控制对 Cloud Healthcare API 资源的访问权限

本页面介绍如何使用身份和访问权限管理 (IAM) 权限控制对 Cloud Healthcare API 数据集和数据存储区的权限。您可以通过 IAM 控制谁有权访问您的数据集和数据存储区。如需详细了解适用于 Cloud Healthcare API 的 IAM,请参阅访问权限控制

IAM 政策概览

您可以通过 IAM 政策管理对资源的访问权限。政策包含数组 bindings。此数组包含一组绑定,这些绑定是成员(如用户帐号或服务帐号)与角色之间的关联。政策使用 JSON 或 YAML 表示。

以下示例政策展示了已被授予 roles/healthcare.datasetAdmin 角色的 user-1@example.com,以及已被授予 roles/healthcare.datasetViewer 角色的 user-2@example.comservice-account-13@appspot.gserviceaccount.com

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

如需更新资源的政策,请使用读取-修改-写入模式。没有单独的方法用于创建、修改和撤消用户访问权限。

如需更新政策,请完成以下步骤:

  1. 通过调用资源的 getIamPolicy() 方法读取当前政策。例如,要读取某个数据集的当前政策,请调用 projects.locations.datasets.getIamPolicy
  2. 使用文本编辑器或以编程方式修改返回的政策,以添加或移除任何适用的成员以及为其授予的角色。
  3. 通过调用资源的 setIamPolicy() 方法写入更新后的政策。例如,要写入某个数据集更新后的政策,请调用 projects.locations.datasets.setIamPolicy

将数据集与 IAM 搭配使用

以下部分介绍了如何获取、修改和设置数据集的政策。 这些部分使用以下示例政策作为初始政策:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

获取政策

以下示例展示了如何读取数据集级层的 IAM 政策。如需了解详情,请参阅 projects.locations.datasets.getIamPolicy

curl

如需读取数据集的 IAM 政策,请发出 GET 请求并指定数据集的名称和访问令牌。

以下示例展示了使用 curlGET 请求。

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:getIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如需查看数据集的 IAM 政策,请发出 GET 请求并指定数据集的名称和访问令牌。

以下示例展示了使用 Windows PowerShell 的 GET 请求:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:getIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

控制台

要查看数据集的 IAM 政策,请执行以下操作:
  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 选择一个数据集,然后点击显示信息面板
  3. 要查看分配给某个角色的成员,请展开该角色。

gcloud

要查看数据集的 Cloud IAM 政策,请运行 gcloud healthcare datasets get-iam-policy 命令。指定数据集名称和位置。

gcloud healthcare datasets get-iam-policy DATASET_ID \
    --location=LOCATION

如果请求成功,则会显示绑定。

bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.datasetViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// datasetIAMPolicy gets the dataset's IAM policy.
func datasetIAMPolicy(w io.Writer, projectID, location, datasetID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	datasetsService := healthcareService.Projects.Locations.Datasets

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", projectID, location, datasetID)

	policy, err := datasetsService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class DatasetGetIamPolicy {
  private static final String DATASET_NAME = "projects/%s/locations/%s/datasets/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void datasetGetIamPolicy(String datasetName) throws IOException {
    // String datasetName =
    //     String.format(DATASET_NAME, "your-project-id", "your-region-id", "your-dataset-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    Datasets.GetIamPolicy request =
        client.projects().locations().datasets().getIamPolicy(datasetName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("Dataset IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getDatasetIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}`;
  const request = {resource_};

  const dataset = await healthcare.projects.locations.datasets.getIamPolicy(
    request
  );
  console.log(
    'Got dataset IAM policy:',
    JSON.stringify(dataset.data, null, 2)
  );
};

getDatasetIamPolicy();

Python

def get_dataset_iam_policy(project_id, location, dataset_id):
    """Gets the IAM policy for the specified dataset.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/datasets
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the dataset's location
    # dataset_id = 'my-dataset'  # replace with your dataset ID
    dataset_name = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )

    request = (
        client.projects().locations().datasets().getIamPolicy(resource=dataset_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

修改政策

以下示例向新用户授予 roles/healthcare.datasetViewer 角色:

设置政策

控制台

如需设置数据集级层 IAM 政策,请完成以下步骤:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 选择要为其设置政策的数据集,然后点击显示信息面板
  3. 点击添加成员
  4. 新成员字段中,输入需要访问数据集的一个或多个身份。
  5. 选择角色列表中的 Cloud Healthcare 下,选择您要授予的权限。例如 Healthcare Dataset Viewer。
  6. 点击保存

gcloud

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.datasetViewer 绑定下的 members 数组:

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请运行相应的 set-iam-policy 命令进行更改。要设置数据集级层的政策,请运行 gcloud healthcare datasets set-iam-policy 命令。指定数据集名称、位置以及您创建的政策文件的路径。

gcloud healthcare datasets set-iam-policy DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果请求成功,则会显示数据集名称和绑定。

Updated IAM policy for dataset [DATASET_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.datasetAdmin
  - user:user-1@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.datasetViewer
etag: bytes
version: VERSION_NUMBER

curl

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.datasetViewer 绑定下的 members 数组:

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.setIamPolicy 进行更新。

如需设置数据集级层 IAM 政策,请发出 POST 请求并指定数据集的名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.datasetViewer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.datasetAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.datasetViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:setIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.datasetViewer 绑定下的 members 数组:

