Reference documentation and code samples for the Google Cloud Org Policy V2 Client class OrgPolicyClient.
Service Description: An interface for managing organization policies.
The Cloud Org Policy service provides a simple mechanism for organizations to restrict the allowed configurations across their entire Cloud Resource hierarchy.
You can use a policy
to configure restrictions in Cloud resources. For
example, you can enforce a policy
that restricts which Google
Cloud Platform APIs can be activated in a certain part of your resource
hierarchy, or prevents serial port access to VM instances in a particular
folder.
Policies
are inherited down through the resource hierarchy. A policy
applied to a parent resource automatically applies to all its child resources
unless overridden with a policy
lower in the hierarchy.
A constraint
defines an aspect of a resource's configuration that can be
controlled by an organization's policy administrator. Policies
are a
collection of constraints
that defines their allowable configuration on a
particular resource and its child resources.
This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started:
$orgPolicyClient = new OrgPolicyClient();
try {
$formattedParent = $orgPolicyClient->projectName('[PROJECT]');
$policy = new Policy();
$response = $orgPolicyClient->createPolicy($formattedParent, $policy);
} finally {
$orgPolicyClient->close();
}
Many parameters require resource names to be formatted in a particular way. To assist with these names, this class includes a format method for each type of name, and additionally a parseName method to extract the individual identifiers contained within formatted names that are returned by the API.
Methods
folderName
Formats a string containing the fully-qualified path to represent a folder resource.
Parameter | |
---|---|
Name | Description |
folder |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted folder resource. |
folderPolicyName
Formats a string containing the fully-qualified path to represent a folder_policy resource.
Parameters | |
---|---|
Name | Description |
folder |
string
|
policy |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted folder_policy resource. |
organizationName
Formats a string containing the fully-qualified path to represent a organization resource.
Parameter | |
---|---|
Name | Description |
organization |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted organization resource. |
organizationPolicyName
Formats a string containing the fully-qualified path to represent a organization_policy resource.
Parameters | |
---|---|
Name | Description |
organization |
string
|
policy |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted organization_policy resource. |
policyName
Formats a string containing the fully-qualified path to represent a policy resource.
Parameters | |
---|---|
Name | Description |
project |
string
|
policy |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted policy resource. |
projectName
Formats a string containing the fully-qualified path to represent a project resource.
Parameter | |
---|---|
Name | Description |
project |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted project resource. |
projectPolicyName
Formats a string containing the fully-qualified path to represent a project_policy resource.
Parameters | |
---|---|
Name | Description |
project |
string
|
policy |
string
|
Returns | |
---|---|
Type | Description |
string | The formatted project_policy resource. |
parseName
Parses a formatted name string and returns an associative array of the components in the name.
The following name formats are supported: Template: Pattern
- folder: folders/{folder}
- folderPolicy: folders/{folder}/policies/{policy}
- organization: organizations/{organization}
- organizationPolicy: organizations/{organization}/policies/{policy}
- policy: projects/{project}/policies/{policy}
- project: projects/{project}
- projectPolicy: projects/{project}/policies/{policy}
The optional $template argument can be supplied to specify a particular pattern, and must match one of the templates listed above. If no $template argument is provided, or if the $template argument does not match one of the templates listed, then parseName will check each of the supported templates, and return the first match.
Parameters | |
---|---|
Name | Description |
formattedName |
string
The formatted name string |
template |
string
Optional name of template to match |
Returns | |
---|---|
Type | Description |
array | An associative array from name component IDs to component values. |
__construct
Constructor.
