Index
AccessPolicies(interface)PolicyBindings(interface)PrincipalAccessBoundaryPolicies(interface)AccessPolicy(message)AccessPolicyDetails(message)AccessPolicyRule(message)AccessPolicyRule.Effect(enum)AccessPolicyRule.Operation(message)CreateAccessPolicyRequest(message)CreatePolicyBindingRequest(message)CreatePrincipalAccessBoundaryPolicyRequest(message)DeleteAccessPolicyRequest(message)DeletePolicyBindingRequest(message)DeletePrincipalAccessBoundaryPolicyRequest(message)GetAccessPolicyRequest(message)GetPolicyBindingRequest(message)GetPrincipalAccessBoundaryPolicyRequest(message)ListAccessPoliciesRequest(message)ListAccessPoliciesResponse(message)ListPolicyBindingsRequest(message)ListPolicyBindingsResponse(message)ListPrincipalAccessBoundaryPoliciesRequest(message)ListPrincipalAccessBoundaryPoliciesResponse(message)OperationMetadata(message)PolicyBinding(message)PolicyBinding.PolicyKind(enum)PolicyBinding.Target(message)PrincipalAccessBoundaryPolicy(message)PrincipalAccessBoundaryPolicyDetails(message)PrincipalAccessBoundaryPolicyRule(message)PrincipalAccessBoundaryPolicyRule.Effect(enum)SearchAccessPolicyBindingsRequest(message)SearchAccessPolicyBindingsResponse(message)SearchPrincipalAccessBoundaryPolicyBindingsRequest(message)SearchPrincipalAccessBoundaryPolicyBindingsResponse(message)SearchTargetPolicyBindingsRequest(message)SearchTargetPolicyBindingsResponse(message)UpdateAccessPolicyRequest(message)UpdatePolicyBindingRequest(message)UpdatePrincipalAccessBoundaryPolicyRequest(message)
AccessPolicies
Manages Identity and Access Management (IAM) access policies.
| CreateAccessPolicy |
|---|
|
Creates an access policy, and returns a long running operation.
|
| DeleteAccessPolicy |
|---|
|
Deletes an access policy.
|
| GetAccessPolicy |
|---|
|
Gets an access policy.
|
| ListAccessPolicies |
|---|
|
Lists access policies.
|
| SearchAccessPolicyBindings |
|---|
|
Returns all policy bindings that bind a specific policy if a user has searchPolicyBindings permission on that policy.
|
| UpdateAccessPolicy |
|---|
|
Updates an access policy.
|
PolicyBindings
An interface for managing Identity and Access Management (IAM) policy bindings.
| CreatePolicyBinding |
|---|
|
Creates a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is created, the policy is applied to the target.
|
| DeletePolicyBinding |
|---|
|
Deletes a policy binding and returns a long-running operation. Callers will need the IAM permissions on both the policy and target. After the binding is deleted, the policy no longer applies to the target.
|
| GetPolicyBinding |
|---|
|
Gets a policy binding.
|
| ListPolicyBindings |
|---|
|
Lists policy bindings.
|
| SearchTargetPolicyBindings |
|---|
|
Search policy bindings by target. Returns all policy binding objects bound directly to target.
|
| UpdatePolicyBinding |
|---|
|
Updates a policy binding and returns a long-running operation. Callers will need the IAM permissions on the policy and target in the binding to update. Target and policy are immutable and cannot be updated.
|
PrincipalAccessBoundaryPolicies
Manages Identity and Access Management (IAM) principal access boundary policies.
| CreatePrincipalAccessBoundaryPolicy |
|---|
|
Creates a principal access boundary policy, and returns a long running operation.
|
| DeletePrincipalAccessBoundaryPolicy |
|---|
|
Deletes a principal access boundary policy.
|
| GetPrincipalAccessBoundaryPolicy |
|---|
|
Gets a principal access boundary policy.
|
| ListPrincipalAccessBoundaryPolicies |
|---|
|
Lists principal access boundary policies.
