Namespace Google.Apis.PolicyTroubleshooter.v3beta.Data

Classes

GoogleCloudPolicytroubleshooterIamV3betaAccessTuple

Information about the principal, resource, and permission to check.

GoogleCloudPolicytroubleshooterIamV3betaAllowBindingExplanation

Details about how a role binding in an allow policy affects a principal's ability to use a permission.

GoogleCloudPolicytroubleshooterIamV3betaAllowBindingExplanationAnnotatedAllowMembership

Details about whether the role binding includes the principal.

GoogleCloudPolicytroubleshooterIamV3betaAllowPolicyExplanation

Details about how the relevant IAM allow policies affect the final access state.

GoogleCloudPolicytroubleshooterIamV3betaConditionContext

Additional context for troubleshooting conditional role bindings and deny rules.

GoogleCloudPolicytroubleshooterIamV3betaConditionContextEffectiveTag

A tag that applies to a resource during policy evaluation. Tags can be either directly bound to a resource or inherited from its ancestor. EffectiveTag contains the name and namespaced_name of the tag value and tag key, with additional fields of inherited to indicate the inheritance status of the effective tag.

GoogleCloudPolicytroubleshooterIamV3betaConditionContextPeer

This message defines attributes for a node that handles a network request. The node can be either a service or an application that sends, forwards, or receives the request. Service peers should fill in principal and labels as appropriate.

GoogleCloudPolicytroubleshooterIamV3betaConditionContextRequest

This message defines attributes for an HTTP request. If the actual request is not an HTTP request, the runtime system should try to map the actual request to an equivalent HTTP request.

GoogleCloudPolicytroubleshooterIamV3betaConditionContextResource

Core attributes for a resource. A resource is an addressable (named) entity provided by the destination service. For example, a Compute Engine instance.

GoogleCloudPolicytroubleshooterIamV3betaConditionExplanation

Explanation for how a condition affects a principal's access

GoogleCloudPolicytroubleshooterIamV3betaConditionExplanationEvaluationState

Evaluated state of a condition expression.

GoogleCloudPolicytroubleshooterIamV3betaDenyPolicyExplanation

Details about how the relevant IAM deny policies affect the final access state.

GoogleCloudPolicytroubleshooterIamV3betaDenyRuleExplanation

Details about how a deny rule in a deny policy affects a principal's ability to use a permission.

GoogleCloudPolicytroubleshooterIamV3betaDenyRuleExplanationAnnotatedDenyPrincipalMatching

Details about whether the principal in the request is listed as a denied principal in the deny rule, either directly or through membership in a principal set.

GoogleCloudPolicytroubleshooterIamV3betaDenyRuleExplanationAnnotatedPermissionMatching

Details about whether the permission in the request is denied by the deny rule.

GoogleCloudPolicytroubleshooterIamV3betaExplainedAllowPolicy

Details about how a specific IAM allow policy contributed to the final access state.

GoogleCloudPolicytroubleshooterIamV3betaExplainedDenyPolicy

Details about how a specific IAM deny policy Policy contributed to the access check.

GoogleCloudPolicytroubleshooterIamV3betaExplainedDenyResource

Details about how a specific resource contributed to the deny policy evaluation.

GoogleCloudPolicytroubleshooterIamV3betaExplainedPABBindingAndPolicy

Details about how a principal access boundary binding and policy contributes to the principal access boundary explanation, with annotations to indicate how the binding and policy contribute to the overall access state.

GoogleCloudPolicytroubleshooterIamV3betaExplainedPABPolicy

Details about how a principal access boundary policy contributes to the explanation, with annotations to indicate how the policy contributes to the overall access state.

GoogleCloudPolicytroubleshooterIamV3betaExplainedPABPolicyVersion

Details about how a principal access boundary policy's version contributes to the policy's enforcement state.

GoogleCloudPolicytroubleshooterIamV3betaExplainedPABRule

Details about how a principal access boundary rule contributes to the explanation, with annotations to indicate how the rule contributes to the overall access state.

GoogleCloudPolicytroubleshooterIamV3betaExplainedPABRuleExplainedResource

Details about how a resource contributes to the explanation, with annotations to indicate how the resource contributes to the overall access state.

GoogleCloudPolicytroubleshooterIamV3betaExplainedPolicyBinding

Details about how a policy binding contributes to the policy explanation, with annotations to indicate how the policy binding contributes to the overall access state.

GoogleCloudPolicytroubleshooterIamV3betaPABPolicyExplanation

Details about how the relevant principal access boundary policies affect the overall access state.

GoogleCloudPolicytroubleshooterIamV3betaTroubleshootIamPolicyRequest

Request for TroubleshootIamPolicy.

GoogleCloudPolicytroubleshooterIamV3betaTroubleshootIamPolicyResponse

Response for TroubleshootIamPolicy.

GoogleIamV1AuditConfig

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.

GoogleIamV1AuditLogConfig

Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.

GoogleIamV1Binding

Associates members, or principals, with a role.

GoogleIamV1Policy

An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A Policy is a collection of bindings. A binding binds one or more members, or principals, to a single role. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation. JSON example:

{
"bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com",
"group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] },
{ "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": {
"title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time
&lt; timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 }

YAML example:

bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com -
serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin -
members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable
access description: Does not grant access after Sep 2020 expression: request.time &lt;
timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3

For a description of IAM and its features, see the IAM documentation.

GoogleIamV2DenyRule

A deny rule in an IAM deny policy.

GoogleIamV2Policy

Data for an IAM policy.

GoogleIamV2PolicyRule

A single rule in a Policy.

GoogleIamV3PolicyBinding

IAM policy binding resource.

GoogleIamV3PolicyBindingTarget

The full resource name of the resource to which the policy will be bound. Immutable once set.

GoogleIamV3PrincipalAccessBoundaryPolicy

An IAM principal access boundary policy resource.

GoogleIamV3PrincipalAccessBoundaryPolicyDetails

Principal access boundary policy details

GoogleIamV3PrincipalAccessBoundaryPolicyRule

Principal access boundary policy rule that defines the resource boundary.

GoogleRpcStatus

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

GoogleTypeExpr

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.