gcloud alpha iap tcp set-iam-policy

NAME

gcloud alpha iap tcp set-iam-policy - set the IAM policy for an IAP TCP IAM resource

SYNOPSIS

gcloud alpha iap tcp set-iam-policy POLICY_FILE [--region=REGION --resource-type=RESOURCE_TYPE --instance=INSTANCE     | --service=SERVICE] [GCLOUD_WIDE_FLAG …]

DESCRIPTION

(ALPHA) This command replaces the existing IAM policy for an IAP TCP IAM resource, given a file encoded in JSON or YAML that contains the IAM policy. If the given policy file specifies an "etag" value, then the replacement will succeed only if the policy already in place matches that etag. (An etag obtained via $ gcloud alpha iap tcp get-iam-policy will prevent the replacement if the policy for the resource has been subsequently updated.) A policy file that does not contain an etag value will replace any existing policy for the resource.

EXAMPLES

To set the IAM policy for the TCP accesses to all the Cloud Run services within the active project, run:

gcloud alpha iap tcp set-iam-policy POLICY_FILE --resource-type=cloud-run

To set the IAM policy for the TCP accesses to all the Cloud Run services in specific region, run:

gcloud alpha iap tcp set-iam-policy POLICY_FILE --resource-type=cloud-run --region=REGION

To set the IAM policy for the TCP accesses to a specific Cloud Run service in specific region, run:

gcloud alpha iap tcp set-iam-policy POLICY_FILE --resource-type=cloud-run --service=SERVICE_ID --region=REGION

POSITIONAL ARGUMENTS

POLICY_FILE

JSON or YAML file containing the IAM policy.

FLAGS

--region=REGION

Region name. Required when --service or --instance is specified for resource-type=cloud-run.

--resource-type=RESOURCE_TYPE

Resource type of the IAP resource. RESOURCE_TYPE must be (only one value is supported): cloud-run.

At most one of these can be specified:

--instance=INSTANCE

Instance ID.

--service=SERVICE

Service name.

GCLOUD WIDE FLAGS

These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

NOTES

This command is currently in alpha and might change without notice. If this command fails with API permission errors despite specifying the correct project, you might be trying to access an API with an invitation-only early access allowlist. This variant is also available:

gcloud beta iap tcp set-iam-policy