{
  "role":"roles/healthcare.datasetViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.setIamPolicy 进行更新。

如需设置数据集级层 IAM 政策,请发出 POST 请求并指定数据集的名称、政策和访问令牌。

以下示例展示了使用 Windows PowerShell 向新用户授予现有 roles/healthcare.datasetViewer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.datasetAdmin',
          'members': [
            'user:user-1@example.com'
          ]
        },
        {
          'role': 'roles/healthcare.datasetViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID:setIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.datasetAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.datasetViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setDatasetIAMPolicy sets an IAM policy for the dataset.
func setDatasetIAMPolicy(w io.Writer, projectID, location, datasetID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	datasetsService := healthcareService.Projects.Locations.Datasets

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s", projectID, location, datasetID)

	policy, err := datasetsService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = datasetsService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class DatasetSetIamPolicy {
  private static final String DATASET_NAME = "projects/%s/locations/%s/datasets/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void datasetSetIamPolicy(String datasetName) throws IOException {
    // String datasetName =
    //     String.format(DATASET_NAME, "your-project-id", "your-region-id", "your-dataset-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the dataset.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.datasetViewer")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    Datasets.SetIamPolicy request =
        client.projects().locations().datasets().setIamPolicy(datasetName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("Dataset policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setDatasetIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.datasetViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const dataset = await healthcare.projects.locations.datasets.setIamPolicy(
    request
  );
  console.log(
    'Set dataset IAM policy:',
    JSON.stringify(dataset.data, null, 2)
  );
};

setDatasetIamPolicy();

Python

def set_dataset_iam_policy(project_id, location, dataset_id, member, role, etag=None):
    """Sets the IAM policy for the specified dataset.

        A single member will be assigned a single role. A member can be any of:

        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'

        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/datasets
    before running the sample.
    """
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the dataset's location
    # dataset_id = 'my-dataset'  # replace with your dataset ID
    dataset_name = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .setIamPolicy(resource=dataset_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

将 DICOM 存储区与 IAM 搭配使用

以下各部分介绍了如何获取、修改和设置 DICOM 存储区的政策。这些部分使用以下示例政策作为初始政策:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

获取政策

以下示例展示了如何读取 DICOM 存储区级层的 IAM 政策。如需了解详情,请参阅 projects.locations.datasets.dicomStores.getIamPolicy

控制台

要查看 DICOM 存储区的 IAM 政策,请执行以下操作:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 点击包含 DICOM 存储区的数据集的 ID,然后选择要为其获取政策的 DICOM 存储区。
  3. 点击显示信息面板
  4. 要查看分配给某个角色的成员,请展开该角色。

gcloud

要查看 DICOM 存储区的 IAM 政策,请运行 gcloud healthcare dicom-stores get-iam-policy 命令。指定 DICOM 存储区名称、数据集名称和位置。

gcloud healthcare dicom-stores get-iam-policy DICOM_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果请求成功,则会显示绑定。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.dicomStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.dicomViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// getDICOMIAMPolicy gets the DICOM store's IAM policy.
func getDICOMIAMPolicy(w io.Writer, projectID, location, datasetID, dicomStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	dicomService := healthcareService.Projects.Locations.Datasets.DicomStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/dicomStores/%s", projectID, location, datasetID, dicomStoreID)

	policy, err := dicomService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.DicomStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class DicomStoreGetIamPolicy {
  private static final String DICOM_NAME = "projects/%s/locations/%s/datasets/%s/dicomStores/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void dicomStoreGetIamPolicy(String dicomStoreName) throws IOException {
    // String dicomStoreName =
    //    String.format(
    //        DICOM_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-dicom-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    DicomStores.GetIamPolicy request =
        client.projects().locations().datasets().dicomStores().getIamPolicy(dicomStoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("DICOM store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getDicomStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/dicomStores/${dicomStoreId}`;
  const request = {resource_};

  const dicomStore =
    await healthcare.projects.locations.datasets.dicomStores.getIamPolicy(
      request
    );
  console.log(
    'Got DICOM store IAM policy:',
    JSON.stringify(dicomStore.data, null, 2)
  );
};

getDicomStoreIamPolicy();

Python

def get_dicom_store_iam_policy(project_id, location, dataset_id, dicom_store_id):
    """Gets the IAM policy for the specified DICOM store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/dicom
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the DICOM store's parent dataset ID
    # dicom_store_id = 'my-dicom-store'  # replace with the DICOM store's ID
    dicom_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    dicom_store_name = "{}/dicomStores/{}".format(dicom_store_parent, dicom_store_id)

    request = (
        client.projects()
        .locations()
        .datasets()
        .dicomStores()
        .getIamPolicy(resource=dicom_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

curl

如需读取 DICOM 存储区的 IAM 政策,请发出 GET 请求并指定数据集的名称、DICOM 存储区的名称和访问令牌。

以下示例展示了使用 curlGET 请求。

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:getIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如需读取 DICOM 存储区的 IAM 政策,请发出 GET 请求并指定数据集的名称、DICOM 存储区的名称和访问令牌。

以下示例展示了使用 Windows PowerShell 的 GET 请求:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:getIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

修改政策

以下示例向新用户授予 roles/healthcare.dicomViewer 角色。如需了解详情,请参阅 projects.locations.datasets.dicomStores.setIamPolicy

