public sealed class IamPolicyAnalysisQuery.Types.Options : IMessage<IamPolicyAnalysisQuery.Types.Options>, IEquatable<IamPolicyAnalysisQuery.Types.Options>, IDeepCloneable<IamPolicyAnalysisQuery.Types.Options>, IBufferMessage, IMessage
Reference documentation and code samples for the Google Cloud Asset Inventory v1 API class IamPolicyAnalysisQuery.Types.Options.
public bool AnalyzeServiceAccountImpersonation { get; set; }
Optional. If true, the response will include access analysis from
identities to resources via service account impersonation. This is a very
expensive operation, because many derived queries will be executed. We
highly recommend you use
[AssetService.AnalyzeIamPolicyLongrunning][google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning]
RPC instead.
For example, if the request analyzes for which resources user A has
permission P, and there's an IAM policy states user A has
iam.serviceAccounts.getAccessToken permission to a service account SA,
and there's another IAM policy states service account SA has permission P
to a Google Cloud folder F, then user A potentially has access to the
Google Cloud folder F. And those advanced analysis results will be
included in
[AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
Another example, if the request analyzes for who has
permission P to a Google Cloud folder F, and there's an IAM policy states
user A has iam.serviceAccounts.actAs permission to a service account SA,
and there's another IAM policy states service account SA has permission P
to the Google Cloud folder F, then user A potentially has access to the
Google Cloud folder F. And those advanced analysis results will be
included in
[AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
Only the following permissions are considered in this analysis:
Optional. If true, the identities section of the result will expand any
Google groups appearing in an IAM policy binding.
If
[IamPolicyAnalysisQuery.identity_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.identity_selector]
is specified, the identity in the result will be determined by the
selector, and this flag is not allowed to set.
If true, the default max expansion per group is 1000 for
AssetService.AnalyzeIamPolicy][].
Optional. If true and
[IamPolicyAnalysisQuery.resource_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.resource_selector]
is not specified, the resource section of the result will expand any
resource attached to an IAM policy to include resources lower in the
resource hierarchy.
For example, if the request analyzes for which resources user A has
permission P, and the results include an IAM policy with P on a Google
Cloud folder, the results will also include resources in that folder with
permission P.
If true and
[IamPolicyAnalysisQuery.resource_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.resource_selector]
is specified, the resource section of the result will expand the
specified resource to include resources lower in the resource hierarchy.
Only project or lower resources are supported. Folder and organization
resources cannot be used together with this option.
For example, if the request analyzes for which users have permission P on
a Google Cloud project with this option enabled, the results will include
all users who have permission P on that project or any lower resource.
If true, the default max expansion per resource is 1000 for
AssetService.AnalyzeIamPolicy][] and 100000 for
AssetService.AnalyzeIamPolicyLongrunning][].
Optional. If true, the access section of result will expand any roles
appearing in IAM policy bindings to include their permissions.
If
[IamPolicyAnalysisQuery.access_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.access_selector]
is specified, the access section of the result will be determined by the
selector, and this flag is not allowed to set.
Optional. If true, the result will output the relevant membership
relationships between groups and other groups, and between groups and
principals. Default is false.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThe provided content details the \u003ccode\u003eIamPolicyAnalysisQuery.Types.Options\u003c/code\u003e class within the Google Cloud Asset Inventory v1 API, offering various version-specific documentation links.\u003c/p\u003e\n"],["\u003cp\u003eThis class, \u003ccode\u003eIamPolicyAnalysisQuery.Types.Options\u003c/code\u003e, provides query options for analyzing IAM policies, and implements interfaces such as \u003ccode\u003eIMessage\u003c/code\u003e, \u003ccode\u003eIEquatable\u003c/code\u003e, \u003ccode\u003eIDeepCloneable\u003c/code\u003e, and \u003ccode\u003eIBufferMessage\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eOptions\u003c/code\u003e class has several properties including \u003ccode\u003eAnalyzeServiceAccountImpersonation\u003c/code\u003e, \u003ccode\u003eExpandGroups\u003c/code\u003e, \u003ccode\u003eExpandResources\u003c/code\u003e, \u003ccode\u003eExpandRoles\u003c/code\u003e, \u003ccode\u003eOutputGroupEdges\u003c/code\u003e, and \u003ccode\u003eOutputResourceEdges\u003c/code\u003e, all of which are optional boolean settings that modify the scope and depth of the analysis.\u003c/p\u003e\n"],["\u003cp\u003eThe latest version available is 3.12.0, with a comprehensive list of previous versions provided, going down to version 2.7.0, which users can browse through for their specific needs.\u003c/p\u003e\n"],["\u003cp\u003eThis documentation page for the Options class allows for version-specific exploration, and includes the ability to see inherited members, constructors, namespace, and assembly information.\u003c/p\u003e\n"]]],[],null,["# Google Cloud Asset Inventory v1 API - Class IamPolicyAnalysisQuery.Types.Options (3.13.0)\n\nVersion latestkeyboard_arrow_down\n\n- [3.13.0 (latest)](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.12.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.12.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.11.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.11.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.10.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.10.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.9.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.9.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.8.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.8.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.7.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.7.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.6.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.6.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.5.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.5.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.4.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.4.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.3.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.3.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.2.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.2.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.1.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.1.