Some or all of the information on this page might not apply to Cloud de Confiance by S3NS. See Differences from Google Cloud for more details.

Package google.iam.v1

Index

IAMPolicy (interface)
Binding (message)
GetIamPolicyRequest (message)
GetPolicyOptions (message)
Policy (message)
SetIamPolicyRequest (message)
TestIamPermissionsRequest (message)
TestIamPermissionsResponse (message)

IAMPolicy

API Overview

Manages Identity and Access Management (IAM) policies.

Any implementation of an API that offers access control features implements the google.iam.v1.IAMPolicy interface.

Data model

Access control is applied when a principal (user or service account), takes some action on a resource exposed by a service. Resources, identified by URI-like names, are the unit of access control specification. Service implementations can choose the granularity of access control and the supported permissions for their resources. For example one database service may allow access control to be specified only at the Table level, whereas another might allow access control to also be specified at the Column level.

Policy Structure

See google.iam.v1.Policy

This is intentionally not a CRUD style API because access control policies are created and deleted implicitly with the resources to which they are attached.

GetIamPolicy
The method `google.iam.v1.IAMPolicy.GetIamPolicy` is not available in Cloud de Confiance by S3NS.

SetIamPolicy
The method `google.iam.v1.IAMPolicy.SetIamPolicy` is not available in Cloud de Confiance by S3NS.

TestIamPermissions
The method `google.iam.v1.IAMPolicy.TestIamPermissions` is not available in Cloud de Confiance by S3NS.

Binding

Associates members, or principals, with a role.

Fields

Fields
`role`	`string` Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
`members[]`	`string` Specifies the principals requesting access for a Cloud de Confiance resource. `members` can have the following values:
`condition`	`Expr` The condition that is associated with this binding.

role

string

Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner.

members[]

string

Specifies the principals requesting access for a Cloud de Confiance resource. members can have the following values:

condition

Expr

The condition that is associated with this binding.

GetIamPolicyRequest

Request message for GetIamPolicy method.

Fields

Fields
`resource`	`string` REQUIRED: The resource for which the policy is being requested. google.com/apis/design/resource_names) for the appropriate value for this field.
`options`	`GetPolicyOptions` OPTIONAL: A `GetPolicyOptions` object for specifying options to `GetIamPolicy`.

resource

string

REQUIRED: The resource for which the policy is being requested. google.com/apis/design/resource_names) for the appropriate value for this field.

options

GetPolicyOptions

OPTIONAL: A GetPolicyOptions object for specifying options to GetIamPolicy.

GetPolicyOptions

Encapsulates settings provided to GetIamPolicy.

Fields

Fields
`requested_policy_version`	`int32` Optional. The maximum policy version that will be used to format the policy.

requested_policy_version

int32

Optional. The maximum policy version that will be used to format the policy.

Policy

An Identity and Access Management (IAM) policy, which specifies access controls for Cloud de Confiance resources.

Fields

Fields
`version`	`int32` Specifies the format of the policy.
`bindings[]`	`Binding` Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal.
`etag`	`bytes` `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.

version

int32

Specifies the format of the policy.

bindings[]

Binding

Associates a list of members, or principals, with a role. Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one principal.

etag

bytes

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy.

Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.

SetIamPolicyRequest

Request message for SetIamPolicy method.

Fields

Fields
`resource`	`string` REQUIRED: The resource for which the policy is being specified. google.com/apis/design/resource_names) for the appropriate value for this field.
`policy`	`Policy` REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud de Confiance services (such as Projects) might reject them.

resource

string

REQUIRED: The resource for which the policy is being specified. google.com/apis/design/resource_names) for the appropriate value for this field.

policy

Policy

REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud de Confiance services (such as Projects) might reject them.

TestIamPermissionsRequest

Request message for TestIamPermissions method.

Fields

Fields
`resource`	`string` REQUIRED: The resource for which the policy detail is being requested. google.com/apis/design/resource_names) for the appropriate value for this field.
`permissions[]`	`string` The set of permissions to check for the `resource`. Permissions with wildcards (such as `` or `storage.`) are not allowed. For more information see IAM Overview.

resource

string

REQUIRED: The resource for which the policy detail is being requested. google.com/apis/design/resource_names) for the appropriate value for this field.

permissions[]

string

The set of permissions to check for the resource. Permissions with wildcards (such as * or storage.*) are not allowed. For more information see IAM Overview.

TestIamPermissionsResponse

Response message for TestIamPermissions method.

Fields

Fields
`permissions[]`	`string` A subset of `TestPermissionsRequest.permissions` that the caller is allowed.

permissions[]

string

A subset of TestPermissionsRequest.permissions that the caller is allowed.