|
| SearchPrincipalAccessBoundaryPolicyBindings |
|---|
|
Returns all policy bindings that bind a specific policy if a user has searchPolicyBindings permission on that policy.
|
| UpdatePrincipalAccessBoundaryPolicy |
|---|
|
Updates a principal access boundary policy.
|
AccessPolicy
An IAM access policy resource.
| Fields | |
|---|---|
name |
Identifier. The resource name of the access policy. The following formats are supported:
|
uid |
Output only. The globally unique ID of the access policy. |
etag |
Optional. The etag for the access policy. If this is provided on update, it must match the server's etag. |
display_name |
Optional. The description of the access policy. Must be less than or equal to 63 characters. |
annotations |
Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations |
create_time |
Output only. The time when the access policy was created. |
update_time |
Output only. The time when the access policy was most recently updated. |
details |
Optional. The details for the access policy. |
AccessPolicyDetails
Access policy details.
| Fields | |
|---|---|
rules[] |
Required. A list of access policy rules. |
AccessPolicyRule
Access Policy Rule that determines the behavior of the policy.
| Fields | |
|---|---|
principals[] |
Required. The identities for which this rule's effect governs using one or more permissions on Google Cloud resources. This field can contain the following values:
If an identifier that was previously set on a policy is soft deleted, then calls to read that policy will return the identifier with a deleted prefix. Users cannot set identifiers with this syntax.
|
excluded_principals[] |
Optional. The identities that are excluded from the access policy rule, even if they are listed in the |
operation |
Required. Attributes that are used to determine whether this rule applies to a request. |
conditions |
Optional. The conditions that determine whether this rule applies to a request. Conditions are identified by their key, which is the FQDN of the service that they are relevant to. For example: Each rule is evaluated independently. If this rule does not apply to a request, other rules might still apply. Currently supported keys are as follows:
|
description |
Optional. Customer specified description of the rule. Must be less than or equal to 256 characters. |
effect |
Required. The effect of the rule. |
Effect
An effect to describe the access relationship.
| Enums | |
|---|---|
EFFECT_UNSPECIFIED |
The effect is unspecified. |
DENY |
The policy will deny access if it evaluates to true. |
ALLOW |
The policy will grant access if it evaluates to true. |
Operation
Attributes that are used to determine whether this rule applies to a request.
| Fields | |
|---|---|
permissions[] |
Optional. The permissions that are explicitly affected by this rule. Each permission uses the format
|
excluded_permissions[] |
Optional. Specifies the permissions that this rule excludes from the set of affected permissions given by The excluded permissions can be specified using the same syntax as |
CreateAccessPolicyRequest
Request message for CreateAccessPolicy method.
| Fields | |
|---|---|
parent |
Required. The parent resource where this access policy will be created. Format: |
access_policy_id |
Required. The ID to use for the access policy, which will become the final component of the access policy's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /[a-z][a-z0-9-.]{2,62}/. This value must be unique among all access policies with the same parent. |
access_policy |
Required. The access policy to create. |
validate_only |
Optional. If set, validate the request and preview the creation, but do not actually post it. |
CreatePolicyBindingRequest
Request message for CreatePolicyBinding method.
| Fields | |
|---|---|
parent |
Required. The parent resource where this policy binding will be created. The binding parent is the closest Resource Manager resource (project, folder or organization) to the binding target. Format:
|
policy_binding_id |
Required. The ID to use for the policy binding, which will become the final component of the policy binding's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /[a-z][a-z0-9-.]{2,62}/. |
policy_binding |
Required. The policy binding to create. |
validate_only |
Optional. If set, validate the request and preview the creation, but do not actually post it. |
CreatePrincipalAccessBoundaryPolicyRequest
Request message for CreatePrincipalAccessBoundaryPolicyRequest method.