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [3.0.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/3.0.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [2.11.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/2.11.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [2.10.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/2.10.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [2.9.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/2.9.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [2.8.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/2.8.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options)\n- [2.7.0](/dotnet/docs/reference/Google.Cloud.Asset.V1/2.7.0/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options) \n\n public sealed class IamPolicyAnalysisQuery.Types.Options : IMessage\u003cIamPolicyAnalysisQuery.Types.Options\u003e, IEquatable\u003cIamPolicyAnalysisQuery.Types.Options\u003e, IDeepCloneable\u003cIamPolicyAnalysisQuery.Types.Options\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Google Cloud Asset Inventory v1 API class IamPolicyAnalysisQuery.Types.Options.\n\nContains query options. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e IamPolicyAnalysisQuery.Types.Options \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[IamPolicyAnalysisQuery](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery)[Types](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types)[Options](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[IamPolicyAnalysisQuery](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery)[Types](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types)[Options](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[IamPolicyAnalysisQuery](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery)[Types](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types)[Options](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1.IamPolicyAnalysisQuery.Types.Options), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Cloud.Asset.V1](/dotnet/docs/reference/Google.Cloud.Asset.V1/latest/Google.Cloud.Asset.V1)\n\nAssembly\n--------\n\nGoogle.Cloud.Asset.V1.dll\n\nConstructors\n------------\n\n### Options()\n\n public Options()\n\n### Options(Options)\n\n public Options(IamPolicyAnalysisQuery.Types.Options other)\n\nProperties\n----------\n\n### AnalyzeServiceAccountImpersonation\n\n public bool AnalyzeServiceAccountImpersonation { get; set; }\n\nOptional. If true, the response will include access analysis from\nidentities to resources via service account impersonation. This is a very\nexpensive operation, because many derived queries will be executed. We\nhighly recommend you use\n\\[AssetService.AnalyzeIamPolicyLongrunning\\]\\[google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning\\]\nRPC instead.\n\nFor example, if the request analyzes for which resources user A has\npermission P, and there's an IAM policy states user A has\niam.serviceAccounts.getAccessToken permission to a service account SA,\nand there's another IAM policy states service account SA has permission P\nto a Google Cloud folder F, then user A potentially has access to the\nGoogle Cloud folder F. And those advanced analysis results will be\nincluded in\n\\[AnalyzeIamPolicyResponse.service_account_impersonation_analysis\\]\\[google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis\\].\n\nAnother example, if the request analyzes for who has\npermission P to a Google Cloud folder F, and there's an IAM policy states\nuser A has iam.serviceAccounts.actAs permission to a service account SA,\nand there's another IAM policy states service account SA has permission P\nto the Google Cloud folder F, then user A potentially has access to the\nGoogle Cloud folder F. And those advanced analysis results will be\nincluded in\n\\[AnalyzeIamPolicyResponse.service_account_impersonation_analysis\\]\\[google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis\\].\n\nOnly the following permissions are considered in this analysis:\n\n- `iam.serviceAccounts.actAs`\n- `iam.serviceAccounts.signBlob`\n- `iam.serviceAccounts.signJwt`\n- `iam.serviceAccounts.getAccessToken`\n- `iam.serviceAccounts.getOpenIdToken`\n- `iam.serviceAccounts.implicitDelegation`\n\nDefault is false.\n\n### ExpandGroups\n\n public bool ExpandGroups { get; set; }\n\nOptional. If true, the identities section of the result will expand any\nGoogle groups appearing in an IAM policy binding.\n\nIf\n\\[IamPolicyAnalysisQuery.identity_selector\\]\\[google.cloud.asset.v1.IamPolicyAnalysisQuery.identity_selector\\]\nis specified, the identity in the result will be determined by the\nselector, and this flag is not allowed to set.\n\nIf true, the default max expansion per group is 1000 for\nAssetService.AnalyzeIamPolicy\\]\\[\\].\n\nDefault is false.\n\n### ExpandResources\n\n public bool ExpandResources { get; set; }\n\nOptional. If true and\n\\[IamPolicyAnalysisQuery.resource_selector\\]\\[google.cloud.asset.v1.IamPolicyAnalysisQuery.resource_selector\\]\nis not specified, the resource section of the result will expand any\nresource attached to an IAM policy to include resources lower in the\nresource hierarchy.\n\nFor example, if the request analyzes for which resources user A has\npermission P, and the results include an IAM policy with P on a Google\nCloud folder, the results will also include resources in that folder with\npermission P.\n\nIf true and\n\\[IamPolicyAnalysisQuery.resource_selector\\]\\[google.cloud.asset.v1.IamPolicyAnalysisQuery.resource_selector\\]\nis specified, the resource section of the result will expand the\nspecified resource to include resources lower in the resource hierarchy.\nOnly project or lower resources are supported. Folder and organization\nresources cannot be used together with this option.\n\nFor example, if the request analyzes for which users have permission P on\na Google Cloud project with this option enabled, the results will include\nall users who have permission P on that project or any lower resource.\n\nIf true, the default max expansion per resource is 1000 for\nAssetService.AnalyzeIamPolicy\\]\\[\\] and 100000 for\nAssetService.AnalyzeIamPolicyLongrunning\\]\\[\\].\n\nDefault is false.\n\n### ExpandRoles\n\n public bool ExpandRoles { get; set; }\n\nOptional. If true, the access section of result will expand any roles\nappearing in IAM policy bindings to include their permissions.\n\nIf\n\\[IamPolicyAnalysisQuery.access_selector\\]\\[google.cloud.asset.v1.IamPolicyAnalysisQuery.access_selector\\]\nis specified, the access section of the result will be determined by the\nselector, and this flag is not allowed to set.\n\nDefault is false.\n\n### OutputGroupEdges\n\n public bool OutputGroupEdges { get; set; }\n\nOptional. If true, the result will output the relevant membership\nrelationships between groups and other groups, and between groups and\nprincipals. Default is false.\n\n### OutputResourceEdges\n\n public bool OutputResourceEdges { get; set; }\n\nOptional. If true, the result will output the relevant parent/child\nrelationships between resources. Default is false."]]
