Method: nodeGroups.setIamPolicy

HTTP request
Path parameters
Request body
- JSON representation
Response body
- JSON representation
  - JSON representation
  - JSON representation
Authorization Scopes
IAM Permissions

Sets the access control policy on the specified resource. Replaces any existing policy.

HTTP request

POST https://www.googleapis.com/compute/v1/projects/{project}/zones/{zone}/nodeGroups/{resourceId}/setIamPolicy

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters

Parameters
`project`	`string` Project ID for this request.
`zone`	`string` The name of the zone for this request.
`resourceId`	`string` Name or id of the resource for this request.

project

string

Project ID for this request.

zone

string

The name of the zone for this request.

resourceId

string

Name or id of the resource for this request.

Request body

The request body contains data with the following structure:

JSON representation
{ "policy": { "version": number, "bindings": [ ], "auditConfigs": [ ], "etag": string }, "bindings": [ { "role": string, "members": [ string ], "condition": } ], "etag": string }

Fields
`policy`	`object` REQUIRED: The complete policy to be applied to the 'resource'. The size of the policy is limited to a few 10s of KB. An empty policy is in general a valid policy but certain services (like Projects) might reject them.
`policy.version`	`number` Specifies the format of the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset.
`policy.bindings[]`	`object` Associates a list of `members` to a `role`. `bindings` with no members will result in an error.
`policy.bindings[].role`	`string` Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
`policy.bindings[].members[]`	`string` Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
`policy.bindings[].condition`	`object` The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently.
`policy.bindings[].condition.expression`	`string` Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported.
`policy.bindings[].condition.title`	`string` An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
`policy.bindings[].condition.description`	`string` An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
`policy.bindings[].condition.location`	`string` An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
`policy.auditConfigs[]`	`object` Specifies cloud audit logging configuration for this policy.
`policy.auditConfigs[].service`	`string` Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
`policy.auditConfigs[].auditLogConfigs[]`	`object` The configuration for logging of each type of permission.
`policy.auditConfigs[].auditLogConfigs[].logType`	`enum` The log type that this config enables.
`policy.auditConfigs[].auditLogConfigs[].exemptedMembers[]`	`string` Specifies the identities that do not cause logging for this type of permission. Follows the same format of `Binding.members`.
`policy.etag`	`string (bytes format)` `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten. A base64-encoded string.
`bindings[]`	`object` Flatten Policy to create a backwacd compatible wire-format. Deprecated. Use 'policy' to specify bindings.
`bindings[].role`	`string` Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
`bindings[].members[]`	`string` Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
`bindings[].condition`	`object` The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently.
`bindings[].condition.expression`	`string` Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported.
`bindings[].condition.title`	`string` An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
`bindings[].condition.description`	`string` An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
`bindings[].condition.location`	`string` An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
`etag`	`string (bytes format)` Flatten Policy to create a backward compatible wire-format. Deprecated. Use 'policy' to specify the etag. A base64-encoded string.

Response body

If successful, the response body contains data with the following structure:

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.

A Policy consists of a list of bindings. A binding binds a list of members to a role, where the members can be user accounts, Google groups, Google domains, and service accounts. A role is a named list of permissions defined by IAM.

JSON Example

{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-other-app@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/viewer",
      "members": ["user:sean@example.com"]
    }
  ]
}

YAML Example

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-other-app@appspot.gserviceaccount.com
  role: roles/owner
- members:
  - user:sean@example.com
  role: roles/viewer

For a description of IAM and its features, see the IAM developer's guide.

JSON representation
{ "version": number, "bindings": [ { "role": string, "members": [ string ], "condition": { "expression": string, "title": string, "description": string, "location": string } } ], "auditConfigs": [ { "service": string, "auditLogConfigs": [ { "logType": enum, "exemptedMembers": [ string ] } ] } ], "etag": string }

JSON representation

{
  "version": number,
  "bindings": [
    {
      "role": string,
      "members": [
        string
      ],
      "condition": {
        "expression": string,
        "title": string,
        "description": string,
        "location": string
      }
    }
  ],
  "auditConfigs": [
    {
      "service": string,
      "auditLogConfigs": [
        {
          "logType": enum,
          "exemptedMembers": [
            string
          ]
        }
      ]
    }
  ],
  "etag": string
}

Fields
`version`	`number` Specifies the format of the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset.
`bindings[]`	`object` Associates a list of `members` to a `role`. `bindings` with no members will result in an error.
`bindings[].role`	`string` Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
`bindings[].members[]`	`string` Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
`bindings[].condition`	`object` The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently.
`bindings[].condition.expression`	`string` Textual representation of an expression in Common Expression Language syntax. The application context of the containing message determines which well-known feature set of CEL is supported.
`bindings[].condition.title`	`string` An optional title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
`bindings[].condition.description`	`string` An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
`bindings[].condition.location`	`string` An optional string indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
`auditConfigs[]`	`object` Specifies cloud audit logging configuration for this policy.
`auditConfigs[].service`	`string` Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
`auditConfigs[].auditLogConfigs[]`	`object` The configuration for logging of each type of permission.
`auditConfigs[].auditLogConfigs[].logType`	`enum` The log type that this config enables.
`auditConfigs[].auditLogConfigs[].exemptedMembers[]`	`string` Specifies the identities that do not cause logging for this type of permission. Follows the same format of `Binding.members`.
`etag`	`string (bytes format)` `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten. A base64-encoded string.

Authorization Scopes

Requires one of the following OAuth scopes:

https://www.googleapis.com/auth/compute
https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

In addition to any permissions specified on the fields above, authorization requires one or more of the following Google IAM permissions:

compute.nodeGroups.setIamPolicy

Σας βοήθησε αυτή η σελίδα; Πείτε μας τη γνώμη σας:

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see our Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Τελευταία ενημέρωση Σεπτέμβριος 12, 2019.

Method: nodeGroups.setIamPolicy

HTTP request

Path parameters

Request body

Response body

Authorization Scopes

IAM Permissions

Αποστολή σχολίων σχετικά με…