A request message for AssetService.AnalyzeIamPolicy.
Optional. The request options.
Classes
Options
Contains request options.
Optional. If true, the access section of result will expand any roles appearing in IAM policy bindings to include their permissions. If [access_selector][] is specified, the access section of the result will be determined by the selector, and this flag will have no effect. Default is false.
Optional. If true, the result will output resource edges, starting from the policy attached resource, to any expanded resources. Default is false.
Optional. If true, the response will include access analysis from identities to resources via service account impersonation. This is a very expensive operation, because many derived queries will be executed. We highly recommend you use ExportIamPolicyAnalysis rpc instead. For example, if the request analyzes for which resources user A has permission P, and there’s an IAM policy states user A has iam.serviceAccounts.getAccessToken permission to a service account SA, and there’s another IAM policy states service account SA has permission P to a GCP folder F, then user A potentially has access to the GCP folder F. And those advanced analysis results will be included in [AnalyzeIamPolicyResponse .service_account_impersonation_analysis][google.cloud.asset.v1 p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation _analysis]. Another example, if the request analyzes for who has permission P to a GCP folder F, and there’s an IAM policy states user A has iam.serviceAccounts.actAs permission to a service account SA, and there’s another IAM policy states service account SA has permission P to the GCP folder F, then user A potentially has access to the GCP folder F. And those advanced analysis results will be included in [AnalyzeIamPolic yResponse.service_account_impersonation_analysis][google.cloud .asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impe rsonation_analysis]. Default is false.