设置政策

控制台

如需设置 DICOM 存储区级层 IAM 政策,请完成以下步骤:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 点击包含 DICOM 存储区的数据集的 ID,然后选择要为其设置政策的 DICOM 存储区。
  3. 点击显示信息面板
  4. 点击添加成员
  5. 新成员字段中,输入需要访问 DICOM 存储区的一个或多个身份。
  6. 选择角色列表中的 Cloud Healthcare 下,选择您要授予的权限。例如 Healthcare DICOM Store Viewer。
  7. 点击保存

gcloud

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.dicomViewer 绑定下的 members 数组:

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请运行相应的 set-iam-policy 命令进行更改。要设置 DICOM 存储区级层的政策,请运行 gcloud healthcare dicom-stores set-iam-policy 命令。指定 DICOM 存储区名称、数据集名称、位置以及您创建的政策文件的路径。

gcloud healthcare dicom-stores set-iam-policy DICOM_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果请求成功,则系统会显示 DICOM 存储区名称和绑定。

Updated IAM policy for dicomStore [DICOM_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.dicomStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.dicomViewer
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setDICOMIAMPolicy sets the DICOM store's IAM policy.
func setDICOMIAMPolicy(w io.Writer, projectID, location, datasetID, dicomStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	dicomService := healthcareService.Projects.Locations.Datasets.DicomStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/dicomStores/%s", projectID, location, datasetID, dicomStoreID)

	policy, err := dicomService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = dicomService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.DicomStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class DicomStoreSetIamPolicy {
  private static final String DICOM_NAME = "projects/%s/locations/%s/datasets/%s/dicomStores/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void dicomStoreSetIamPolicy(String dicomStoreName) throws IOException {
    // String dicomStoreName =
    //    String.format(
    //        DICOM_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-dicom-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.dicomStoreAdmin")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    DicomStores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .dicomStores()
            .setIamPolicy(dicomStoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("DICOM policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setDicomStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.dicomStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/dicomStores/${dicomStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const dicomStore =
    await healthcare.projects.locations.datasets.dicomStores.setIamPolicy(
      request
    );
  console.log(
    'Set DICOM store IAM policy:',
    JSON.stringify(dicomStore.data, null, 2)
  );
};

setDicomStoreIamPolicy();

Python

def set_dicom_store_iam_policy(
    project_id, location, dataset_id, dicom_store_id, member, role, etag=None
):
    """Sets the IAM policy for the specified DICOM store.

    A single member will be assigned a single role. A member can be any of:

    - allUsers, that is, anyone
    - allAuthenticatedUsers, anyone authenticated with a Google account
    - user:email, as in 'user:somebody@example.com'
    - group:email, as in 'group:admins@example.com'
    - domain:domainname, as in 'domain:example.com'
    - serviceAccount:email,
        as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'

    A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
    or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/dicom
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the DICOM store's parent dataset ID
    # dicom_store_id = 'my-dicom-store'  # replace with the DICOM store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    dicom_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    dicom_store_name = "{}/dicomStores/{}".format(dicom_store_parent, dicom_store_id)

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .dicomStores()
        .setIamPolicy(resource=dicom_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

curl

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.dicomViewer 绑定下的 members 数组:

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.dicomStores.setIamPolicy 进行更新。

如需设置 DICOM 存储区级层 IAM 政策,请发出 POST 请求并指定数据集的名称、DICOM 存储区的名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.dicomViewer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.dicomStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.dicomViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:setIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.dicomViewer 绑定下的 members 数组:

{
  "role":"roles/healthcare.dicomViewer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.dicomStores.setIamPolicy 进行更新。

如需设置 DICOM 存储区级层 IAM 政策,请发出 POST 请求并指定数据集的名称、DICOM 存储区的名称、政策和访问令牌。

以下示例展示了使用 Windows PowerShell 向新用户授予现有 roles/healthcare.dicomViewer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.dicomStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.dicomViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/dicomStores/DICOM_STORE_ID:setIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.dicomStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.dicomViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

将 FHIR 存储区与 IAM 搭配使用

以下各部分介绍了如何获取、修改和设置 FHIR 存储区的政策。这些部分使用以下示例政策作为初始政策:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

获取政策

以下示例展示了如何读取 FHIR 存储区级层的 IAM 政策。如需了解详情,请参阅 projects.locations.datasets.fhirStores.getIamPolicy

控制台

要查看 FHIR 存储区的 IAM 政策,请执行以下操作:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 点击包含 FHIR 存储区的数据集的 ID,然后选择要为其获取政策的 FHIR 存储区。
  3. 点击显示信息面板
  4. 要查看分配给某个角色的成员,请展开该角色。

gcloud

要查看 FHIR 存储区的 IAM 政策,请运行 gcloud healthcare fhir-stores get-iam-policy 命令。指定 FHIR 存储区名称、数据集名称和位置。

gcloud healthcare fhir-stores get-iam-policy FHIR_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果请求成功,则会显示绑定。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.fhirStoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.fhirResourceReader
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// getFHIRIAMPolicy gets the FHIR store's IAM policy.
func getFHIRIAMPolicy(w io.Writer, projectID, location, datasetID, fhirStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	fhirService := healthcareService.Projects.Locations.Datasets.FhirStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/fhirStores/%s", projectID, location, datasetID, fhirStoreID)

	policy, err := fhirService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM Policy etag: %v\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.FhirStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class FhirStoreGetIamPolicy {
  private static final String FHIR_NAME = "projects/%s/locations/%s/datasets/%s/fhirStores/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void fhirStoreGetIamPolicy(String fhirStoreName) throws IOException {
    // String fhirStoreName =
    //    String.format(
    //        FHIR_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-fhir-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    FhirStores.GetIamPolicy request =
        client.projects().locations().datasets().fhirStores().getIamPolicy(fhirStoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("FHIR store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getFhirStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const fhirStoreId = 'my-fhir-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/fhirStores/${fhirStoreId}`;
  const request = {resource_};

  const fhirStore =
    await healthcare.projects.locations.datasets.fhirStores.getIamPolicy(
      request
    );
  console.log(
    'Got FHIR store IAM policy:',
    JSON.stringify(fhirStore.data, null, 2)
  );
};

getFhirStoreIamPolicy();

