public sealed class ExplainedDenyResource : IMessage<ExplainedDenyResource>, IEquatable<ExplainedDenyResource>, IDeepCloneable<ExplainedDenyResource>, IBufferMessage, IMessage
Reference documentation and code samples for the Policy Troubleshooter v3 API class ExplainedDenyResource.
Details about how a specific resource contributed to the deny policy
evaluation.
public DenyAccessState DenyAccessState { get; set; }
Required. Indicates whether any policies attached to this resource deny
the specific permission to the specified principal for the specified
resource.
This field does not indicate whether the principal actually has the
permission for the resource. There might be another policy that overrides
this policy. To determine whether the principal actually has the
permission, use the overall_access_state field in the
[TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
public RepeatedField<ExplainedDenyPolicy> ExplainedPolicies { get; }
List of IAM deny policies that were evaluated to check the principal's
denied permissions, with annotations to indicate how each policy
contributed to the final result.
The full resource name that identifies the resource. For example,
//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance.
If the sender of the request does not have access to the policy, this field
is omitted.
The relevance of this policy to the overall access state in the
[TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
If the sender of the request does not have access to the policy, this field
is omitted.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThe \u003ccode\u003eExplainedDenyResource\u003c/code\u003e class in the Policy Troubleshooter v3 API provides details on how a specific resource contributes to deny policy evaluation.\u003c/p\u003e\n"],["\u003cp\u003eThis class is part of the \u003ccode\u003eGoogle.Cloud.PolicyTroubleshooter.Iam.V3\u003c/code\u003e namespace and is implemented within the \u003ccode\u003eGoogle.Cloud.PolicyTroubleshooter.Iam.V3.dll\u003c/code\u003e assembly.\u003c/p\u003e\n"],["\u003cp\u003eIt provides properties like \u003ccode\u003eDenyAccessState\u003c/code\u003e, \u003ccode\u003eExplainedPolicies\u003c/code\u003e, \u003ccode\u003eFullResourceName\u003c/code\u003e, and \u003ccode\u003eRelevance\u003c/code\u003e to analyze the impact of deny policies.\u003c/p\u003e\n"],["\u003cp\u003eThe latest version is 1.2.0, with previous versions 1.1.0 and 1.0.0 available.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003eExplainedDenyResource\u003c/code\u003e implements multiple interfaces, including \u003ccode\u003eIMessage\u003c/code\u003e, \u003ccode\u003eIEquatable\u003c/code\u003e, and \u003ccode\u003eIDeepCloneable\u003c/code\u003e, and inherits from \u003ccode\u003eobject\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Policy Troubleshooter v3 API - Class ExplainedDenyResource (1.2.0)\n\nVersion latestkeyboard_arrow_down\n\n- [1.2.0 (latest)](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyResource)\n- [1.1.0](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/1.1.0/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyResource)\n- [1.0.0](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/1.0.0/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyResource) \n\n public sealed class ExplainedDenyResource : IMessage\u003cExplainedDenyResource\u003e, IEquatable\u003cExplainedDenyResource\u003e, IDeepCloneable\u003cExplainedDenyResource\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Policy Troubleshooter v3 API class ExplainedDenyResource.\n\nDetails about how a specific resource contributed to the deny policy\nevaluation. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e ExplainedDenyResource \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[ExplainedDenyResource](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyResource), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[ExplainedDenyResource](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyResource), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[ExplainedDenyResource](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyResource), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Cloud.PolicyTroubleshooter.Iam.V3](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3)\n\nAssembly\n--------\n\nGoogle.Cloud.PolicyTroubleshooter.Iam.V3.dll\n\nConstructors\n------------\n\n### ExplainedDenyResource()\n\n public ExplainedDenyResource()\n\n### ExplainedDenyResource(ExplainedDenyResource)\n\n public ExplainedDenyResource(ExplainedDenyResource other)\n\nProperties\n----------\n\n### DenyAccessState\n\n public DenyAccessState DenyAccessState { get; set; }\n\nRequired. Indicates whether any policies attached to *this resource* deny\nthe specific permission to the specified principal for the specified\nresource.\n\nThis field does *not* indicate whether the principal actually has the\npermission for the resource. There might be another policy that overrides\nthis policy. To determine whether the principal actually has the\npermission, use the `overall_access_state` field in the\n\\[TroubleshootIamPolicyResponse\\]\\[google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse\\].\n\n### ExplainedPolicies\n\n public RepeatedField\u003cExplainedDenyPolicy\u003e ExplainedPolicies { get; }\n\nList of IAM deny policies that were evaluated to check the principal's\ndenied permissions, with annotations to indicate how each policy\ncontributed to the final result.\n\n### FullResourceName\n\n public string FullResourceName { get; set; }\n\nThe full resource name that identifies the resource. For example,\n`//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.\n\nIf the sender of the request does not have access to the policy, this field\nis omitted.\n\nFor examples of full resource names for Google Cloud services, see\n\u003chttps://cloud.google.com/iam/help/troubleshooter/full-resource-names\u003e.\n\n### Relevance\n\n public HeuristicRelevance Relevance { get; set; }\n\nThe relevance of this policy to the overall access state in the\n\\[TroubleshootIamPolicyResponse\\]\\[google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse\\].\n\nIf the sender of the request does not have access to the policy, this field\nis omitted."]]
