Sets the access control policy on the specified resource. Replaces any existing policy.
HTTP request
POST https://compute.googleapis.com/compute/v1/projects/{project}/zones/{zone}/nodeGroups/{resourceId}/setIamPolicy
The URL uses gRPC Transcoding syntax.
Path parameters
Parameters | |
---|---|
project |
Project ID for this request. |
zone |
The name of the zone for this request. |
resourceId |
Name or id of the resource for this request. |
Request body
The request body contains data with the following structure:
JSON representation | |
---|---|
{ "policy": { "version": number, "bindings": [ ], "auditConfigs": [ ], "etag": string }, "bindings": [ { "role": string, "members": [ string ], "condition": } ], "etag": string } |
Fields | |
---|---|
policy |
REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them. |
policy.version |
Specifies the format of the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Operations affecting conditional bindings must specify version 3. This can be either setting a conditional policy, modifying a conditional binding, or removing a conditional binding from the stored conditional policy. Operations on non-conditional policies may specify any valid value or leave the field unset. If no etag is provided in the call to |
policy.bindings[] |
Associates a list of |
policy.bindings[].role |
Role that is assigned to |
policy.bindings[].members[] |
Specifies the identities requesting access for a Cloud Platform resource.
|
policy.bindings[].condition |
The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently. |
policy.bindings[].condition.expression |
Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported. |
policy.bindings[].condition.title |
An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. |
policy.bindings[].condition.description |
An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. |
policy.bindings[].condition.location |
An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file. |
policy.auditConfigs[] |
Specifies cloud audit logging configuration for this policy. |
policy.auditConfigs[].service |
Specifies a service that will be enabled for audit logging. For example, |
policy.auditConfigs[].auditLogConfigs[] |
The configuration for logging of each type of permission. |
policy.auditConfigs[].auditLogConfigs[].logType |
The log type that this config enables. |
policy.auditConfigs[].auditLogConfigs[].exemptedMembers[] |
Specifies the identities that do not cause logging for this type of permission. Follows the same format of |
policy.etag |
If no A base64-encoded string. |
bindings[] |
Flatten Policy to create a backwacd compatible wire-format. Deprecated. Use 'policy' to specify bindings. |
bindings[].role |
Role that is assigned to |
bindings[].members[] |
Specifies the identities requesting access for a Cloud Platform resource.
|
bindings[].condition |
The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently. |
bindings[].condition.expression |
Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported. |
bindings[].condition.title |
An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. |
bindings[].condition.description |
An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. |
bindings[].condition.location |
An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file. |
etag |
Flatten Policy to create a backward compatible wire-format. Deprecated. Use 'policy' to specify the etag. A base64-encoded string. |
Response body
If successful, the response body contains data with the following structure:
Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
A Policy
is a collection of bindings
. A binding
binds one or more members
to a single role
. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role
is a named list of permissions (defined by IAM or configured by users). A binding
can optionally specify a condition
, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource.
JSON Example
{
"bindings": [
{
"role": "roles/resourcemanager.organizationAdmin",
"members": [
"user:mike@example.com",
"group:admins@example.com",
"domain:google.com",
"serviceAccount:my-project-id@appspot.gserviceaccount.com"
]
},
{
"role": "roles/resourcemanager.organizationViewer",
"members": ["user:eve@example.com"],
"condition": {
"title": "expirable access",
"description": "Does not grant access after Sep 2020",
"expression": "request.time <
timestamp('2020-10-01T00:00:00.000Z')",
}
}
]
}
YAML Example
bindings:
- members:
- user:mike@example.com
- group:admins@example.com
- domain:google.com
- serviceAccount:my-project-id@appspot.gserviceaccount.com
role: roles/resourcemanager.organizationAdmin
- members:
- user:eve@example.com
role: roles/resourcemanager.organizationViewer
condition:
title: expirable access
description: Does not grant access after Sep 2020
expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
For a description of IAM and its features, see the IAM developer's guide.
JSON representation | |
---|---|
{ "version": number, "bindings": [ { "role": string, "members": [ string ], "condition": { "expression": string, "title": string, "description": string, "location": string } } ], "auditConfigs": [ { "service": string, "auditLogConfigs": [ { "logType": enum, "exemptedMembers": [ string ] } ] } ], "etag": string } |
Fields | |
---|---|
version |
Specifies the format of the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Operations affecting conditional bindings must specify version 3. This can be either setting a conditional policy, modifying a conditional binding, or removing a conditional binding from the stored conditional policy. Operations on non-conditional policies may specify any valid value or leave the field unset. If no etag is provided in the call to |
bindings[] |
Associates a list of |
bindings[].role |
Role that is assigned to |
bindings[].members[] |
Specifies the identities requesting access for a Cloud Platform resource.
|
bindings[].condition |
The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently. |
bindings[].condition.expression |
Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported. |
bindings[].condition.title |
An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. |
bindings[].condition.description |
An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. |
bindings[].condition.location |
An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file. |
auditConfigs[] |
Specifies cloud audit logging configuration for this policy. |
auditConfigs[].service |
Specifies a service that will be enabled for audit logging. For example, |
auditConfigs[].auditLogConfigs[] |
The configuration for logging of each type of permission. |
auditConfigs[].auditLogConfigs[].logType |
The log type that this config enables. |
auditConfigs[].auditLogConfigs[].exemptedMembers[] |
Specifies the identities that do not cause logging for this type of permission. Follows the same format of |
etag |
If no A base64-encoded string. |
Authorization Scopes
Requires one of the following OAuth scopes:
https://www.googleapis.com/auth/compute
https://www.googleapis.com/auth/cloud-platform
For more information, see the Authentication Overview.
IAM Permissions
In addition to any permissions specified on the fields above, authorization requires one or more of the following Google IAM permissions:
compute.nodeGroups.setIamPolicy