Esta página foi traduzida pela API Cloud Translation.

Controlar o acesso aos recursos da Cloud Healthcare API

Esta página descreve como controlar o acesso aos conjuntos de dados e às bases de dados da Cloud Healthcare API através das autorizações Identity and Access Management (IAM). O IAM permite-lhe controlar quem tem acesso aos seus conjuntos de dados e repositórios de dados. Para saber mais sobre a IAM para a Cloud Healthcare API, consulte o artigo Controlo de acesso.

Vista geral das políticas de IAM

O acesso a um recurso é gerido através de uma política de IAM. Uma política contém uma matriz denominada bindings. Esta matriz contém uma coleção de associações, que são associações entre responsáveis, como uma conta de utilizador ou uma conta de serviço, e uma função. As políticas são representadas através de JSON ou YAML.

A política de exemplo seguinte mostra que user-1@example.com recebeu a função roles/healthcare.datasetAdmin e que user-2@example.com e service-account-13@appspot.gserviceaccount.com receberam a função roles/healthcare.datasetViewer:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Para atualizar uma política para um recurso, use o padrão ler-modificar-escrever. Não existem métodos separados para criar, modificar e revogar o acesso dos utilizadores.

Para atualizar uma política, conclua os seguintes passos:

Leia a política atual chamando o método getIamPolicy() do recurso. Por exemplo, para ler a política atual de um conjunto de dados, chame projects.locations.datasets.getIamPolicy.
Edite a política devolvida através de um editor de texto ou programaticamente para adicionar ou remover quaisquer responsáveis aplicáveis e as respetivas concessões de funções.
Escreva a política atualizada chamando o método setIamPolicy() do recurso. Por exemplo, para escrever a política atualizada de um conjunto de dados, chame projects.locations.datasets.setIamPolicy.

Usar o IAM com lojas de consentimento

As secções seguintes mostram como obter, modificar e definir uma política para um arquivo de consentimento. Estas secções usam a seguinte política de exemplo como ponto de partida:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Obter uma política

Os exemplos seguintes mostram como ler uma política de IAM ao nível do armazenamento de consentimento. Para mais informações, consulte projects.locations.datasets.consentStores.getIamPolicy.

Para ver a política IAM de um armazenamento de consentimento:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o armazenamento de consentimento e, de seguida, selecione o armazenamento de consentimento para o qual quer obter uma política.
Clique em Mostrar painel de informações.
Para ver os responsáveis atribuídos a uma função, expanda a função.

Para ver a política de IAM de um arquivo de consentimento, execute o comando gcloud healthcare consent-stores get-iam-policy. Especifique o nome da loja de consentimento, o nome do conjunto de dados e a localização.

gcloud healthcare consent-stores get-iam-policy CONSENT_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

Se o pedido for bem-sucedido, as associações são apresentadas.

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.consentStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.consentReader
etag: bytes
version: VERSION_NUMBER

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getConsentStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const consentStoreId = 'my-consent-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/consentStores/${consentStoreId}`;
  const request = {resource_};

  const consentStore =
    await healthcare.projects.locations.datasets.consentStores.getIamPolicy(
      request
    );
  console.log(
    'Got consent store IAM policy:',
    JSON.stringify(consentStore.data, null, 2)
  );
};

getConsentStoreIamPolicy();

def get_consent_store_iam_policy(
    project_id: str, location: str, dataset_id: str, consent_store_id: str
):
    """Gets the IAM policy for the specified consent store.
    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/consent
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the consent store's parent dataset ID
    # consent_store_id = 'my-consent-store'  # replace with the consent store's ID
    consent_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    consent_store_name = "{}/consentStores/{}".format(
        consent_store_parent, consent_store_id
    )

    request = (
        client.projects()
        .locations()
        .datasets()
        .consentStores()
        .getIamPolicy(resource=consent_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

Para ler a política de IAM de um arquivo de consentimento, faça um pedido GET e especifique o nome do conjunto de dados, o nome do arquivo de consentimento e um token de acesso.

O exemplo seguinte mostra um pedido GET com curl:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:getIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Para ler a política de IAM de um arquivo de consentimento, faça um pedido GET e especifique o nome do conjunto de dados, o nome do arquivo de consentimento e um token de acesso.

O exemplo seguinte mostra um pedido GET através do Windows PowerShell:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:getIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Modificar uma política

Os seguintes exemplos concedem a um novo utilizador a função roles/healthcare.consentReader. Para mais informações, consulte projects.locations.datasets.consentStores.setIamPolicy.

Definir uma política

Para definir uma política IAM ao nível do arquivo de consentimento, conclua os seguintes passos:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o armazenamento de consentimento e, de seguida, selecione o armazenamento de consentimento para o qual quer definir uma política.
Clique em Mostrar painel de informações.
Clique em Adicionar principal.
No campo Novos responsáveis, introduza uma ou mais identidades que precisam de acesso ao arquivo de consentimento.
Na lista Selecionar uma função, em Cloud Healthcare, selecione a autorização que quer conceder. Por exemplo, o visualizador do arquivo de consentimento do Healthcare.
Clique em Guardar.

Conceda ou revogue funções aos utilizadores modificando a política que recuperou, de forma programática ou através de um editor de texto. O valor etag muda quando a política muda, pelo que tem de especificar o valor atual.

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.consentReader:

{
  "role":"roles/healthcare.consentReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Para revogar o acesso de um principal, elimine o respetivo endereço de email da matriz members. Para revogar o acesso do último principal que tem uma função, elimine a matriz bindings para a função. Não pode ter uma matriz bindings vazia na sua política.

