Namespace Google.Apis.PolicyTroubleshooter.v3.Data

Classes

GoogleCloudPolicytroubleshooterIamV3AccessTuple

Information about the principal, resource, and permission to check.

GoogleCloudPolicytroubleshooterIamV3AllowBindingExplanation

Details about how a role binding in an allow policy affects a principal's ability to use a permission.

GoogleCloudPolicytroubleshooterIamV3AllowBindingExplanationAnnotatedAllowMembership

Details about whether the role binding includes the principal.

GoogleCloudPolicytroubleshooterIamV3AllowPolicyExplanation

Details about how the relevant IAM allow policies affect the final access state.

GoogleCloudPolicytroubleshooterIamV3ConditionContext

Additional context for troubleshooting conditional role bindings and deny rules.

GoogleCloudPolicytroubleshooterIamV3ConditionContextEffectiveTag

A tag that applies to a resource during policy evaluation. Tags can be either directly bound to a resource or inherited from its ancestor. EffectiveTag contains the name and namespaced_name of the tag value and tag key, with additional fields of inherited to indicate the inheritance status of the effective tag.

GoogleCloudPolicytroubleshooterIamV3ConditionContextPeer

This message defines attributes for a node that handles a network request. The node can be either a service or an application that sends, forwards, or receives the request. Service peers should fill in principal and labels as appropriate.

GoogleCloudPolicytroubleshooterIamV3ConditionContextRequest

This message defines attributes for an HTTP request. If the actual request is not an HTTP request, the runtime system should try to map the actual request to an equivalent HTTP request.

GoogleCloudPolicytroubleshooterIamV3ConditionContextResource

Core attributes for a resource. A resource is an addressable (named) entity provided by the destination service. For example, a Compute Engine instance.

GoogleCloudPolicytroubleshooterIamV3ConditionExplanation

Explanation for how a condition affects a principal's access

GoogleCloudPolicytroubleshooterIamV3ConditionExplanationEvaluationState

Evaluated state of a condition expression.

GoogleCloudPolicytroubleshooterIamV3DenyPolicyExplanation

Details about how the relevant IAM deny policies affect the final access state.

GoogleCloudPolicytroubleshooterIamV3DenyRuleExplanation

Details about how a deny rule in a deny policy affects a principal's ability to use a permission.

GoogleCloudPolicytroubleshooterIamV3DenyRuleExplanationAnnotatedDenyPrincipalMatching

Details about whether the principal in the request is listed as a denied principal in the deny rule, either directly or through membership in a principal set.

GoogleCloudPolicytroubleshooterIamV3DenyRuleExplanationAnnotatedPermissionMatching

Details about whether the permission in the request is denied by the deny rule.

GoogleCloudPolicytroubleshooterIamV3ExplainedAllowPolicy

Details about how a specific IAM allow policy contributed to the final access state.

GoogleCloudPolicytroubleshooterIamV3ExplainedDenyPolicy

Details about how a specific IAM deny policy Policy contributed to the access check.

GoogleCloudPolicytroubleshooterIamV3ExplainedDenyResource

Details about how a specific resource contributed to the deny policy evaluation.

GoogleCloudPolicytroubleshooterIamV3TroubleshootIamPolicyRequest

Request for TroubleshootIamPolicy.

GoogleCloudPolicytroubleshooterIamV3TroubleshootIamPolicyResponse

Response for TroubleshootIamPolicy.

GoogleIamV1AuditConfig

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.

GoogleIamV1AuditLogConfig

Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.

GoogleIamV1Binding

Associates members, or principals, with a role.

GoogleIamV1Policy

An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A Policy is a collection of bindings. A binding binds one or more members, or principals, to a single role. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation. JSON example:

{
"bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com",
"group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] },
{ "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": {
"title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time
< timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 }

YAML example:

bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com -
serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin -
members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable
access description: Does not grant access after Sep 2020 expression: request.time <
timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3

For a description of IAM and its features, see the IAM documentation.

GoogleIamV2DenyRule

A deny rule in an IAM deny policy.

GoogleIamV2Policy

Data for an IAM policy.

GoogleIamV2PolicyRule

A single rule in a Policy.

GoogleRpcStatus

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

GoogleTypeExpr

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.