获取资源的 IAM 政策
深入探索
如需查看包含此代码示例的详细文档,请参阅以下内容:
代码示例
C#
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
using Google.Cloud.Iam.V1;
using Google.Cloud.Kms.V1;
using System;
public class IamGetPolicySample
{
public Policy IamGetPolicy(
string projectId = "my-project", string locationId = "us-east1", string keyRingId = "my-key-ring", string keyId = "my-key")
{
// Create the client.
KeyManagementServiceClient client = KeyManagementServiceClient.Create();
// Build the resource name.
CryptoKeyName resourceName = new CryptoKeyName(projectId, locationId, keyRingId, keyId);
// The resource name could also be a key ring.
// var resourceName = new KeyRingName(projectId, locationId, keyRingId);
// Get the current IAM policy.
Policy policy = client.IAMPolicyClient.GetIamPolicy(
new GetIamPolicyRequest
{
ResourceAsResourceName = resourceName
});
// Print the policy.
foreach (Binding b in policy.Bindings)
{
String role = b.Role;
foreach (String member in b.Members)
{
// ...
}
}
// Return the policy.
return policy;
}
}
Go
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
import (
"context"
"fmt"
"io"
kms "cloud.google.com/go/kms/apiv1"
)
// iamGetPolicy retrieves and prints the Cloud IAM policy associated with the
// Cloud KMS key.
func iamGetPolicy(w io.Writer, name string) error {
// NOTE: The resource name can be either a key or a key ring.
//
// name := "projects/my-project/locations/us-east1/keyRings/my-key-ring/cryptoKeys/my-key"
// name := "projects/my-project/locations/us-east1/keyRings/my-key-ring"
// Create the client.
ctx := context.Background()
client, err := kms.NewKeyManagementClient(ctx)
if err != nil {
return fmt.Errorf("failed to create kms client: %w", err)
}
defer client.Close()
// Get the current policy.
policy, err := client.ResourceIAM(name).Policy(ctx)
if err != nil {
return fmt.Errorf("failed to get IAM policy: %w", err)
}
// Print the policy members.
for _, role := range policy.Roles() {
fmt.Fprintf(w, "%s\n", role)
for _, member := range policy.Members(role) {
fmt.Fprintf(w, "- %s\n", member)
}
fmt.Fprintf(w, "\n")
}
return nil
}
Java
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
import com.google.cloud.kms.v1.CryptoKeyName;
import com.google.cloud.kms.v1.KeyManagementServiceClient;
import com.google.iam.v1.Binding;
import com.google.iam.v1.Policy;
import java.io.IOException;
public class IamGetPolicy {
public void iamGetPolicy() throws IOException {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String locationId = "us-east1";
String keyRingId = "my-key-ring";
String keyId = "my-key";
iamGetPolicy(projectId, locationId, keyRingId, keyId);
}
// Get the IAM policy for the given key.
public void iamGetPolicy(String projectId, String locationId, String keyRingId, String keyId)
throws IOException {
// Initialize client that will be used to send requests. This client only
// needs to be created once, and can be reused for multiple requests. After
// completing all of your requests, call the "close" method on the client to
// safely clean up any remaining background resources.
try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
// Build the key version name from the project, location, key ring, key,
// and key version.
CryptoKeyName resourceName = CryptoKeyName.of(projectId, locationId, keyRingId, keyId);
// The resource name could also be a key ring.
// KeyRingName resourceName = KeyRingName.of(projectId, locationId, keyRingId);
// Get the current policy.
Policy policy = client.getIamPolicy(resourceName);
// Print the policy.
System.out.printf("IAM policy:%n");
for (Binding binding : policy.getBindingsList()) {
System.out.printf("%s%n", binding.getRole());
for (String member : binding.getMembersList()) {
System.out.printf("- %s%n", member);
}
}
}
}
}
Node.js
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
//
// TODO(developer): Uncomment these variables before running the sample.
//
// const projectId = 'my-project';
// const locationId = 'us-east1';
// const keyRingId = 'my-key-ring';
// const keyId = 'my-key';
// const member = 'user:foo@example.com';
// Imports the Cloud KMS library
const {KeyManagementServiceClient} = require('@google-cloud/kms');
// Instantiates a client
const client = new KeyManagementServiceClient();
// Build the resource name
const resourceName = client.cryptoKeyPath(
projectId,
locationId,
keyRingId,
keyId
);
// The resource name could also be a key ring.