Depois de modificar a política para conceder as funções aplicáveis, execute o comando set-iam-policy adequado para fazer as alterações. Para definir uma política ao nível da loja de consentimento, execute o comando gcloud healthcare consent-stores set-iam-policy. Especifique o nome do armazenamento de consentimento, o nome do conjunto de dados, a localização e o caminho para o ficheiro de políticas que criou.

gcloud healthcare consent-stores set-iam-policy CONSENT_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

Se o pedido for bem-sucedido, o nome da loja de consentimento e as associações são apresentados.

Updated IAM policy for consentStore [CONSENT_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.consentStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.consentReader
etag: bytes
version: VERSION_NUMBER

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setConsentStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const consentStoreId = 'my-consent-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.consentStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/consentStores/${consentStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const consentStore =
    await healthcare.projects.locations.datasets.consentStores.setIamPolicy(
      request
    );
  console.log(
    'Set consent store IAM policy:',
    JSON.stringify(consentStore.data, null, 2)
  );
};

setConsentStoreIamPolicy();

def set_consent_store_iam_policy(
    project_id: str,
    location: str,
    dataset_id: str,
    consent_store_id: str,
    member,
    role,
    etag=None,
):
    """Sets the IAM policy for the specified consent store.
    A single member will be assigned a single role. A member can be any of:
    - allUsers, that is, anyone
    - allAuthenticatedUsers, anyone authenticated with a Google account
    - user:email, as in 'user:somebody@example.com'
    - group:email, as in 'group:admins@example.com'
    - domain:domainname, as in 'domain:example.com'
    - serviceAccount:email,
        as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
    A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
    or 'roles/editor'
    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/consent
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the consent store's parent dataset ID
    # consent_store_id = 'my-consent-store'  # replace with the consent store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    consent_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    consent_store_name = "{}/consentStores/{}".format(
        consent_store_parent, consent_store_id
    )

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .consentStores()
        .setIamPolicy(resource=consent_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.consentReader:

{
  "role":"roles/healthcare.consentReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.consentStores.setIamPolicy para fazer as atualizações.

Para definir uma política de IAM ao nível da loja de consentimento, faça um pedido e especifique o nome do conjunto de dados, o nome da loja de consentimento, a política e um token de acesso.POST

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.consentReader existente:

A política pode ser escrita diretamente no pedido, como mostrado aqui, ou pode ser transmitida como um ficheiro JSON ou YAML. Para ver exemplos de como formatar uma política como JSON ou YAML, consulte o artigo Policy.

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.consentStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.consentReader',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:setIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.consentReader:

{
  "role":"roles/healthcare.consentReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.consentStores.setIamPolicy para fazer as atualizações.

O exemplo seguinte mostra um pedido POST através do Windows PowerShell para conceder a função roles/healthcare.consentReader existente a um novo utilizador:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.consentStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.consentReader',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/consentStores/CONSENT_STORE_ID:setIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.consentStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.consentReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Usar o IAM com conjuntos de dados

As secções seguintes mostram como obter, modificar e definir uma política para um conjunto de dados. Estas secções usam a seguinte política de exemplo como ponto de partida:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Obter uma política

Os exemplos seguintes mostram como ler uma política de IAM ao nível do conjunto de dados. Para mais informações, consulte projects.locations.datasets.getIamPolicy.

curl

Para ler a política IAM de um conjunto de dados, faça um pedido GET e especifique o nome do conjunto de dados e um token de acesso.

O exemplo seguinte mostra um pedido GET com curl:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:getIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

Para ver a política de IAM de um conjunto de dados, faça um pedido GET e especifique o nome do conjunto de dados e um token de acesso.

O exemplo seguinte mostra um pedido GET através do Windows PowerShell:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:getIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Consola

Para ver a Política IAM de um conjunto de dados:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Selecione um conjunto de dados e, de seguida, clique em Mostrar painel de informações.
Para ver os responsáveis atribuídos a uma função, expanda a função.

gcloud

Para ver a política IAM de um conjunto de dados, execute o comando gcloud healthcare datasets get-iam-policy. Especifique o nome do conjunto de dados e a localização.

gcloud healthcare datasets get-iam-policy DATASET_ID \
    --location=LOCATION

Se o pedido for bem-sucedido, as associações são apresentadas.

bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.datasetViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// datasetIAMPolicy gets the dataset's IAM policy.
func datasetIAMPolicy(w io.Writer, projectID, location, datasetID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	datasetsService := healthcareService.Projects.Locations.Datasets

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", projectID, location, datasetID)

	policy, err := datasetsService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class DatasetGetIamPolicy {
  private static final String DATASET_NAME = "projects/%s/locations/%s/datasets/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void datasetGetIamPolicy(String datasetName) throws IOException {
    // String datasetName =
    //     String.format(DATASET_NAME, "your-project-id", "your-region-id", "your-dataset-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    Datasets.GetIamPolicy request =
        client.projects().locations().datasets().getIamPolicy(datasetName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("Dataset IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getDatasetIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}`;
  const request = {resource_};

  const dataset =
    await healthcare.projects.locations.datasets.getIamPolicy(request);
  console.log(
    'Got dataset IAM policy:',
    JSON.stringify(dataset.data, null, 2)
  );
};

getDatasetIamPolicy();

Python

# Imports the Dict and Any types for runtime type hints.
from typing import Any, Dict


def get_dataset_iam_policy(
    project_id: str, location: str, dataset_id: str
) -> Dict[str, Any]:
    """Gets the IAM policy for the specified dataset.

