Package google.iam.v1

Index

AuditConfig

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConifg must have one or more AuditLogConfigs.

If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditConfig are exempted.

Example Policy with multiple AuditConfigs:

{
  "audit_configs": [
    {
      "service": "allServices"
      "audit_log_configs": [
        {
          "log_type": "DATA_READ",
          "exempted_members": [
            "user:foo@gmail.com"
          ]
        },
        {
          "log_type": "DATA_WRITE",
        },
        {
          "log_type": "ADMIN_READ",
        }
      ]
    },
    {
      "service": "fooservice@googleapis.com"
      "audit_log_configs": [
        {
          "log_type": "DATA_READ",
        },
        {
          "log_type": "DATA_WRITE",
          "exempted_members": [
            "user:bar@gmail.com"
          ]
        }
      ]
    }
  ]
}

For fooservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts foo@gmail.com from DATA_READ logging, and bar@gmail.com from DATA_WRITE logging.

Fields
service

string

Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.

exempted_members[]
(deprecated)

string

audit_log_configs[]

AuditLogConfig

The configuration for logging of each type of permission. Next ID: 4

AuditLogConfig

Provides the configuration for logging a type of permissions. Example:

{
  "audit_log_configs": [
    {
      "log_type": "DATA_READ",
      "exempted_members": [
        "user:foo@gmail.com"
      ]
    },
    {
      "log_type": "DATA_WRITE",
    }
  ]
}

This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting foo@gmail.com from DATA_READ logging.

Fields
log_type

LogType

The log type that this config enables.

exempted_members[]

string

Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.

LogType

The list of valid permission types for which logging can be configured. Admin writes are always logged, and are not configurable.

Enums
LOG_TYPE_UNSPECIFIED Default case. Should never be this.
ADMIN_READ Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE Data writes. Example: CloudSQL Users create
DATA_READ Data reads. Example: CloudSQL Users list

AuthContext

Trusted attributes supplied by the IAM system.

Attr

Attribute types.

Enums
NO_ATTR Default non-attribute.
AUTHORITY Either principal or (if present) authority selector.
ATTRIBUTION The principal (even if an authority selector is present), which must only be used for attribution, not authorization.
APPROVER An approver (distinct from the requester) that has authorized this request. When used with IN, the condition indicates that one of the approvers associated with the request matches the specified principal, or is a member of the specified group. Approvers can only grant additional access, and are thus only used in a strictly positive context (e.g. ALLOW/IN or DENY/NOT_IN). See: go/rpc-security-policy-dynamicauth.
JUSTIFICATION_TYPE

What types of justifications have been supplied with this request. String values should match enum names from tech.iam.JustificationType, e.g. "MANUAL_STRING". It is not permitted to grant access based on the absence of a justification, so justification conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).

Multiple justifications, e.g., a Buganizer ID and a manually-entered reason, are normal and supported.

Binding

Associates members with a role.

Fields
role

string

Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner. Required

members[]

string

Specifies the identities requesting access for a Cloud Platform resource. members can have the following values:

  • allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.

  • allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account.

  • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.

  • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.

  • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.

  • domain:{domain}: A Google Apps domain name that represents all the users of that domain. For example, google.com or example.com.

Condition

A condition to be met.

Fields
op

Operator

An operator to apply the subject with.

value
(deprecated)

string

DEPRECATED. Use 'values' instead.

values[]

string

The objects of the condition. This is mutually exclusive with 'value'.

Union field Subject. Condition subject. Subject can be only one of the following:
iam

Attr

Trusted attributes supplied by the IAM system.

sys

Attr

Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.

svc

string

Trusted attributes discharged by the service.

Operator

Condition operator types.

Enums
NO_OP Default no-op.
EQUALS DEPRECATED. Use IN instead.
NOT_EQUALS DEPRECATED. Use NOT_IN instead.
IN The condition is true if the subject (or any element of it if it is a set) matches any of the supplied values.
NOT_IN The condition is true if the subject (or every element of it if it is a set) matches none of the supplied values.
DISCHARGED Subject is discharged

GetIamPolicyRequest

Request message for GetIamPolicy method.

Fields
resource

string

REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.

LogConfig

Specifies what kind of log the caller must write

Fields
Union field type. Must be set type can be only one of the following:
counter

CounterOptions

Counter options.

data_access

DataAccessOptions

Data access options.

cloud_audit

CloudAuditOptions

Cloud audit options.

CloudAuditOptions

Write a Cloud Audit log

CounterOptions

Options for counters

Fields
metric

string

The metric to update.

field

string

The field value to attribute.

DataAccessOptions

Write a Data Access (Gin) log

Policy

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.

A Policy consists of a list of bindings. A Binding binds a list of members to a role, where the members can be user accounts, Google groups, Google domains, and service accounts. A role is a named list of permissions defined by IAM.

Example

{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-other-app@appspot.gserviceaccount.com",
      ]
    },
    {
      "role": "roles/viewer",
      "members": ["user:sean@example.com"]
    }
  ]
}

For a description of IAM and its features, see the IAM developer's guide.

Fields
version

int32

Version of the Policy. The default version is 0.

bindings[]

Binding

Associates a list of members to a role. Multiple bindings must not be specified for the same role. bindings with no members will result in an error.

audit_configs[]

AuditConfig

Specifies cloud audit logging configuration for this policy.

rules[]

Rule

If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied.

etag

bytes

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy.

If no etag is provided in the call to setIamPolicy, then the existing policy is overwritten blindly.

iam_owned

bool

Rule

A rule to be applied in a Policy.

Fields
description

string

Human-readable description of the rule.

permissions[]

string

A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.

action

Action

Required

in[]

string

If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.

not_in[]

string

If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries. The format for in and not_in entries is the same as for members in a Binding (see google/iam/v1/policy.proto).

conditions[]

Condition

Additional restrictions that must be met

log_config[]

LogConfig

The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.

Action

Rule action types.

Enums
NO_ACTION Default no action.
ALLOW Matching 'Entries' grant access.
ALLOW_WITH_LOG Matching 'Entries' grant access and the caller promises to log the request per the returned log_configs.
DENY Matching 'Entries' deny access.
DENY_WITH_LOG Matching 'Entries' deny access and the caller promises to log the request per the returned log_configs.
LOG Matching 'Entries' tell IAM.Check callers to generate logs.

SetIamPolicyRequest

Request message for SetIamPolicy method.

Fields
resource

string

REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.

policy

Policy

REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.

update_mask

FieldMask

OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: paths: "bindings, etag" This field is only used by Cloud IAM.

SystemContext

Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.

Attr

Attribute types.

Enums
NO_ATTR Default non-attribute type
REGION Region of the resource
SERVICE Service name
NAME Resource name
IP IP address of the caller

TestIamPermissionsRequest

Request message for TestIamPermissions method.

Fields
resource

string

REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.

permissions[]

string

The set of permissions to check for the resource. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see IAM Overview.

TestIamPermissionsResponse

Response message for TestIamPermissions method.

Fields
permissions[]

string

A subset of TestPermissionsRequest.permissions that the caller is allowed.

Send feedback about...

Cloud Source Repositories