// const resourceName = client.keyRingPath(projectId, locationId, keyRingId);
async function iamGetPolicy() {
const [policy] = await client.getIamPolicy({
resource: resourceName,
});
for (const binding of policy.bindings) {
console.log(`Role: ${binding.role}`);
for (const member of binding.members) {
console.log(` - ${member}`);
}
}
return policy;
}
return iamGetPolicy();
PHP
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
use Google\Cloud\Iam\V1\GetIamPolicyRequest;
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
function iam_get_policy(
string $projectId = 'my-project',
string $locationId = 'us-east1',
string $keyRingId = 'my-key-ring',
string $keyId = 'my-key'
) {
// Create the Cloud KMS client.
$client = new KeyManagementServiceClient();
// Build the resource name.
$resourceName = $client->cryptoKeyName($projectId, $locationId, $keyRingId, $keyId);
// The resource name could also be a key ring.
// $resourceName = $client->keyRingName($projectId, $locationId, $keyRingId);
// Get the current IAM policy.
$getIamPolicyRequest = (new GetIamPolicyRequest())
->setResource($resourceName);
$policy = $client->getIamPolicy($getIamPolicyRequest);
// Print the policy.
printf('IAM policy for %s' . PHP_EOL, $resourceName);
foreach ($policy->getBindings() as $binding) {
printf('%s' . PHP_EOL, $binding->getRole());
foreach ($binding->getMembers() as $member) {
printf('- %s' . PHP_EOL, $member);
}
}
return $policy;
}
Python
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
from google.cloud import kms
from google.iam.v1 import policy_pb2 as iam_policy
def iam_get_policy(
project_id: str, location_id: str, key_ring_id: str, key_id: str
) -> iam_policy.Policy:
"""
Get the IAM policy for a resource.
Args:
project_id (string): Google Cloud project ID (e.g. 'my-project').
location_id (string): Cloud KMS location (e.g. 'us-east1').
key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').
key_id (string): ID of the key to use (e.g. 'my-key').
Returns:
Policy: Cloud IAM policy.
"""
# Create the client.
client = kms.KeyManagementServiceClient()
# Build the resource name.
resource_name = client.crypto_key_path(project_id, location_id, key_ring_id, key_id)
# The resource name could also be a key ring.
# resource_name = client.key_ring_path(project_id, location_id, key_ring_id);
# Get the current policy.
policy = client.get_iam_policy(request={"resource": resource_name})
# Print the policy
print(f"IAM policy for {resource_name}")
for binding in policy.bindings:
print(binding.role)
for member in binding.members:
print(f"- {member}")
return policy
Ruby
如需了解如何安装和使用 Cloud KMS 客户端库,请参阅 Cloud KMS 客户端库。
如需向 Cloud KMS 进行身份验证,请设置应用默认凭据。 如需了解详情,请参阅为本地开发环境设置身份验证。
# TODO(developer): uncomment these values before running the sample.
# project_id = "my-project"
# location_id = "us-east1"
# key_ring_id = "my-key-ring"
# key_id = "my-key"
# Require the library.
require "google/cloud/kms"
# Create the client.
client = Google::Cloud::Kms.key_management_service
# Build the resource name.
resource_name = client.crypto_key_path project: project_id,
location: location_id,
key_ring: key_ring_id,
crypto_key: key_id
# The resource name could also be a key ring.
# resource_name = client.key_ring_path project: project_id, location: location_id, key_ring: key_ring_id
# Create the IAM client.
iam_client = Google::Cloud::Kms::V1::IAMPolicy::Client.new
# Get the current IAM policy.
policy = iam_client.get_iam_policy resource: resource_name
# Print the policy.
puts "Policy for #{resource_name}"
policy.bindings.each do |bind|
puts bind.role
bind.members.each do |member|
puts "- #{member}"
end
end
后续步骤
如需搜索和过滤其他 Google Cloud 产品的代码示例,请参阅 Google Cloud 示例浏览器。