    See
    https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/datasets
    before running the sample.
    See https://googleapis.github.io/google-api-python-client/docs/dyn/healthcare_v1.projects.locations.datasets.html#getIamPolicy
    for the Python API reference.

    Args:
      project_id: The project ID or project number of the Google Cloud project you want
          to use.
      location: The name of the dataset's location.
      dataset_id: The ID of the dataset containing the IAM policy to get.

    Returns:
      A dictionary representing an IAM policy.
    """
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    # Imports HttpError from the Google Python API client errors module.
    from googleapiclient.errors import HttpError

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'
    # location = 'us-central1'
    # dataset_id = 'my-dataset'
    dataset_name = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )

    request = (
        client.projects().locations().datasets().getIamPolicy(resource=dataset_name)
    )

    try:
        response = request.execute()
        print("etag: {}".format(response.get("name")))
        return response
    except HttpError as err:
        raise err

Modificar uma política

Os seguintes exemplos concedem a um novo utilizador a função:roles/healthcare.datasetViewer

Definir uma política

Consola

Para definir uma política IAM ao nível do conjunto de dados, conclua os seguintes passos:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Selecione o conjunto de dados para o qual quer definir uma política e, de seguida, clique em Mostrar painel de informações.
Clique em Adicionar principal.
No campo Novos responsáveis, introduza uma ou mais identidades que precisam de acesso ao conjunto de dados.
Na lista Selecionar uma função, em Cloud Healthcare, selecione a autorização que quer conceder. Por exemplo, o visualizador do conjunto de dados de cuidados de saúde.
Clique em Guardar.

gcloud

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.datasetViewer:

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, execute o comando set-iam-policy adequado para fazer as alterações. Para definir uma política ao nível do conjunto de dados, execute o comando gcloud healthcare datasets set-iam-policy. Especifique o nome do conjunto de dados, a localização e o caminho para o ficheiro de política que criou.

gcloud healthcare datasets set-iam-policy DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

Se o pedido for bem-sucedido, são apresentados o nome do conjunto de dados e as associações.

Updated IAM policy for dataset [DATASET_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.datasetAdmin
  - user:user-1@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.datasetViewer
etag: bytes
version: VERSION_NUMBER

curl

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.datasetViewer:

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.setIamPolicy para fazer as atualizações.

Para definir uma política IAM ao nível do conjunto de dados, faça um POST pedido e especifique o nome do conjunto de dados, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.datasetViewer existente:

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.datasetAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.datasetViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:setIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.datasetViewer:

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.setIamPolicy para fazer as atualizações.

Para definir uma política IAM ao nível do conjunto de dados, faça um POST pedido e especifique o nome do conjunto de dados, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST através do Windows PowerShell para conceder a função roles/healthcare.datasetViewer existente a um novo utilizador:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.datasetAdmin',
          'members': [
            'user:user-1@example.com'
          ]
        },
        {
          'role': 'roles/healthcare.datasetViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:setIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setDatasetIAMPolicy sets an IAM policy for the dataset.
func setDatasetIAMPolicy(w io.Writer, projectID, location, datasetID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	datasetsService := healthcareService.Projects.Locations.Datasets

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", projectID, location, datasetID)

	policy, err := datasetsService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = datasetsService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class DatasetSetIamPolicy {
  private static final String DATASET_NAME = "projects/%s/locations/%s/datasets/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void datasetSetIamPolicy(String datasetName) throws IOException {
    // String datasetName =
    //     String.format(DATASET_NAME, "your-project-id", "your-region-id", "your-dataset-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the dataset.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.datasetViewer")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    Datasets.SetIamPolicy request =
        client.projects().locations().datasets().setIamPolicy(datasetName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("Dataset policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setDatasetIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.datasetViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const dataset =
    await healthcare.projects.locations.datasets.setIamPolicy(request);
  console.log(
    'Set dataset IAM policy:',
    JSON.stringify(dataset.data, null, 2)
  );
};

setDatasetIamPolicy();

Python

# Imports the Dict and Any types for runtime type hints.
from typing import Any, Dict

def set_dataset_iam_policy(
    project_id: str,
    location: str,
    dataset_id: str,
    member: str,
    role: str,
    etag: str = None,
) -> Dict[str, Any]:
    """Sets the IAM policy for the specified dataset.

        A single member will be assigned a single role. A member can be any of:

        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'

        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'

    See
    https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/datasets
    before running the sample.
    See https://googleapis.github.io/google-api-python-client/docs/dyn/healthcare_v1.projects.locations.datasets.html#setIamPolicy
    for the Python API reference.

    Args:
      project_id: The project ID or project number of the Google Cloud project you want
          to use.
      location: The name of the dataset's location.
      dataset_id: The ID of the dataset containing the IAM policy to set.
      member: The principals to grant access for a Google Cloud resource.
      role: The role to assign to the list of 'members'.
      etag: The 'etag' returned in a previous getIamPolicy request to ensure that
        setIamPolicy changes apply to the same policy version.

