API documentation for policytroubleshooter_iam_v3.types package.
Classes
AccessTuple
Information about the principal, resource, and permission to check.
AllowAccessState
Whether IAM allow policies gives the principal the permission.
Values:
ALLOW_ACCESS_STATE_UNSPECIFIED (0):
Not specified.
ALLOW_ACCESS_STATE_GRANTED (1):
The allow policy gives the principal the
permission.
ALLOW_ACCESS_STATE_NOT_GRANTED (2):
The allow policy doesn't give the principal
the permission.
ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL (3):
The allow policy gives the principal the permission if a
condition expression evaluate to true. However, the
sender of the request didn't provide enough context for
Policy Troubleshooter to evaluate the condition expression.
ALLOW_ACCESS_STATE_UNKNOWN_INFO (4):
The sender of the request doesn't have access
to all of the allow policies that Policy
Troubleshooter needs to evaluate the principal's
access.
AllowBindingExplanation
Details about how a role binding in an allow policy affects a principal's ability to use a permission.
AllowPolicyExplanation
Details about how the relevant IAM allow policies affect the final access state.
ConditionContext
Additional context for troubleshooting conditional role bindings and deny rules.
ConditionExplanation
Explanation for how a condition affects a principal's access
DenyAccessState
Whether IAM deny policies deny the principal the permission.
Values:
DENY_ACCESS_STATE_UNSPECIFIED (0):
Not specified.
DENY_ACCESS_STATE_DENIED (1):
The deny policy denies the principal the
permission.
DENY_ACCESS_STATE_NOT_DENIED (2):
The deny policy doesn't deny the principal
the permission.
DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL (3):
The deny policy denies the principal the permission if a
condition expression evaluates to true. However, the
sender of the request didn't provide enough context for
Policy Troubleshooter to evaluate the condition expression.
DENY_ACCESS_STATE_UNKNOWN_INFO (4):
The sender of the request does not have
access to all of the deny policies that Policy
Troubleshooter needs to evaluate the principal's
access.
DenyPolicyExplanation
Details about how the relevant IAM deny policies affect the final access state.
DenyRuleExplanation
Details about how a deny rule in a deny policy affects a principal's ability to use a permission.
ExplainedAllowPolicy
Details about how a specific IAM allow policy contributed to the final access state.
ExplainedDenyPolicy
Details about how a specific IAM deny policy
Policy][google.iam.v2.Policy] contributed to the access check.
ExplainedDenyResource
Details about how a specific resource contributed to the deny policy evaluation.
HeuristicRelevance
The extent to which a single data point contributes to an overall determination.
Values: HEURISTIC_RELEVANCE_UNSPECIFIED (0): Not specified. HEURISTIC_RELEVANCE_NORMAL (1): The data point has a limited effect on the result. Changing the data point is unlikely to affect the overall determination. HEURISTIC_RELEVANCE_HIGH (2): The data point has a strong effect on the result. Changing the data point is likely to affect the overall determination.
MembershipMatchingState
Whether the principal in the request matches the principal in the policy.
Values: MEMBERSHIP_MATCHING_STATE_UNSPECIFIED (0): Not specified. MEMBERSHIP_MATCHED (1): The principal in the request matches the principal in the policy. The principal can be included directly or indirectly:
- A principal is included directly if that principal is
listed in the role binding.
- A principal is included indirectly if that principal is
in a Google group, Google Workspace account, or Cloud
Identity domain that is listed in the policy.
MEMBERSHIP_NOT_MATCHED (2):
The principal in the request doesn't match
the principal in the policy.
MEMBERSHIP_UNKNOWN_INFO (3):
The principal in the policy is a group or
domain, and the sender of the request doesn't
have permission to view whether the principal in
the request is a member of the group or domain.
MEMBERSHIP_UNKNOWN_UNSUPPORTED (4):
The principal is an unsupported type.
PermissionPatternMatchingState
Whether the permission in the request matches the permission in the policy.
Values: PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED (0): Not specified. PERMISSION_PATTERN_MATCHED (1): The permission in the request matches the permission in the policy. PERMISSION_PATTERN_NOT_MATCHED (2): The permission in the request matches the permission in the policy.
RolePermissionInclusionState
Whether a role includes a specific permission.
Values: ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED (0): Not specified. ROLE_PERMISSION_INCLUDED (1): The permission is included in the role. ROLE_PERMISSION_NOT_INCLUDED (2): The permission is not included in the role. ROLE_PERMISSION_UNKNOWN_INFO (3): The sender of the request is not allowed to access the role definition.
TroubleshootIamPolicyRequest
Request for TroubleshootIamPolicy.
TroubleshootIamPolicyResponse
Response for TroubleshootIamPolicy.