Parameters | |
---|---|
Name | Description |
options |
array
Optional. Options for configuring the service API wrapper. |
↳ apiEndpoint |
string
The address of the API remote host. May optionally include the port, formatted as "
|
↳ credentials |
string|array|FetchAuthTokenInterface|CredentialsWrapper
The credentials to be used by the client to authorize API calls. This option accepts either a path to a credentials file, or a decoded credentials file as a PHP array. Advanced usage: In addition, this option can also accept a pre-constructed Google\Auth\FetchAuthTokenInterface object or Google\ApiCore\CredentialsWrapper object. Note that when one of these objects are provided, any settings in $credentialsConfig will be ignored. |
↳ credentialsConfig |
array
Options used to configure credentials, including auth token caching, for the client. For a full list of supporting configuration options, see Google\ApiCore\CredentialsWrapper::build() . |
↳ disableRetries |
bool
Determines whether or not retries defined by the client configuration should be disabled. Defaults to |
↳ clientConfig |
string|array
Client method configuration, including retry settings. This option can be either a path to a JSON file, or a PHP array containing the decoded JSON data. By default this settings points to the default client config file, which is provided in the resources folder. |
↳ transport |
string|TransportInterface
The transport used for executing network requests. May be either the string |
↳ transportConfig |
array
Configuration options that will be used to construct the transport. Options for each supported transport type should be passed in a key for that transport. For example: $transportConfig = [ 'grpc' => [...], 'rest' => [...], ]; See the Google\ApiCore\Transport\GrpcTransport::build() and Google\ApiCore\Transport\RestTransport::build() methods for the supported options. |
↳ clientCertSource |
callable
A callable which returns the client cert as a string. This can be used to provide a certificate and private key to the transport layer for mTLS. |
createPolicy
Creates a Policy.
Returns a google.rpc.Status
with google.rpc.Code.NOT_FOUND
if the
constraint does not exist.
Returns a google.rpc.Status
with google.rpc.Code.ALREADY_EXISTS
if the
policy already exists on the given Cloud resource.
Parameters | |
---|---|
Name | Description |
parent |
string
Required. The Cloud resource that will parent the new Policy. Must be in one of the following forms:
|
policy |
Google\Cloud\OrgPolicy\V2\Policy
Required. |
optionalArgs |
array
Optional. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
Returns | |
---|---|
Type | Description |
Google\Cloud\OrgPolicy\V2\Policy |
use Google\ApiCore\ApiException;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
use Google\Cloud\OrgPolicy\V2\Policy;
/**
* @param string $formattedParent The Cloud resource that will parent the new Policy. Must be in
* one of the following forms:
* * `projects/{project_number}`
* * `projects/{project_id}`
* * `folders/{folder_id}`
* * `organizations/{organization_id}`
* Please see {@see OrgPolicyClient::projectName()} for help formatting this field.
*/
function create_policy_sample(string $formattedParent): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Prepare any non-scalar elements to be passed along with the request.
$policy = new Policy();
// Call the API and handle any network failures.
try {
/** @var Policy $response */
$response = $orgPolicyClient->createPolicy($formattedParent, $policy);
printf('Response data: %s' . PHP_EOL, $response->serializeToJsonString());
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function callSample(): void
{
$formattedParent = OrgPolicyClient::projectName('[PROJECT]');
create_policy_sample($formattedParent);
}
deletePolicy
Deletes a Policy.
Returns a google.rpc.Status
with google.rpc.Code.NOT_FOUND
if the
constraint or Org Policy does not exist.
Parameters | |
---|---|
Name | Description |
name |
string
Required. Name of the policy to delete.
See |
optionalArgs |
array
Optional. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
use Google\ApiCore\ApiException;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
/**
* @param string $formattedName Name of the policy to delete.
* See `Policy` for naming rules. Please see
* {@see OrgPolicyClient::policyName()} for help formatting this field.
*/
function delete_policy_sample(string $formattedName): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Call the API and handle any network failures.
try {
$orgPolicyClient->deletePolicy($formattedName);
printf('Call completed successfully.' . PHP_EOL);
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function callSample(): void
{
$formattedName = OrgPolicyClient::policyName('[PROJECT]', '[POLICY]');
delete_policy_sample($formattedName);
}
getEffectivePolicy
Gets the effective Policy
on a resource. This is the result of merging
Policies
in the resource hierarchy and evaluating conditions. The
returned Policy
will not have an etag
or condition
set because it is
a computed Policy
across multiple resources.