    Returns:
      A dictionary representing an IAM policy.
    """
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    # Imports HttpError from the Google Python API client errors module.
    from googleapiclient.errors import HttpError

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'
    # location = 'us-central1'
    # dataset_id = 'my-dataset'
    dataset_name = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )

    # TODO(developer): Uncomment these lines and replace with your values.
    # role = 'roles/viewer'
    # member = 'serviceAccount:group@example.com'
    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .setIamPolicy(resource=dataset_name, body={"policy": policy})
    )
    try:
        response = request.execute()
        print("etag: {}".format(response.get("name")))
        print("bindings: {}".format(response.get("bindings")))
        return response
    except HttpError as err:
        raise err

Usar o IAM com arquivos DICOM

As secções seguintes mostram como obter, modificar e definir uma política para um arquivo DICOM. Estas secções usam a seguinte política de exemplo como ponto de partida:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Obter uma política

Os exemplos seguintes mostram como ler uma política de IAM ao nível do armazenamento DICOM. Para mais informações, consulte projects.locations.datasets.dicomStores.getIamPolicy.

Consola

Para ver a Política IAM de um arquivo DICOM:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o arquivo DICOM e, de seguida, selecione o arquivo DICOM para o qual quer obter uma política.
Clique em Mostrar painel de informações.
Para ver os responsáveis atribuídos a uma função, expanda a função.

gcloud

Para ver a política de IAM de um arquivo DICOM, execute o comando gcloud healthcare dicom-stores get-iam-policy. Especifique o nome do arquivo DICOM, o nome do conjunto de dados e a localização.

gcloud healthcare dicom-stores get-iam-policy DICOM_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

Se o pedido for bem-sucedido, as associações são apresentadas.

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.dicomStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.dicomViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// getDICOMIAMPolicy gets the DICOM store's IAM policy.
func getDICOMIAMPolicy(w io.Writer, projectID, location, datasetID, dicomStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	dicomService := healthcareService.Projects.Locations.Datasets.DicomStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/dicomStores/%s", projectID, location, datasetID, dicomStoreID)

	policy, err := dicomService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.DicomStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class DicomStoreGetIamPolicy {
  private static final String DICOM_NAME = "projects/%s/locations/%s/datasets/%s/dicomStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void dicomStoreGetIamPolicy(String dicomStoreName) throws IOException {
    // String dicomStoreName =
    //    String.format(
    //        DICOM_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-dicom-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    DicomStores.GetIamPolicy request =
        client.projects().locations().datasets().dicomStores().getIamPolicy(dicomStoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("DICOM store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getDicomStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/dicomStores/${dicomStoreId}`;
  const request = {resource_};

  const dicomStore =
    await healthcare.projects.locations.datasets.dicomStores.getIamPolicy(
      request
    );
  console.log(
    'Got DICOM store IAM policy:',
    JSON.stringify(dicomStore.data, null, 2)
  );
};

getDicomStoreIamPolicy();

Python

def get_dicom_store_iam_policy(project_id, location, dataset_id, dicom_store_id):
    """Gets the IAM policy for the specified DICOM store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/dicom
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the DICOM store's parent dataset ID
    # dicom_store_id = 'my-dicom-store'  # replace with the DICOM store's ID
    dicom_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    dicom_store_name = f"{dicom_store_parent}/dicomStores/{dicom_store_id}"

    request = (
        client.projects()
        .locations()
        .datasets()
        .dicomStores()
        .getIamPolicy(resource=dicom_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

curl

Para ler a política de IAM de um arquivo DICOM, faça um pedido GET e especifique o nome do conjunto de dados, o nome do arquivo DICOM e um token de acesso.

O exemplo seguinte mostra um pedido GET com curl:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:getIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

Para ler a política de IAM de um arquivo DICOM, faça um pedido GET e especifique o nome do conjunto de dados, o nome do arquivo DICOM e um token de acesso.

O exemplo seguinte mostra um pedido GET através do Windows PowerShell:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:getIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Modificar uma política

Os seguintes exemplos concedem a um novo utilizador a função roles/healthcare.dicomViewer. Para mais informações, consulte projects.locations.datasets.dicomStores.setIamPolicy.

Definir uma política

Consola

Para definir uma política IAM ao nível do arquivo DICOM, conclua os seguintes passos:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o arquivo DICOM e, de seguida, selecione o arquivo DICOM para o qual quer definir uma política.
Clique em Mostrar painel de informações.
Clique em Adicionar principal.
No campo Novos responsáveis, introduza uma ou mais identidades que precisam de acesso ao arquivo DICOM.
Na lista Selecionar uma função, em Cloud Healthcare, selecione a autorização que quer conceder. Por exemplo, o visualizador de armazenamentos DICOM da Healthcare.
Clique em Guardar.

gcloud

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.dicomViewer:

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, execute o comando set-iam-policy adequado para fazer as alterações. Para definir uma política ao nível do armazenamento DICOM, execute o comando gcloud healthcare dicom-stores set-iam-policy. Especifique o nome do arquivo DICOM, o nome do conjunto de dados, a localização e o caminho para o ficheiro de política que criou.

gcloud healthcare dicom-stores set-iam-policy DICOM_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

Se o pedido for bem-sucedido, o nome da loja DICOM e as associações são apresentados.