| Fields | |
|---|---|
parent |
Required. The parent resource where this principal access boundary policy will be created. Only organizations are supported. Format: |
principal_access_boundary_policy_id |
Required. The ID to use for the principal access boundary policy, which will become the final component of the principal access boundary policy's resource name. This value must start with a lowercase letter followed by up to 62 lowercase letters, numbers, hyphens, or dots. Pattern, /[a-z][a-z0-9-.]{2,62}/. |
principal_access_boundary_policy |
Required. The principal access boundary policy to create. |
validate_only |
Optional. If set, validate the request and preview the creation, but do not actually post it. |
DeleteAccessPolicyRequest
Request message for DeleteAccessPolicy method.
| Fields | |
|---|---|
name |
Required. The name of the access policy to delete. Format: |
etag |
Optional. The etag of the access policy. If this is provided, it must match the server's etag. |
validate_only |
Optional. If set, validate the request and preview the deletion, but do not actually post it. |
force |
Optional. If set to true, the request will force the deletion of the Policy even if the Policy references PolicyBindings. |
DeletePolicyBindingRequest
Request message for DeletePolicyBinding method.
| Fields | |
|---|---|
name |
Required. The name of the policy binding to delete. Format:
|
etag |
Optional. The etag of the policy binding. If this is provided, it must match the server's etag. |
validate_only |
Optional. If set, validate the request and preview the deletion, but do not actually post it. |
DeletePrincipalAccessBoundaryPolicyRequest
Request message for DeletePrincipalAccessBoundaryPolicy method.
| Fields | |
|---|---|
name |
Required. The name of the principal access boundary policy to delete. Format: |
etag |
Optional. The etag of the principal access boundary policy. If this is provided, it must match the server's etag. |
validate_only |
Optional. If set, validate the request and preview the deletion, but do not actually post it. |
force |
Optional. If set to true, the request will force the deletion of the policy even if the policy is referenced in policy bindings. |
GetAccessPolicyRequest
Request message for GetAccessPolicy method.
| Fields | |
|---|---|
name |
Required. The name of the access policy to retrieve. Format: |
GetPolicyBindingRequest
Request message for GetPolicyBinding method.
| Fields | |
|---|---|
name |
Required. The name of the policy binding to retrieve. Format:
|
GetPrincipalAccessBoundaryPolicyRequest
Request message for GetPrincipalAccessBoundaryPolicy method.
| Fields | |
|---|---|
name |
Required. The name of the principal access boundary policy to retrieve. Format: |
ListAccessPoliciesRequest
Request message for ListAccessPolicies method.
| Fields | |
|---|---|
parent |
Required. The parent resource, which owns the collection of access policy resources. Format: |
page_size |
Optional. The maximum number of access policies to return. The service may return fewer than this value. If unspecified, at most 50 access policies will be returned. Valid value ranges from 1 to 1000; values above 1000 will be coerced to 1000. |
page_token |
Optional. A page token, received from a previous When paginating, all other parameters provided to |
ListAccessPoliciesResponse
Response message for ListAccessPolicies method.
| Fields | |
|---|---|
access_policies[] |
The access policies from the specified parent. |
next_page_token |
Optional. A token, which can be sent as |
ListPolicyBindingsRequest
Request message for ListPolicyBindings method.
| Fields | |
|---|---|
parent |
Required. The parent resource, which owns the collection of policy bindings. Format:
|
page_size |
Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000. |
page_token |
Optional. A page token, received from a previous When paginating, all other parameters provided to |
filter |
Optional. An expression for filtering the results of the request. Filter rules are case insensitive. Some eligible fields for filtering are the following:
Some examples of filter queries:
|
ListPolicyBindingsResponse
Response message for ListPolicyBindings method.
| Fields | |
|---|---|
policy_bindings[] |
The policy bindings from the specified parent. |
next_page_token |
Optional. A token, which can be sent as |
ListPrincipalAccessBoundaryPoliciesRequest
Request message for ListPrincipalAccessBoundaryPolicies method.
| Fields | |
|---|---|
parent |
Required. The parent resource, which owns the collection of principal access boundary policies. Format: |
page_size |
Optional. The maximum number of principal access boundary policies to return. The service may return fewer than this value. If unspecified, at most 50 principal access boundary policies will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000. |
page_token |
Optional. A page token, received from a previous When paginating, all other parameters provided to |
ListPrincipalAccessBoundaryPoliciesResponse
Response message for ListPrincipalAccessBoundaryPolicies method.
