Configurar a API Policy

Esta página explica como configurar a API Cloud Identity Policy antes de listar e obter políticas.

Instale a biblioteca cliente Python

Para instalar a biblioteca cliente Python, execute o seguinte comando:

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

Para mais informações sobre como configurar o seu ambiente de programação Python, consulte o guia de configuração do ambiente de programação Python.

Ative a API e configure as credenciais da conta de serviço

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Roles required to select or create a project
• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
Go to project selector
Verify that billing is enabled for your Google Cloud project.
Enable the Cloud Identity API.
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.
Enable the API
Create a service account:
1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator). Learn how to grant roles.

2. In the Google Cloud console, go to the Create service account page.

   Go to Create service account
3. Select your project.

4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

   In the Service account description field, enter a description. For example, Service account for quickstart.

5. Click Create and continue.

6. Grant the Project > Owner role to the service account.

   To grant the role, find the Select a role list, then select Project > Owner.

   Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
7. Click Continue.

8. Click Done to finish creating the service account.

   Do not close your browser window. You will use it in the next step.
Create a service account key:
1. In the Google Cloud console, click the email address for the service account that you created.
2. Click Keys.
3. Click Add key, and then click Create new key.
4. Click Create. A JSON key file is downloaded to your computer.
5. Click Close.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Cloud Identity API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

Create a service account:

1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator). Learn how to grant roles.

2. In the Google Cloud console, go to the Create service account page.

   Go to Create service account
3. Select your project.

4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

   In the Service account description field, enter a description. For example, Service account for quickstart.

5. Click Create and continue.

6. Grant the Project > Owner role to the service account.

   To grant the role, find the Select a role list, then select Project > Owner.

   Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
7. Click Continue.

8. Click Done to finish creating the service account.

   Do not close your browser window. You will use it in the next step.

Create a service account key:

1. In the Google Cloud console, click the email address for the service account that you created.
2. Click Keys.
3. Click Add key, and then click Create new key.
4. Click Create. A JSON key file is downloaded to your computer.
5. Click Close.

Autentique-se como uma conta de serviço com delegação ao nível do domínio

Se for um administrador que gere políticas de identidade ou quiser fornecer uma conta com privilégios ao nível do domínio para que possa gerir políticas Google em nome dos administradores, deve autenticar-se como uma conta de serviço e, em seguida, conceder privilégios ao nível do domínio à conta de serviço.

Nota: uma vez que a delegação ao nível do domínio permite que a conta de serviço se faça passar por um utilizador administrador, as ações da conta de serviço são registadas como tendo sido realizadas pelo utilizador.

Para ver detalhes sobre a configuração da delegação ao nível do domínio, consulte o artigo Controle o acesso à API com a delegação ao nível do domínio.

Para se autenticar como uma conta de serviço, consulte o artigo Usar o OAuth 2.0 para aplicações de servidor a servidor. Quando inicializar a credencial no seu código, especifique o endereço de email no qual a conta de serviço atua chamando with_subject() na credencial. Por exemplo:

Python

credentials = service_account.Credentials.from_service_account_file(
  SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(ADMIN_EMAIL)

Pode encontrar exemplos de código detalhados para chamar a API Policy, incluindo o código de autenticação, no artigo Listar e obter políticas.