Updated IAM policy for dicomStore [DICOM_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.dicomStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.dicomViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setDICOMIAMPolicy sets the DICOM store's IAM policy.
func setDICOMIAMPolicy(w io.Writer, projectID, location, datasetID, dicomStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	dicomService := healthcareService.Projects.Locations.Datasets.DicomStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/dicomStores/%s", projectID, location, datasetID, dicomStoreID)

	policy, err := dicomService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = dicomService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.DicomStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class DicomStoreSetIamPolicy {
  private static final String DICOM_NAME = "projects/%s/locations/%s/datasets/%s/dicomStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void dicomStoreSetIamPolicy(String dicomStoreName) throws IOException {
    // String dicomStoreName =
    //    String.format(
    //        DICOM_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-dicom-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.dicomStoreAdmin")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    DicomStores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .dicomStores()
            .setIamPolicy(dicomStoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("DICOM policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setDicomStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.dicomStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/dicomStores/${dicomStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const dicomStore =
    await healthcare.projects.locations.datasets.dicomStores.setIamPolicy(
      request
    );
  console.log(
    'Set DICOM store IAM policy:',
    JSON.stringify(dicomStore.data, null, 2)
  );
};

setDicomStoreIamPolicy();

Python

def set_dicom_store_iam_policy(
    project_id, location, dataset_id, dicom_store_id, member, role, etag=None
):
    """Sets the IAM policy for the specified DICOM store.

    A single member will be assigned a single role. A member can be any of:

    - allUsers, that is, anyone
    - allAuthenticatedUsers, anyone authenticated with a Google account
    - user:email, as in 'user:somebody@example.com'
    - group:email, as in 'group:admins@example.com'
    - domain:domainname, as in 'domain:example.com'
    - serviceAccount:email,
        as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'

    A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
    or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/dicom
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the DICOM store's parent dataset ID
    # dicom_store_id = 'my-dicom-store'  # replace with the DICOM store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    dicom_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    dicom_store_name = f"{dicom_store_parent}/dicomStores/{dicom_store_id}"

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .dicomStores()
        .setIamPolicy(resource=dicom_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

curl

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.dicomViewer:

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.dicomStores.setIamPolicy para fazer as atualizações.

Para definir uma política de IAM ao nível do arquivo DICOM, faça um pedido e especifique o nome do conjunto de dados, o nome do arquivo DICOM, a política e um token de acesso.POST

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.dicomViewer existente:

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.dicomStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.dicomViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:setIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no âmbito da associação roles/healthcare.dicomViewer:

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.dicomStores.setIamPolicy para fazer as atualizações.

Para definir uma política de IAM ao nível do arquivo DICOM, faça um pedido e especifique o nome do conjunto de dados, o nome do arquivo DICOM, a política e um token de acesso.POST

O exemplo seguinte mostra um pedido POST através do Windows PowerShell para conceder a função roles/healthcare.dicomViewer existente a um novo utilizador:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.dicomStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.dicomViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:setIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Usar o IAM com FHIR stores

As secções seguintes mostram como obter, modificar e definir uma política para um FHIR store. Estas secções usam a seguinte política de exemplo como ponto de partida:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Obter uma política

Os exemplos seguintes mostram como ler uma política de IAM ao nível do FHIR store. Para mais informações, consulte projects.locations.datasets.fhirStores.getIamPolicy.

Consola

Para ver a Política IAM de um FHIR store:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o FHIR store e, de seguida, selecione o FHIR store para o qual quer obter uma política.
Clique em Mostrar painel de informações.
Para ver os responsáveis atribuídos a uma função, expanda a função.

gcloud

Para ver a política de IAM de uma loja FHIR, execute o comando gcloud healthcare fhir-stores get-iam-policy. Especifique o nome da loja FHIR, o nome do conjunto de dados e a localização.

gcloud healthcare fhir-stores get-iam-policy FHIR_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

Se o pedido for bem-sucedido, as associações são apresentadas.

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.fhirStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.fhirResourceReader
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// getFHIRIAMPolicy gets the FHIR store's IAM policy.
func getFHIRIAMPolicy(w io.Writer, projectID, location, datasetID, fhirStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	fhirService := healthcareService.Projects.Locations.Datasets.FhirStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/fhirStores/%s", projectID, location, datasetID, fhirStoreID)

	policy, err := fhirService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.FhirStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class FhirStoreGetIamPolicy {
  private static final String FHIR_NAME = "projects/%s/locations/%s/datasets/%s/fhirStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void fhirStoreGetIamPolicy(String fhirStoreName) throws IOException {
    // String fhirStoreName =
    //    String.format(
    //        FHIR_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-fhir-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    FhirStores.GetIamPolicy request =
        client.projects().locations().datasets().fhirStores().getIamPolicy(fhirStoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("FHIR store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getFhirStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const fhirStoreId = 'my-fhir-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/fhirStores/${fhirStoreId}`;
  const request = {resource_};

  const fhirStore =
    await healthcare.projects.locations.datasets.fhirStores.getIamPolicy(
      request
    );
  console.log(
    'Got FHIR store IAM policy:',
    JSON.stringify(fhirStore.data, null, 2)
  );
};

getFhirStoreIamPolicy();

Python

def get_fhir_store_iam_policy(project_id, location, dataset_id, fhir_store_id):
    """Gets the IAM policy for the specified FHIR store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/fhir
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Instantiates an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the parent dataset's ID
    # fhir_store_id = 'my-fhir-store' # replace with the FHIR store ID
    fhir_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    fhir_store_name = f"{fhir_store_parent}/fhirStores/{fhir_store_id}"

    request = (
        client.projects()
        .locations()
        .datasets()
        .fhirStores()
        .getIamPolicy(resource=fhir_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

curl

Para ler a política de IAM de uma FHIR store, faça um pedido POST e especifique o nome do conjunto de dados, o nome da FHIR store e um token de acesso.

O exemplo seguinte mostra um pedido POST com curl:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:getIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

Para ler a política de IAM de uma loja FHIR, faça um pedido POST e especifique o nome do conjunto de dados, o nome da loja FHIR e um token de acesso.

