Class DenyRuleExplanation (0.1.7)

Version 0.1.7

• 0.1.10 (latest)
• 0.1.9

DenyRuleExplanation(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Details about how a deny rule in a deny policy affects a principal's ability to use a permission.

Attributes
Name	Description
deny_access_state	google.cloud.policytroubleshooter_iam_v3.types.DenyAccessState Required. Indicates whether *this rule* denies the specified permission to the specified principal for the specified resource. This field does *not* indicate whether the principal is actually denied on the permission for the resource. There might be another rule that overrides this rule. To determine whether the principal actually has the permission, use the overall_access_state field in the TroubleshootIamPolicyResponse.
combined_denied_permission	google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedPermissionMatching Indicates whether the permission in the request is listed as a denied permission in the deny rule.
denied_permissions	MutableMapping[str, google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedPermissionMatching] Lists all denied permissions in the deny rule and indicates whether each permission matches the permission in the request. Each key identifies a denied permission in the rule, and each value indicates whether the denied permission matches the permission in the request.
combined_exception_permission	google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedPermissionMatching Indicates whether the permission in the request is listed as an exception permission in the deny rule.
exception_permissions	MutableMapping[str, google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedPermissionMatching] Lists all exception permissions in the deny rule and indicates whether each permission matches the permission in the request. Each key identifies a exception permission in the rule, and each value indicates whether the exception permission matches the permission in the request.
combined_denied_principal	google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedDenyPrincipalMatching Indicates whether the principal is listed as a denied principal in the deny rule, either directly or through membership in a principal set.
denied_principals	MutableMapping[str, google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedDenyPrincipalMatching] Lists all denied principals in the deny rule and indicates whether each principal matches the principal in the request, either directly or through membership in a principal set. Each key identifies a denied principal in the rule, and each value indicates whether the denied principal matches the principal in the request.
combined_exception_principal	google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedDenyPrincipalMatching Indicates whether the principal is listed as an exception principal in the deny rule, either directly or through membership in a principal set.
exception_principals	MutableMapping[str, google.cloud.policytroubleshooter_iam_v3.types.DenyRuleExplanation.AnnotatedDenyPrincipalMatching] Lists all exception principals in the deny rule and indicates whether each principal matches the principal in the request, either directly or through membership in a principal set. Each key identifies a exception principal in the rule, and each value indicates whether the exception principal matches the principal in the request.
relevance	google.cloud.policytroubleshooter_iam_v3.types.HeuristicRelevance The relevance of this role binding to the overall determination for the entire policy.
condition	google.type.expr_pb2.Expr A condition expression that specifies when the deny rule denies the principal access. To learn about IAM Conditions, see https://cloud.google.com/iam/help/conditions/overview.
condition_explanation	google.cloud.policytroubleshooter_iam_v3.types.ConditionExplanation Condition evaluation state for this role binding.

Classes

AnnotatedDenyPrincipalMatching

AnnotatedDenyPrincipalMatching(
    mapping=None, *, ignore_unknown_fields=False, **kwargs
)

Details about whether the principal in the request is listed as a denied principal in the deny rule, either directly or through membership in a principal set.

AnnotatedPermissionMatching

AnnotatedPermissionMatching(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Details about whether the permission in the request is denied by the deny rule.

DeniedPermissionsEntry

DeniedPermissionsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

The abstract base class for a message.

Parameters
Name	Description
kwargs	dict Keys and values corresponding to the fields of the message.
mapping	Union[dict, .Message] A dictionary or message to be used to determine the values for this message.
ignore_unknown_fields	Optional(bool) If True, do not raise errors for unknown fields. Only applied if mapping is a mapping type or there are keyword parameters.

DeniedPrincipalsEntry

DeniedPrincipalsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

The abstract base class for a message.

Parameters
Name	Description
kwargs	dict Keys and values corresponding to the fields of the message.
mapping	Union[dict, .Message] A dictionary or message to be used to determine the values for this message.
ignore_unknown_fields	Optional(bool) If True, do not raise errors for unknown fields. Only applied if mapping is a mapping type or there are keyword parameters.

ExceptionPermissionsEntry

ExceptionPermissionsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

The abstract base class for a message.

Parameters
Name	Description
kwargs	dict Keys and values corresponding to the fields of the message.
mapping	Union[dict, .Message] A dictionary or message to be used to determine the values for this message.
ignore_unknown_fields	Optional(bool) If True, do not raise errors for unknown fields. Only applied if mapping is a mapping type or there are keyword parameters.

ExceptionPrincipalsEntry

ExceptionPrincipalsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

The abstract base class for a message.

Parameters
Name	Description
kwargs	dict Keys and values corresponding to the fields of the message.
mapping	Union[dict, .Message] A dictionary or message to be used to determine the values for this message.
ignore_unknown_fields	Optional(bool) If True, do not raise errors for unknown fields. Only applied if mapping is a mapping type or there are keyword parameters.