| Fields | |
|---|---|
principal_access_boundary_policies[] |
The principal access boundary policies from the specified parent. |
next_page_token |
Optional. A token, which can be sent as |
OperationMetadata
Represents the metadata of the long-running operation.
| Fields | |
|---|---|
create_time |
Output only. The time the operation was created. |
end_time |
Output only. The time the operation finished running. |
target |
Output only. Server-defined resource path for the target of the |
verb |
Output only. Name of the verb executed by the operation. |
status_message |
Output only. Human-readable status of the operation, if any. |
requested_cancellation |
Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have [Operation.error][] value with a |
api_version |
Output only. API version used to start the operation. |
PolicyBinding
IAM policy binding resource.
| Fields | |
|---|---|
name |
Identifier. The name of the policy binding, in the format Format:
|
uid |
Output only. The globally unique ID of the policy binding. Assigned when the policy binding is created. |
etag |
Optional. The etag for the policy binding. If this is provided on update, it must match the server's etag. |
display_name |
Optional. The description of the policy binding. Must be less than or equal to 63 characters. |
annotations |
Optional. User-defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations |
target |
Required. Immutable. The full resource name of the resource to which the policy will be bound. Immutable once set. |
policy_kind |
Immutable. The kind of the policy to attach in this binding. This field must be one of the following:
|
policy |
Required. Immutable. The resource name of the policy to be bound. The binding parent and policy must belong to the same organization. |
policy_uid |
Output only. The globally unique ID of the policy to be bound. |
condition |
Optional. The condition to apply to the policy binding. When set, the The condition is currently only supported when bound to policies of kind principal access boundary. When the bound policy is a principal access boundary policy, the only supported attributes in any subexpression are Allowed operations for
Allowed operations for
Supported principal types are Workspace, Workforce Pool, Workload Pool and Service Account. Allowed string must be one of:
|
create_time |
Output only. The time when the policy binding was created. |
update_time |
Output only. The time when the policy binding was most recently updated. |
PolicyKind
The different policy kinds supported in this binding.
| Enums | |
|---|---|
POLICY_KIND_UNSPECIFIED |
Unspecified policy kind; Not a valid state |
PRINCIPAL_ACCESS_BOUNDARY |
Principal access boundary policy kind |
ACCESS |
Access policy kind. |
Target
The full resource name of the resource to which the policy will be bound. Immutable once set.
| Fields | |
|---|---|
Union field target. The different types of targets that can be bound to a policy. target can be only one of the following: |
|
principal_set |
Immutable. The full resource name that's used for principal access boundary policy bindings. The principal set must be directly parented by the policy binding's parent or same as the parent if the target is a project, folder, or organization. Examples:
|
resource |
Immutable. The full resource name that's used for access policy bindings. Examples:
|
PrincipalAccessBoundaryPolicy
An IAM principal access boundary policy resource.
| Fields | |
|---|---|
name |
Identifier. The resource name of the principal access boundary policy. The following format is supported: |
uid |
Output only. The globally unique ID of the principal access boundary policy. |
etag |
Optional. The etag for the principal access boundary. If this is provided on update, it must match the server's etag. |
display_name |
Optional. The description of the principal access boundary policy. Must be less than or equal to 63 characters. |
annotations |
Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations |
create_time |
Output only. The time when the principal access boundary policy was created. |
update_time |
Output only. The time when the principal access boundary policy was most recently updated. |
details |
Optional. The details for the principal access boundary policy. |
PrincipalAccessBoundaryPolicyDetails
Principal access boundary policy details
| Fields | |
|---|---|
rules[] |
Required. A list of principal access boundary policy rules. The number of rules in a policy is limited to 500. |
enforcement_version |
Optional. The version number (for example, |
PrincipalAccessBoundaryPolicyRule
Principal access boundary policy rule that defines the resource boundary.