O exemplo seguinte mostra um pedido POST através do Windows PowerShell:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:getIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Modificar uma política

Os seguintes exemplos concedem a um novo utilizador a função roles/healthcare.fhirResourceReader. Para mais informações, consulte projects.locations.datasets.fhirStores.setIamPolicy.

Definir uma política

Consola

Para definir uma política IAM ao nível da loja FHIR, conclua os seguintes passos:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o FHIR store e, de seguida, selecione o FHIR store para o qual quer definir uma política.
Clique em Mostrar painel de informações.
Clique em Adicionar principal.
No campo Novos responsáveis, introduza uma ou mais identidades que precisam de acesso ao arquivo FHIR.
Na lista Selecionar uma função, em Cloud Healthcare, selecione a autorização que quer conceder. Por exemplo, Healthcare FHIR Resource Reader.
Clique em Guardar.

gcloud

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no elemento roles/healthcare.fhirResourceReader:

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, execute o comando set-iam-policy adequado para fazer as alterações. Para definir uma política ao nível da loja FHIR, execute o comando gcloud healthcare fhir-stores set-iam-policy. Especifique o nome da loja FHIR, o nome do conjunto de dados, a localização e o caminho para o ficheiro de política que criou.

gcloud healthcare fhir-stores set-iam-policy FHIR_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

Se o pedido for bem-sucedido, são apresentados o nome da loja FHIR e as associações.

Updated IAM policy for fhirStore [FHIR_STORE_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.fhirResourceReader
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setFHIRIAMPolicy sets the FHIR store's IAM policy.
func setFHIRIAMPolicy(w io.Writer, projectID, location, datasetID, fhirStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	fhirService := healthcareService.Projects.Locations.Datasets.FhirStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/fhirStores/%s", projectID, location, datasetID, fhirStoreID)

	policy, err := fhirService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = fhirService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM Policy version: %v\n", policy.Version)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.FhirStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class FhirStoreSetIamPolicy {
  private static final String FHIR_NAME = "projects/%s/locations/%s/datasets/%s/fhirStores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void fhirStoreSetIamPolicy(String fhirStoreName) throws IOException {
    // String fhirStoreName =
    //    String.format(
    //        FHIR_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-fhir-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.fhirResourceReader")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    FhirStores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .fhirStores()
            .setIamPolicy(fhirStoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("FHIR policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setFhirStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const fhirStoreId = 'my-fhir-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.fhirStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/fhirStores/${fhirStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const fhirStore =
    await healthcare.projects.locations.datasets.fhirStores.setIamPolicy(
      request
    );
  console.log(
    'Set FHIR store IAM policy:',
    JSON.stringify(fhirStore.data, null, 2)
  );
};

setFhirStoreIamPolicy();

Python

def set_fhir_store_iam_policy(
    project_id,
    location,
    dataset_id,
    fhir_store_id,
    member,
    role,
    etag=None,
):
    """Sets the IAM policy for the specified FHIR store.
        A single member will be assigned a single role. A member can be any of:
        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/fhir
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Instantiates an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the parent dataset's ID
    # fhir_store_id = 'my-fhir-store' # replace with the FHIR store ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    fhir_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    fhir_store_name = f"{fhir_store_parent}/fhirStores/{fhir_store_id}"

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .fhirStores()
        .setIamPolicy(resource=fhir_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

curl

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no elemento roles/healthcare.fhirResourceReader:

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.fhirStores.setIamPolicy para fazer as atualizações.

Para definir uma política IAM ao nível da loja FHIR, faça um pedido POST e especifique o nome do conjunto de dados, o nome da loja FHIR, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.fhirResourceReader existente:

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.fhirStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.fhirResourceReader',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:setIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no elemento roles/healthcare.fhirResourceReader:

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.fhirStores.setIamPolicy para fazer as atualizações.

Para definir uma política IAM ao nível da loja FHIR, faça um pedido POST e especifique o nome do conjunto de dados, o nome da loja FHIR, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST através do Windows PowerShell para conceder a função roles/healthcare.fhirResourceReader existente a um novo utilizador:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.fhirStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.fhirResourceReader',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:setIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Usar o IAM com armazenamentos de HL7v2

As secções seguintes mostram como obter, modificar e definir uma política para um HL7v2 store. Estas secções usam a seguinte política de exemplo como ponto de partida:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Obter uma política

Os exemplos seguintes mostram como ler uma política de IAM ao nível do armazenamento HL7v2. Para mais informações, consulte projects.locations.datasets.hl7V2Stores.getIamPolicy.

Consola

Para ver a política IAM de um armazenamento de HL7v2:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o armazenamento de HL7v2 e, de seguida, selecione o armazenamento de HL7v2 para o qual quer obter uma política.
Clique em Mostrar painel de informações.
Para ver os responsáveis atribuídos a uma função, expanda a função.

gcloud

Para ver a política de IAM de um armazenamento de HL7v2, execute o comando hl7v2-stores get-iam-policy. Especifique o nome do armazenamento de HL7v2, o nome do conjunto de dados e a localização.

gcloud healthcare hl7v2-stores get-iam-policy HL7V2_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

Se o pedido for bem-sucedido, as associações são apresentadas.

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.hl7v2StoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.hl7v2Consumer
etag: bytes
version: VERSION_NUMBER

curl

Para ler a política de IAM de um armazenamento de HL7v2, faça um pedido GET e especifique o nome do conjunto de dados, o nome do armazenamento de HL7v2 e um token de acesso.