Python

def get_fhir_store_iam_policy(project_id, location, dataset_id, fhir_store_id):
    """Gets the IAM policy for the specified FHIR store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/fhir
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Instantiates an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the parent dataset's ID
    # fhir_store_id = 'my-fhir-store' # replace with the FHIR store ID
    fhir_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    fhir_store_name = "{}/fhirStores/{}".format(fhir_store_parent, fhir_store_id)

    request = (
        client.projects()
        .locations()
        .datasets()
        .fhirStores()
        .getIamPolicy(resource=fhir_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

curl

如需读取 FHIR 存储区的 IAM 政策,请发出 POST 请求并指定数据集的名称、FHIR 存储区的名称和访问令牌。

以下示例展示了使用 curlPOST 请求。

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:getIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如需读取 FHIR 存储区的 IAM 政策,请发出 POST 请求并指定数据集的名称、FHIR 存储区的名称和访问令牌。

以下示例展示了使用 Windows PowerShell 的 POST 请求:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:getIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceReader",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

修改政策

以下示例向新用户授予 roles/healthcare.fhirResourceReader 角色。如需了解详情,请参阅 projects.locations.datasets.fhirStores.setIamPolicy

设置政策

控制台

如需设置 FHIR 存储区级层 IAM 政策,请完成以下步骤:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 点击包含 FHIR 存储区的数据集的 ID,然后选择要为其设置政策的 FHIR 存储区。
  3. 点击显示信息面板
  4. 点击添加成员
  5. 新成员字段中,输入需要访问 FHIR 存储区的一个或多个身份。
  6. 选择角色列表中的 Cloud Healthcare 下,选择您要授予的权限。例如 Healthcare FHIR Resource Reader。
  7. 点击保存

gcloud

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.fhirResourceReader 绑定下的 members 数组:

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请运行相应的 set-iam-policy 命令进行更改。 要设置 FHIR 存储区级层的政策,请运行 gcloud healthcare fhir-stores set-iam-policy 命令。指定 FHIR 存储区名称、数据集名称、位置以及您创建的政策文件的路径。

gcloud healthcare fhir-stores set-iam-policy FHIR_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果请求成功,则系统会显示 FHIR 存储区名称和绑定。

Updated IAM policy for fhirStore [FHIR_STORE_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.fhirResourceReader
etag: bytes
version: VERSION_NUMBER

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setFHIRIAMPolicy sets the FHIR store's IAM policy.
func setFHIRIAMPolicy(w io.Writer, projectID, location, datasetID, fhirStoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	fhirService := healthcareService.Projects.Locations.Datasets.FhirStores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/fhirStores/%s", projectID, location, datasetID, fhirStoreID)

	policy, err := fhirService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = fhirService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM Policy version: %v\n", policy.Version)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.FhirStores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class FhirStoreSetIamPolicy {
  private static final String FHIR_NAME = "projects/%s/locations/%s/datasets/%s/fhirStores/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void fhirStoreSetIamPolicy(String fhirStoreName) throws IOException {
    // String fhirStoreName =
    //    String.format(
    //        FHIR_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-fhir-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.fhirResourceReader")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    FhirStores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .fhirStores()
            .setIamPolicy(fhirStoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("FHIR policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setFhirStoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const fhirStoreId = 'my-fhir-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.fhirStoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/fhirStores/${fhirStoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const fhirStore =
    await healthcare.projects.locations.datasets.fhirStores.setIamPolicy(
      request
    );
  console.log(
    'Set FHIR store IAM policy:',
    JSON.stringify(fhirStore.data, null, 2)
  );
};

setFhirStoreIamPolicy();

Python

def set_fhir_store_iam_policy(
    project_id,
    location,
    dataset_id,
    fhir_store_id,
    member,
    role,
    etag=None,
):
    """Sets the IAM policy for the specified FHIR store.
        A single member will be assigned a single role. A member can be any of:
        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/fhir
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Instantiates an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the parent dataset's ID
    # fhir_store_id = 'my-fhir-store' # replace with the FHIR store ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    fhir_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    fhir_store_name = "{}/fhirStores/{}".format(fhir_store_parent, fhir_store_id)

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .fhirStores()
        .setIamPolicy(resource=fhir_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

curl

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.fhirResourceReader 绑定下的 members 数组:

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.fhirStores.setIamPolicy 进行更新。

如需设置 FHIR 存储区级层 IAM 政策,请发出 POST 请求并指定数据集的名称、FHIR 存储区名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.fhirResourceReader 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.fhirStoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.fhirResourceReader',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:setIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.fhirResourceReader 绑定下的 members 数组:

{
  "role":"roles/healthcare.fhirResourceReader",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.fhirStores.setIamPolicy 进行更新。

如需设置 FHIR 存储区级层 IAM 政策,请发出 POST 请求并指定数据集的名称、FHIR 存储区名称、政策和访问令牌。

以下示例展示了使用 Windows PowerShell 向新用户授予现有 roles/healthcare.fhirResourceReader 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.fhirStoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.fhirResourceReader',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/fhirStores/FHIR_STORE_ID:setIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.fhirStoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.fhirResourceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

将 HL7v2 存储区与 IAM 搭配使用

以下部分介绍了如何获取、修改和设置适用于 HL7v2 存储区的政策。这些部分使用以下示例政策作为初始政策:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

获取政策

以下示例展示了如何读取 HL7v2 存储区级层的 IAM 政策。如需了解详情,请参阅 projects.locations.datasets.hl7V2Stores.getIamPolicy

控制台

要查看 HL7v2 存储区的 IAM 政策,请执行以下操作:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 点击包含 HL7v2 存储区的数据集的 ID,然后选择要为其获取政策的 HL7v2 存储区。
  3. 点击显示信息面板
  4. 要查看分配给某个角色的成员,请展开该角色。

gcloud

要查看 HL7v2 存储区的 IAM 政策,请运行 hl7v2-stores get-iam-policy 命令。指定 HL7v2 存储区名称、数据集名称和位置。

gcloud healthcare hl7v2-stores get-iam-policy HL7V2_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION

如果请求成功,则会显示绑定。

bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.hl7v2StoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  role: roles/healthcare.hl7v2Consumer
etag: bytes
version: VERSION_NUMBER

curl

如需读取 HL7v2 存储区的 IAM 政策,请发出 GET 请求并指定数据集的名称、HL7v2 存储区的名称和访问令牌。

以下示例展示了使用 curlGET 请求。

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:getIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

PowerShell

如需读取 HL7v2 存储区的 IAM 政策,请发出 GET 请求并指定数据集的名称、HL7v2 存储区的名称和访问令牌。

以下示例展示了使用 Windows PowerShell 的 GET 请求:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Get `
  -Headers $headers `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:getIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// hl7V2IAMPolicy gets the IAM policy.
func hl7V2IAMPolicy(w io.Writer, projectID, location, datasetID, hl7V2StoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	storesService := healthcareService.Projects.Locations.Datasets.Hl7V2Stores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s", projectID, location, datasetID, hl7V2StoreID)

	policy, err := storesService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "IAM policy etag: %q\n", policy.Etag)
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.Hl7V2Stores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Collections;

public class Hl7v2StoreGetIamPolicy {
  private static final String HL7v2_NAME = "projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void hl7v2StoreGetIamPolicy(String hl7v2StoreName) throws IOException {
    // String hl7v2StoreName =
    //    String.format(
    //        HL7v2_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-hl7v2-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Create request and configure any parameters.
    Hl7V2Stores.GetIamPolicy request =
        client.projects().locations().datasets().hl7V2Stores().getIamPolicy(hl7v2StoreName);

    // Execute the request and process the results.
    Policy policy = request.execute();
    System.out.println("HL7v2 store IAMPolicy retrieved: \n" + policy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const getHl7v2StoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const hl7v2StoreId = 'my-hl7v2-store';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/hl7V2Stores/${hl7v2StoreId}`;
  const request = {resource_};

  const hl7v2Store =
    await healthcare.projects.locations.datasets.hl7V2Stores.getIamPolicy(
      request
    );
  console.log(
    'Got HL7v2 store IAM policy:',
    JSON.stringify(hl7v2Store.data, null, 2)
  );
};

getHl7v2StoreIamPolicy();

Python

def get_hl7v2_store_iam_policy(project_id, location, dataset_id, hl7v2_store_id):
    """Gets the IAM policy for the specified HL7v2 store.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/hl7v2
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the HL7v2 store's parent dataset
    # hl7v2_store_id = 'my-hl7v2-store'  # replace with the HL7v2 store's ID
    hl7v2_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    hl7v2_store_name = "{}/hl7V2Stores/{}".format(hl7v2_store_parent, hl7v2_store_id)

    request = (
        client.projects()
        .locations()
        .datasets()
        .hl7V2Stores()
        .getIamPolicy(resource=hl7v2_store_name)
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    return response

修改政策

以下示例向新用户授予 roles/healthcare.hl7V2Consumer 角色。如需了解详情,请参阅 projects.locations.datasets.hl7V2Stores.setIamPolicy

设置政策

控制台

如需设置 HL7v2 存储区级层 IAM 政策,请完成以下步骤:

  1. 在 Cloud Console 中,转到“数据集”页面。

    转到“数据集”页面

  2. 点击包含 HL7v2 存储区的数据集的 ID,然后选择要为其设置政策的 HL7v2 存储区。
  3. 点击显示信息面板
  4. 点击添加成员
  5. 新成员字段中,输入需要访问 HL7v2 存储区的一个或多个身份。
  6. 选择角色列表中的 Cloud Healthcare 下,选择您要授予的权限。例如 Healthcare HL7v2 Message Consumer。
  7. 点击保存

gcloud

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.hl7V2Consumer 绑定下的 members 数组:

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请运行相应的 set-iam-policy 命令进行更改。 要设置 HL7v2 存储区级层的政策,请运行 gcloud healthcare hl7v2-stores set-iam-policy 命令。指定 HL7v2 存储区名称、数据集名称、位置以及您创建的政策文件的路径。

gcloud healthcare hl7v2-stores set-iam-policy HL7V2_STORE_ID \
    --dataset=DATASET_ID \
    --location=LOCATION \
    POLICY_FILE_NAME

如果请求成功,则系统会显示 HL7v2 存储区名称和绑定。

Updated IAM policy for hl7v2Store [HL7V2_STORE_ID].
bindings:
- members:
  - user:user-1@example.com
  role: roles/healthcare.hl7v2StoreAdmin
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - user:user-2@example.com
  - user:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.hl7v2Consumer
etag: bytes
version: VERSION_NUMBER

curl

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.hl7V2Consumer 绑定下的 members 数组:

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.hl7V2Stores.setIamPolicy 进行更新。

如需设置 HL7v2 存储区级层 IAM 政策,请发出 POST 请求并指定数据集的名称、HL7v2 存储区名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.hl7V2Consumer 角色的 POST 请求。

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.hl7V2StoreAdmin',
            'members': [
              'user:user-1@example.com'
            ]
          },
          {
            'role':'roles/healthcare.hl7V2Consumer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com',
              'user:user-2@example.com',
              'user:NEW_USER_EMAIL_ADDRESS'
            ]
          }
        ]
      }
    }" "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:setIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

PowerShell

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

要向新用户授予角色,请将其电子邮件地址附加到 roles/healthcare.hl7V2Consumer 绑定下的 members 数组:

{
  "role":"roles/healthcare.hl7V2Consumer",
  "members": [
    "serviceAccount:service-account-13@appspot.gserviceaccount.com",
    "user:user-2@example.com",
    "user:NEW_USER_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.locations.datasets.hl7V2Stores.setIamPolicy 进行更新。

如需设置 HL7v2 存储区级层 IAM 政策,请发出 POST 请求并指定数据集的名称、HL7v2 存储区名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.hl7V2Consumer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.hl7V2StoreAdmin',
          'members': [
            'user:user-1@example.com',
          ]
        },
        {
          'role': 'roles/healthcare.hl7V2Consumer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'user:user-2@example.com',
            'user:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://healthcare.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/datasets/DATASET_ID/hl7V2Stores/HL7V2_STORE_ID:setIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.hl7V2StoreAdmin",
      "members": [
        "user:user-1@example.com"
      ]
    },
    {
      "role":"roles/healthcare.hl7V2Consumer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:user-2@example.com",
        "user:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

Go

import (
	"context"
	"fmt"
	"io"

	healthcare "google.golang.org/api/healthcare/v1"
)

// setHL7V2IAMPolicy sets an IAM policy.
func setHL7V2IAMPolicy(w io.Writer, projectID, location, datasetID, hl7V2StoreID string) error {
	ctx := context.Background()

	healthcareService, err := healthcare.NewService(ctx)
	if err != nil {
		return fmt.Errorf("healthcare.NewService: %v", err)
	}

	storesService := healthcareService.Projects.Locations.Datasets.Hl7V2Stores

	name := fmt.Sprintf("projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s", projectID, location, datasetID, hl7V2StoreID)

	policy, err := storesService.GetIamPolicy(name).Do()
	if err != nil {
		return fmt.Errorf("GetIamPolicy: %v", err)
	}

	policy.Bindings = append(policy.Bindings, &healthcare.Binding{
		Members: []string{"user:example@example.com"},
		Role:    "roles/viewer",
	})

	req := &healthcare.SetIamPolicyRequest{
		Policy: policy,
	}

	policy, err = storesService.SetIamPolicy(name, req).Do()
	if err != nil {
		return fmt.Errorf("SetIamPolicy: %v", err)
	}

	fmt.Fprintf(w, "Sucessfully set IAM Policy.\n")
	return nil
}

Java

import com.google.api.client.http.HttpRequestInitializer;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.healthcare.v1.CloudHealthcare;
import com.google.api.services.healthcare.v1.CloudHealthcare.Projects.Locations.Datasets.Hl7V2Stores;
import com.google.api.services.healthcare.v1.CloudHealthcareScopes;
import com.google.api.services.healthcare.v1.model.Binding;
import com.google.api.services.healthcare.v1.model.Policy;
import com.google.api.services.healthcare.v1.model.SetIamPolicyRequest;
import com.google.auth.http.HttpCredentialsAdapter;
import com.google.auth.oauth2.GoogleCredentials;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;

public class Hl7v2StoreSetIamPolicy {
  private static final String HL7v2_NAME = "projects/%s/locations/%s/datasets/%s/hl7V2Stores/%s";
  private static final JsonFactory JSON_FACTORY = new JacksonFactory();
  private static final NetHttpTransport HTTP_TRANSPORT = new NetHttpTransport();

  public static void hl7v2StoreSetIamPolicy(String hl7v2StoreName) throws IOException {
    // String hl7v2StoreName =
    //    String.format(
    //        HL7v2_NAME, "your-project-id", "your-region-id", "your-dataset-id", "your-hl7v2-id");

    // Initialize the client, which will be used to interact with the service.
    CloudHealthcare client = createClient();

    // Configure the IAMPolicy to apply to the store.
    // For more information on understanding IAM roles, see the following:
    // https://cloud.google.com/iam/docs/understanding-roles
    Binding binding =
        new Binding()
            .setRole("roles/healthcare.hl7V2Consumer")
            .setMembers(Arrays.asList("domain:google.com"));
    Policy policy = new Policy().setBindings(Arrays.asList(binding));
    SetIamPolicyRequest policyRequest = new SetIamPolicyRequest().setPolicy(policy);