| Fields | |
|---|---|
description |
Optional. The description of the principal access boundary policy rule. Must be less than or equal to 256 characters. |
resources[] |
Required. A list of Resource Manager resources. If a resource is listed in the rule, then the rule applies for that resource and its descendants. The number of resources in a policy is limited to 500 across all rules in the policy. The following resource types are supported:
|
effect |
Required. The access relationship of principals to the resources in this rule. |
Effect
An effect to describe the access relationship.
| Enums | |
|---|---|
EFFECT_UNSPECIFIED |
Effect unspecified. |
ALLOW |
Allows access to the resources in this rule. |
SearchAccessPolicyBindingsRequest
Request message for SearchAccessPolicyBindings rpc.
| Fields | |
|---|---|
name |
Required. The name of the access policy. Format: |
page_size |
Optional. The maximum number of policy bindings to return. The service may return fewer than this value. If unspecified, at most 50 policy bindings will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000. |
page_token |
Optional. A page token, received from a previous When paginating, all other parameters provided to |
SearchAccessPolicyBindingsResponse
Response message for SearchAccessPolicyBindings rpc.
| Fields | |
|---|---|
policy_bindings[] |
The policy bindings that reference the specified policy. |
next_page_token |
Optional. A token, which can be sent as |
SearchPrincipalAccessBoundaryPolicyBindingsRequest
Request message for SearchPrincipalAccessBoundaryPolicyBindings rpc.
| Fields | |
|---|---|
name |
Required. The name of the principal access boundary policy. Format: |
page_size |
Optional. The maximum number of policy bindings to return. The service may return fewer than this value. If unspecified, at most 50 policy bindings will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000. |
page_token |
Optional. A page token, received from a previous When paginating, all other parameters provided to |
SearchPrincipalAccessBoundaryPolicyBindingsResponse
Response message for SearchPrincipalAccessBoundaryPolicyBindings rpc.
| Fields | |
|---|---|
policy_bindings[] |
The policy bindings that reference the specified policy. |
next_page_token |
Optional. A token, which can be sent as |
SearchTargetPolicyBindingsRequest
Request message for SearchTargetPolicyBindings method.
| Fields | |
|---|---|
target |
Required. The target resource, which is bound to the policy in the binding. Format:
|
page_size |
Optional. The maximum number of policy bindings to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000. |
page_token |
Optional. A page token, received from a previous When paginating, all other parameters provided to |
parent |
Required. The parent resource where this search will be performed. This should be the nearest Resource Manager resource (project, folder, or organization) to the target. Format:
|
filter |
Optional. Filtering currently only supports the kind of policies to return, and must be in the format "policy_kind={policy_kind}". If String is empty, bindings bound to all kinds of policies would be returned. The only supported values are the following:
|
SearchTargetPolicyBindingsResponse
Response message for SearchTargetPolicyBindings method.
| Fields | |
|---|---|
policy_bindings[] |
The policy bindings bound to the specified target. |
next_page_token |
Optional. A token, which can be sent as |
UpdateAccessPolicyRequest
Request message for UpdateAccessPolicy method.
| Fields | |
|---|---|
access_policy |
Required. The access policy to update. The access policy's |
validate_only |
Optional. If set, validate the request and preview the update, but do not actually post it. |
UpdatePolicyBindingRequest
Request message for UpdatePolicyBinding method.
| Fields | |
|---|---|
policy_binding |
Required. The policy binding to update. The policy binding's |
validate_only |
Optional. If set, validate the request and preview the update, but do not actually post it. |
update_mask |
Optional. The list of fields to update |
UpdatePrincipalAccessBoundaryPolicyRequest
Request message for UpdatePrincipalAccessBoundaryPolicy method.
| Fields | |
|---|---|
principal_access_boundary_policy |
Required. The principal access boundary policy to update. The principal access boundary policy's |
validate_only |
Optional. If set, validate the request and preview the update, but do not actually post it. |
update_mask |
Optional. The list of fields to update |