O exemplo seguinte mostra um pedido GET com curl:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:getIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

Para ler a política de IAM de um armazenamento de HL7v2, faça um pedido GET e especifique o nome do conjunto de dados, o nome do armazenamento de HL7v2 e um token de acesso.

O exemplo seguinte mostra um pedido GET através do Windows PowerShell:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:getIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// hl7V2IAMPolicy gets the IAM policy.
func hl7V2IAMPolicy(w io.Writer, projectID, location, datasetID, hl7V2StoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	storesService := healthcareService.Projects.Locations.Datasets.Hl7V2Stores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s", projectID, location, datasetID, hl7V2StoreID)

	policy, err := storesService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "IAM policy etag: %q\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.Hl7V2Stores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class Hl7v2StoreGetIamPolicy {
  private static final String HL7v2_NAME = "projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void hl7v2StoreGetIamPolicy(String hl7v2StoreName) throws IOException {
    // String hl7v2StoreName =
    //    String.format(
    //        HL7v2_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-hl7v2-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    Hl7V2Stores.GetIamPolicy request =
        client.projects().locations().datasets().hl7V2Stores().getIamPolicy(hl7v2StoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("HL7v2 store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getHl7v2StoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const hl7v2StoreId = 'my-hl7v2-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/hl7V2Stores/${hl7v2StoreId}`;
  const request = {resource_};

  const hl7v2Store =
    await healthcare.projects.locations.datasets.hl7V2Stores.getIamPolicy(
      request
    );
  console.log(
    'Got HL7v2 store IAM policy:',
    JSON.stringify(hl7v2Store.data, null, 2)
  );
};

getHl7v2StoreIamPolicy();

Python

def get_hl7v2_store_iam_policy(project_id, location, dataset_id, hl7v2_store_id):
    """Gets the IAM policy for the specified HL7v2 store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/hl7v2
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the HL7v2 store's parent dataset
    # hl7v2_store_id = 'my-hl7v2-store'  # replace with the HL7v2 store's ID
    hl7v2_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    hl7v2_store_name = f"{hl7v2_store_parent}/hl7V2Stores/{hl7v2_store_id}"

    request = (
        client.projects()
        .locations()
        .datasets()
        .hl7V2Stores()
        .getIamPolicy(resource=hl7v2_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

Modificar uma política

Os seguintes exemplos concedem a um novo utilizador a função roles/healthcare.hl7V2Consumer. Para mais informações, consulte projects.locations.datasets.hl7V2Stores.setIamPolicy.

Definir uma política

Consola

Para definir uma política de IAM ao nível da loja HL7v2, conclua os seguintes passos:

Na Google Cloud consola, aceda à página Conjuntos de dados.
Aceda aos conjuntos de dados
Clique no ID do conjunto de dados que contém o armazenamento de HL7v2 e, de seguida, selecione o armazenamento de HL7v2 para o qual quer definir uma política.
Clique em Mostrar painel de informações.
Clique em Adicionar principal.
No campo Novos responsáveis, introduza uma ou mais identidades que precisam de acesso ao armazenamento HL7v2.
Na lista Selecionar uma função, em Cloud Healthcare, selecione a autorização que quer conceder. Por exemplo, Consumidor de mensagens de HL7v2 da Healthcare.
Clique em Guardar.

gcloud

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no elemento roles/healthcare.hl7V2Consumer:

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, execute o comando set-iam-policy adequado para fazer as alterações. Para definir uma política ao nível do armazenamento HL7v2, execute o comando gcloud healthcare hl7v2-stores set-iam-policy. Especifique o nome do armazenamento HL7v2, o nome do conjunto de dados, a localização e o caminho para o ficheiro de política que criou.

gcloud healthcare hl7v2-stores set-iam-policy HL7V2_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

Se o pedido for bem-sucedido, o nome da loja HL7v2 e as associações são apresentados.

Updated IAM policy for hl7v2Store [HL7V2_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.hl7v2StoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.hl7v2Consumer
etag: bytes
version: VERSION_NUMBER

curl

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no elemento roles/healthcare.hl7V2Consumer:

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.hl7V2Stores.setIamPolicy para fazer as atualizações.

Para definir uma política de IAM ao nível do armazenamento HL7v2, faça um pedido POST e especifique o nome do conjunto de dados, o nome do armazenamento HL7v2, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.hl7V2Consumer existente.

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.hl7V2StoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.hl7V2Consumer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:setIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

Para conceder a função a um novo utilizador, anexe o respetivo endereço de email à matriz members no elemento roles/healthcare.hl7V2Consumer:

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.locations.datasets.hl7V2Stores.setIamPolicy para fazer as atualizações.

