| }</pre> | |
| </div> | |
| <div class="method"> | |
| <code class="details" id="testIamPermissions">testIamPermissions(project, resource, body=None, x__xgafv=None)</code> | |
| <pre>Returns permissions that a caller has on the specified resource. | |
| *Caution* This resource is intended | |
| for use only by third-party partners who are creatingCloud Marketplace | |
| images. | |
| Args: | |
| project: string, Project ID for this request. (required) | |
| resource: string, Name or id of the resource for this request. (required) | |
| body: object, The request body. | |
| The object takes the form of: | |
| { | |
| "permissions": [ # The set of permissions to check for the 'resource'. Permissions with | |
| # wildcards (such as '*' or 'storage.*') are not allowed. | |
| "A String", | |
| ], | |
| } | |
| x__xgafv: string, V1 error format. | |
| Allowed values | |
| 1 - v1 error format | |
| 2 - v2 error format | |
| Returns: | |
| An object of the form: | |
| { | |
| "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is | |
| # allowed. | |
| "A String", | |
| ], | |
| }</pre> | |
| </div> | |
| </body></html> |