Subtrees of Resource Manager resource hierarchy with 'under:' prefix will not be expanded.
Parameters | |
---|---|
Name | Description |
name |
string
Required. The effective policy to compute. See |
optionalArgs |
array
Optional. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
Returns | |
---|---|
Type | Description |
Google\Cloud\OrgPolicy\V2\Policy |
use Google\ApiCore\ApiException;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
use Google\Cloud\OrgPolicy\V2\Policy;
/**
* @param string $formattedName The effective policy to compute. See `Policy` for naming rules. Please see
* {@see OrgPolicyClient::policyName()} for help formatting this field.
*/
function get_effective_policy_sample(string $formattedName): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Call the API and handle any network failures.
try {
/** @var Policy $response */
$response = $orgPolicyClient->getEffectivePolicy($formattedName);
printf('Response data: %s' . PHP_EOL, $response->serializeToJsonString());
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function callSample(): void
{
$formattedName = OrgPolicyClient::policyName('[PROJECT]', '[POLICY]');
get_effective_policy_sample($formattedName);
}
getPolicy
Gets a Policy
on a resource.
If no Policy
is set on the resource, NOT_FOUND is returned. The
etag
value can be used with UpdatePolicy()
to update a
Policy
during read-modify-write.
Parameters | |
---|---|
Name | Description |
name |
string
Required. Resource name of the policy. See |
optionalArgs |
array
Optional. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
Returns | |
---|---|
Type | Description |
Google\Cloud\OrgPolicy\V2\Policy |
use Google\ApiCore\ApiException;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
use Google\Cloud\OrgPolicy\V2\Policy;
/**
* @param string $formattedName Resource name of the policy. See `Policy` for naming
* requirements. Please see
* {@see OrgPolicyClient::policyName()} for help formatting this field.
*/
function get_policy_sample(string $formattedName): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Call the API and handle any network failures.
try {
/** @var Policy $response */
$response = $orgPolicyClient->getPolicy($formattedName);
printf('Response data: %s' . PHP_EOL, $response->serializeToJsonString());
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function callSample(): void
{
$formattedName = OrgPolicyClient::policyName('[PROJECT]', '[POLICY]');
get_policy_sample($formattedName);
}
listConstraints
Lists Constraints
that could be applied on the specified resource.
Parameters | |
---|---|
Name | Description |
parent |
string
Required. The Cloud resource that parents the constraint. Must be in one of the following forms:
|
optionalArgs |
array
Optional. |
↳ pageSize |
int
The maximum number of resources contained in the underlying API response. The API may return fewer values in a page, even if there are additional values to be retrieved. |
↳ pageToken |
string
A page token is used to specify a page of values to be returned. If no page token is specified (the default), the first page of values will be returned. Any page token used here must have been generated by a previous call to the API. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
Returns | |
---|---|
Type | Description |
Google\ApiCore\PagedListResponse |
use Google\ApiCore\ApiException;
use Google\ApiCore\PagedListResponse;
use Google\Cloud\OrgPolicy\V2\Constraint;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
/**
* @param string $formattedParent The Cloud resource that parents the constraint. Must be in one of
* the following forms:
* * `projects/{project_number}`
* * `projects/{project_id}`
* * `folders/{folder_id}`
* * `organizations/{organization_id}`
* Please see {@see OrgPolicyClient::projectName()} for help formatting this field.
*/
function list_constraints_sample(string $formattedParent): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Call the API and handle any network failures.
try {
/** @var PagedListResponse $response */
$response = $orgPolicyClient->listConstraints($formattedParent);
/** @var Constraint $element */
foreach ($response as $element) {
printf('Element data: %s' . PHP_EOL, $element->serializeToJsonString());
}
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function callSample(): void
{
$formattedParent = OrgPolicyClient::projectName('[PROJECT]');
list_constraints_sample($formattedParent);
}
listPolicies
Retrieves all of the Policies
that exist on a particular resource.