Para definir uma política de IAM ao nível do armazenamento HL7v2, faça um pedido POST e especifique o nome do conjunto de dados, o nome do armazenamento HL7v2, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.hl7V2Consumer existente:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.hl7V2StoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.hl7V2Consumer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:setIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setHL7V2IAMPolicy sets an IAM policy.
func setHL7V2IAMPolicy(w io.Writer, projectID, location, datasetID, hl7V2StoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %w", err)
	}

	storesService := healthcareService.Projects.Locations.Datasets.Hl7V2Stores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s", projectID, location, datasetID, hl7V2StoreID)

	policy, err := storesService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %w", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = storesService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %w", err)
	}

	fmt.Fprintf(w, "Sucessfully set IAM Policy.\n")
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.Hl7V2Stores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class Hl7v2StoreSetIamPolicy {
  private static final String HL7v2_NAME = "projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s";
  private static final JsonFactory JSON_FACTORY = new GsonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void hl7v2StoreSetIamPolicy(String hl7v2StoreName) throws IOException {
    // String hl7v2StoreName =
    //    String.format(
    //        HL7v2_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-hl7v2-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.hl7V2Consumer")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    Hl7V2Stores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .hl7V2Stores()
            .setIamPolicy(hl7v2StoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("HL7v2 policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setHl7v2StoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.hl7V2StoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/hl7V2Stores/${hl7v2StoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const hl7v2Store =
    await healthcare.projects.locations.datasets.hl7V2Stores.setIamPolicy(
      request
    );
  console.log(
    'Set HL7v2 store IAM policy:',
    JSON.stringify(hl7v2Store.data, null, 2)
  );
};

setHl7v2StoreIamPolicy();

Python

def set_hl7v2_store_iam_policy(
    project_id, location, dataset_id, hl7v2_store_id, member, role, etag=None
):
    """Sets the IAM policy for the specified HL7v2 store.
        A single member will be assigned a single role. A member can be any of:
        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/healthcare/api-client/v1/hl7v2
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the HL7v2 store's parent dataset
    # hl7v2_store_id = 'my-hl7v2-store'  # replace with the HL7v2 store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    hl7v2_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    hl7v2_store_name = f"{hl7v2_store_parent}/hl7V2Stores/{hl7v2_store_id}"

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .hl7V2Stores()
        .setIamPolicy(resource=hl7v2_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

Usar o IAM com a API Healthcare Natural Language

As secções seguintes mostram como obter, modificar e definir uma política para a API Healthcare Natural Language. Estas secções usam a seguinte política de exemplo como ponto de partida:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

Obter uma política

Os exemplos seguintes mostram como ler uma política de IAM ao nível do projeto. Para mais informações, consulte o método projects.getIamPolicy.

curl

Para ler a política IAM de um projeto, faça um pedido POST e especifique o nome do projeto e um token de acesso.

O exemplo seguinte mostra um pedido POST com curl:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

PowerShell

Para ver a política de IAM de um projeto, faça um pedido POST e especifique o nome do projeto e um token de acesso.

O exemplo seguinte mostra um pedido POST através do Windows PowerShell:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method POST `
  -Headers $headers `
  -Uri "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

Consola

Para ver a política de IAM de um projeto, conclua os seguintes passos:

Na Google Cloud consola, aceda à página IAM.
Aceda ao IAM
Para ver os principais atribuídos a uma função, clique em Funções e, de seguida, expanda a função.

gcloud

Para ver a política de IAM de um projeto, execute o comando gcloud projects get-iam-policy. Especifique o nome do projeto no pedido.

gcloud projects get-iam-policy PROJECT_ID

Se o pedido for bem-sucedido, as associações são apresentadas.

bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  role: roles/healthcare.nlpServiceViewer
etag: bytes
version: VERSION_NUMBER

Modificar uma política

Os exemplos seguintes concedem a um serviço a função roles/healthcare.nlpServiceViewer. Para mais informações, consulte projects.setIamPolicy.

Definir uma política

Consola

Para definir uma política de IAM ao nível do projeto, conclua os seguintes passos:

Na Google Cloud consola, aceda à página IAM.
Aceda ao IAM
Clique no botão Editar junto ao principal ou clique em Adicionar principal e, de seguida, no campo Novos principais, introduza uma ou mais identidades que precisam de acesso ao projeto.
Na lista Selecionar uma função, em Cloud Healthcare, selecione Healthcare Natural Language Service Viewer.
Clique em Guardar.

gcloud

Para conceder a função a uma nova conta de serviço, adicione o endereço de email da conta de serviço à matriz members no âmbito da roles/healthcare.nlpServiceViewer associação:

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, execute o comando gcloud projects set-iam-policy para fazer as alterações. Especifique o projeto e o caminho para o ficheiro de política que criou.

gcloud projects set-iam-policy PROJECT_STORE_ID \
    POLICY_FILE_NAME

Se o pedido for bem-sucedido, são apresentados o nome do projeto e as associações.

Updated IAM policy for project [PROJECT_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - serviceAccount:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.nlpServiceViewer
etag: bytes
version: VERSION_NUMBER

curl

Para conceder a função a uma nova conta de serviço, adicione o endereço de email da conta de serviço à matriz members no âmbito da roles/healthcare.nlpServiceViewer associação:

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.setIamPolicy para fazer as atualizações.

Para definir uma política IAM ao nível do projeto, faça um POST pedido e especifique o nome do projeto, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.nlpServiceViewer existente:

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.nlpServiceViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com'
            ]
          }
        ]
      }
    }" "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy"

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

PowerShell

Para conceder a função a uma nova conta de serviço, adicione o endereço de email da conta de serviço à matriz members no âmbito da roles/healthcare.nlpServiceViewer associação:

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}

Depois de modificar a política para conceder as funções aplicáveis, chame projects.setIamPolicy para fazer as atualizações.

Para definir uma política IAM ao nível do projeto, faça um POST pedido e especifique o nome do projeto, a política e um token de acesso.

O exemplo seguinte mostra um pedido POST que usa curl para conceder a um novo utilizador a função roles/healthcare.nlpServiceViewer existente:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.nlpServiceViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'serviceAccount:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy" | Select-Object -Expand Content

A resposta é a seguinte:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "serviceAccount:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}