    // Create request and configure any parameters.
    Hl7V2Stores.SetIamPolicy request =
        client
            .projects()
            .locations()
            .datasets()
            .hl7V2Stores()
            .setIamPolicy(hl7v2StoreName, policyRequest);

    // Execute the request and process the results.
    Policy updatedPolicy = request.execute();
    System.out.println("HL7v2 policy has been updated: " + updatedPolicy.toPrettyString());
  }

  private static CloudHealthcare createClient() throws IOException {
    // Use Application Default Credentials (ADC) to authenticate the requests
    // For more information see https://cloud.google.com/docs/authentication/production
    GoogleCredentials credential =
        GoogleCredentials.getApplicationDefault()
            .createScoped(Collections.singleton(CloudHealthcareScopes.CLOUD_PLATFORM));

    // Create a HttpRequestInitializer, which will provide a baseline configuration to all requests.
    HttpRequestInitializer requestInitializer =
        request -> {
          new HttpCredentialsAdapter(credential).initialize(request);
          request.setConnectTimeout(60000); // 1 minute connect timeout
          request.setReadTimeout(60000); // 1 minute read timeout
        };

    // Build the client for interacting with the service.
    return new CloudHealthcare.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitializer)
        .setApplicationName("your-application-name")
        .build();
  }
}

Node.js

const google = require('@googleapis/healthcare');
const healthcare = google.healthcare({
  version: 'v1',
  auth: new google.auth.GoogleAuth({
    scopes: ['https://www.googleapis.com/auth/cloud-platform'],
  }),
});

const setHl7v2StoreIamPolicy = async () => {
  // TODO(developer): uncomment these lines before running the sample
  // const cloudRegion = 'us-central1';
  // const projectId = 'adjective-noun-123';
  // const datasetId = 'my-dataset';
  // const dicomStoreId = 'my-dicom-store';
  // const member = 'user:example@gmail.com';
  // const role = 'roles/healthcare.hl7V2StoreViewer';
  const resource_ = `projects/${projectId}/locations/${cloudRegion}/datasets/${datasetId}/hl7V2Stores/${hl7v2StoreId}`;
  const request = {
    resource_,
    resource: {
      policy: {
        bindings: [
          {
            members: member,
            role: role,
          },
        ],
      },
    },
  };

  const hl7v2Store =
    await healthcare.projects.locations.datasets.hl7V2Stores.setIamPolicy(
      request
    );
  console.log(
    'Set HL7v2 store IAM policy:',
    JSON.stringify(hl7v2Store.data, null, 2)
  );
};

setHl7v2StoreIamPolicy();

Python

def set_hl7v2_store_iam_policy(
    project_id, location, dataset_id, hl7v2_store_id, member, role, etag=None
):
    """Sets the IAM policy for the specified HL7v2 store.
        A single member will be assigned a single role. A member can be any of:
        - allUsers, that is, anyone
        - allAuthenticatedUsers, anyone authenticated with a Google account
        - user:email, as in 'user:somebody@example.com'
        - group:email, as in 'group:admins@example.com'
        - domain:domainname, as in 'domain:example.com'
        - serviceAccount:email,
            as in 'serviceAccount:my-other-app@appspot.gserviceaccount.com'
        A role can be any IAM role, such as 'roles/viewer', 'roles/owner',
        or 'roles/editor'.

    See https://github.com/GoogleCloudPlatform/python-docs-samples/tree/master/healthcare/api-client/v1/hl7v2
    before running the sample."""
    # Imports the Google API Discovery Service.
    from googleapiclient import discovery

    api_version = "v1"
    service_name = "healthcare"
    # Returns an authorized API client by discovering the Healthcare API
    # and using GOOGLE_APPLICATION_CREDENTIALS environment variable.
    client = discovery.build(service_name, api_version)

    # TODO(developer): Uncomment these lines and replace with your values.
    # project_id = 'my-project'  # replace with your GCP project ID
    # location = 'us-central1'  # replace with the parent dataset's location
    # dataset_id = 'my-dataset'  # replace with the HL7v2 store's parent dataset
    # hl7v2_store_id = 'my-hl7v2-store'  # replace with the HL7v2 store's ID
    # member = 'myemail@example.com'  # replace with an authorized member
    # role = 'roles/viewer'  # replace with a Healthcare API IAM role
    hl7v2_store_parent = "projects/{}/locations/{}/datasets/{}".format(
        project_id, location, dataset_id
    )
    hl7v2_store_name = "{}/hl7V2Stores/{}".format(hl7v2_store_parent, hl7v2_store_id)

    policy = {"bindings": [{"role": role, "members": [member]}]}

    if etag is not None:
        policy["etag"] = etag

    request = (
        client.projects()
        .locations()
        .datasets()
        .hl7V2Stores()
        .setIamPolicy(resource=hl7v2_store_name, body={"policy": policy})
    )
    response = request.execute()

    print("etag: {}".format(response.get("name")))
    print("bindings: {}".format(response.get("bindings")))
    return response

将 IAM 与 Healthcare Natural Language API 搭配使用

以下各部分展示了如何获取、修改和设置 Healthcare Natural Language API 政策。这些部分使用以下示例政策作为初始政策:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