Parameters | |
---|---|
Name | Description |
parent |
string
Required. The target Cloud resource that parents the set of constraints and policies that will be returned from this call. Must be in one of the following forms:
|
optionalArgs |
array
Optional. |
↳ pageSize |
int
The maximum number of resources contained in the underlying API response. The API may return fewer values in a page, even if there are additional values to be retrieved. |
↳ pageToken |
string
A page token is used to specify a page of values to be returned. If no page token is specified (the default), the first page of values will be returned. Any page token used here must have been generated by a previous call to the API. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
Returns | |
---|---|
Type | Description |
Google\ApiCore\PagedListResponse |
use Google\ApiCore\ApiException;
use Google\ApiCore\PagedListResponse;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
use Google\Cloud\OrgPolicy\V2\Policy;
/**
* @param string $formattedParent The target Cloud resource that parents the set of constraints and
* policies that will be returned from this call. Must be in one of the
* following forms:
* * `projects/{project_number}`
* * `projects/{project_id}`
* * `folders/{folder_id}`
* * `organizations/{organization_id}`
* Please see {@see OrgPolicyClient::projectName()} for help formatting this field.
*/
function list_policies_sample(string $formattedParent): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Call the API and handle any network failures.
try {
/** @var PagedListResponse $response */
$response = $orgPolicyClient->listPolicies($formattedParent);
/** @var Policy $element */
foreach ($response as $element) {
printf('Element data: %s' . PHP_EOL, $element->serializeToJsonString());
}
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function callSample(): void
{
$formattedParent = OrgPolicyClient::projectName('[PROJECT]');
list_policies_sample($formattedParent);
}
updatePolicy
Updates a Policy.
Returns a google.rpc.Status
with google.rpc.Code.NOT_FOUND
if the
constraint or the policy do not exist.
Returns a google.rpc.Status
with google.rpc.Code.ABORTED
if the etag
supplied in the request does not match the persisted etag of the policy
Note: the supplied policy will perform a full overwrite of all fields.
Parameters | |
---|---|
Name | Description |
policy |
Google\Cloud\OrgPolicy\V2\Policy
Required. |
optionalArgs |
array
Optional. |
↳ updateMask |
FieldMask
Field mask used to specify the fields to be overwritten in the policy by the set. The fields specified in the update_mask are relative to the policy, not the full request. |
↳ retrySettings |
RetrySettings|array
Retry settings to use for this call. Can be a Google\ApiCore\RetrySettings object, or an associative array of retry settings parameters. See the documentation on Google\ApiCore\RetrySettings for example usage. |
Returns | |
---|---|
Type | Description |
Google\Cloud\OrgPolicy\V2\Policy |
use Google\ApiCore\ApiException;
use Google\Cloud\OrgPolicy\V2\OrgPolicyClient;
use Google\Cloud\OrgPolicy\V2\Policy;
/**
* This sample has been automatically generated and should be regarded as a code
* template only. It will require modifications to work:
* - It may require correct/in-range values for request initialization.
* - It may require specifying regional endpoints when creating the service client,
* please see the apiEndpoint client configuration option for more details.
*/
function update_policy_sample(): void
{
// Create a client.
$orgPolicyClient = new OrgPolicyClient();
// Prepare any non-scalar elements to be passed along with the request.
$policy = new Policy();
// Call the API and handle any network failures.
try {
/** @var Policy $response */
$response = $orgPolicyClient->updatePolicy($policy);
printf('Response data: %s' . PHP_EOL, $response->serializeToJsonString());
} catch (ApiException $ex) {
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
}
}
Constants
SERVICE_NAME
Value: 'google.cloud.orgpolicy.v2.OrgPolicy'
The name of the service.
SERVICE_ADDRESS
Value: 'orgpolicy.googleapis.com'
The default address of the service.
DEFAULT_SERVICE_PORT
Value: 443
The default port of the service.
CODEGEN_NAME
Value: 'gapic'
The name of the code generator, to be included in the agent header.