获取政策

以下示例展示了如何读取项目级层的 IAM 政策。如需了解详情,请参阅 projects.getIamPolicy 方法。

curl

如需读取项目的 IAM 政策,请发出 POST 请求并指定项目的名称和访问令牌。

以下示例展示了使用 curlPOST 请求。

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
     "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

PowerShell

如需查看项目的 IAM 政策,请发出 POST 请求并指定项目的名称和访问令牌。

以下示例展示了使用 Windows PowerShell 的 POST 请求:

$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method POST `
  -Headers $headers `
  -Uri "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

控制台

如需查看项目的 IAM 政策,请完成以下步骤:

  1. 在 Cloud Console 中,转到 IAM 页面。

    转到 IAM 页面

  2. 如需查看分配给角色的成员,请点击角色,然后展开角色。

gcloud

如需查看数据集的 IAM 政策,请运行 gcloud projects get-iam-policy 命令。在请求中指定项目名称。

gcloud projects get-iam-policy PROJECT_ID 

如果请求成功,则会显示绑定。

bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  role: roles/healthcare.nlpServiceViewer
etag: bytes
version: VERSION_NUMBER

修改政策

以下示例会向服务授予 roles/healthcare.nlpServiceViewer 角色。如需了解详情,请参阅 projects.setIamPolicy

设置政策

控制台

如需设置项目级层 IAM 政策,请完成以下步骤:

  1. 在 Cloud Console 中,转到 IAM 页面。

    转到 IAM 页面

  2. 点击成员旁边的修改按钮或点击添加成员,然后在新成员字段中,输入需要访问项目的一个或多个身份。
  3. 选择角色列表中,在 Cloud Healthcare 下,选择 Healthcare Natural Language Service Viewer。
  4. 点击保存

gcloud

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

如需向新服务帐号授予角色,请将服务帐号的电子邮件地址添加到 roles/healthcare.nlpServiceViewer 绑定下的 members 数组中:

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请运行 gcloud projects set-iam-policy 命令进行更改。指定项目和您创建的政策文件的路径。

gcloud projects set-iam-policy PROJECT_STORE_ID \
    POLICY_FILE_NAME 

如果请求成功,则会显示项目名称和绑定。

Updated IAM policy for project [PROJECT_ID].
bindings:
- members:
  - serviceAccount:service-account-13@appspot.gserviceaccount.com
  - serviceAccount:NEW_USER_EMAIL_ADDRESS
  role: roles/healthcare.nlpServiceViewer
etag: bytes
version: VERSION_NUMBER

curl

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

如需向新服务帐号授予角色,请将服务帐号的电子邮件地址添加到 roles/healthcare.nlpServiceViewer 绑定下的 members 数组中:

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.setIamPolicy 进行更新。

如需设置项目级层 IAM 政策,请发出 POST 请求并指定项目名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.nlpServiceViewer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    --data "{
      'policy': {
        'bindings': [
          {
            'role':'roles/healthcare.nlpServiceViewer',
            'members': [
              'serviceAccount:service-account-13@appspot.gserviceaccount.com'
            ]
          }
        ]
      }
    }" "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy"

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com"
      ]
    }
  ]
}

PowerShell

通过以编程方式或使用文本编辑器修改检索到的政策,向用户授予角色或撤消用户的角色。etag 值会随政策更改而变化,因此您必须指定当前值。

如需向新服务帐号授予角色,请将服务帐号的电子邮件地址添加到 roles/healthcare.nlpServiceViewer 绑定下的 members 数组中:

{
  "role":"roles/healthcare.nlpServiceViewer",
  "members": [
      "serviceAccount:service-account-13@appspot.gserviceaccount.com",
      "serviceAccount:NEW_SERVICE_ACCOUNT_EMAIL_ADDRESS"
  ]
}
要撤消成员的访问权限,请从 members 数组中删除其电子邮件地址。要撤消某个角色的最后一个成员的访问权限,请删除该角色的 bindings 数组。 您不能在政策中添加没有成员的 bindings 数组。

修改完政策以授予适用的角色后,请调用 projects.setIamPolicy 进行更新。

如需设置项目级层 IAM 政策,请发出 POST 请求并指定项目名称、政策和访问令牌。

以下示例展示了使用 curl 向新用户授予现有 roles/healthcare.nlpServiceViewer 角色的 POST 请求:

政策可以直接写入请求,如下所示,它也可以作为 JSON 或 YAML 文件传入。如需查看更多示例以了解如何将政策格式设置为 JSON 或 YAML,请参阅 Policy
$cred = gcloud auth application-default print-access-token
$headers = @{ Authorization = "Bearer $cred" }

Invoke-WebRequest `
  -Method Post `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -Body "{
    'policy': {
      'bindings': [
        {
          'role': 'roles/healthcare.nlpServiceViewer',
          'members': [
            'serviceAccount:service-account-13@appspot.gserviceaccount.com',
            'serviceAccount:NEW_USER_EMAIL_ADDRESS'
          ]
        }
      ]
    }
  }" `
  -Uri "https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy" | Select-Object -Expand Content

如果请求成功,则服务器返回 JSON 格式的类似下列示例的响应:

{
  "etag":"bytes",
  "bindings": [
    {
      "role":"roles/healthcare.nlpServiceViewer",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "serviceAccount:NEW_USER_EMAIL_ADDRESS"
      ]
    }
  ]
}

后续步骤