com.google.api.services.iam.v2beta.model

Class GoogleIamV2betaDenyRule

java.lang.Object

java.util.AbstractMap<String,Object>

com.google.api.client.util.GenericData

com.google.api.client.json.GenericJson

com.google.api.services.iam.v2beta.model.GoogleIamV2betaDenyRule

All Implemented Interfaces:

Cloneable, Map<String,Object>

public final class GoogleIamV2betaDenyRule
extends GenericJson

A deny rule in an IAM deny policy.

This is the Java data model class that specifies how to parse/serialize into the JSON that is transmitted over HTTP when working with the Identity and Access Management (IAM) API. For a detailed explanation see: https://developers.google.com/api-client-library/java/google-http-java-client/json

Author:

Google, Inc.

Nested Class Summary

Nested classes/interfaces inherited from class com.google.api.client.util.GenericData

GenericData.Flags

Nested classes/interfaces inherited from class java.util.AbstractMap

AbstractMap.SimpleEntry<K,V>, AbstractMap.SimpleImmutableEntry<K,V>

Nested classes/interfaces inherited from interface java.util.Map

Map.Entry<K,V>

Constructor Summary

Constructors

Constructor and Description
GoogleIamV2betaDenyRule()

Method Summary

Modifier and Type	Method and Description
GoogleIamV2betaDenyRule	clone()
GoogleTypeExpr	getDenialCondition() The condition that determines whether this deny rule applies to a request.
List<String>	getDeniedPermissions() The permissions that are explicitly denied by this rule.
List<String>	getDeniedPrincipals() The identities that are prevented from using one or more permissions on Google Cloud resources.
List<String>	getExceptionPermissions() Specifies the permissions that this rule excludes from the set of denied permissions given by `denied_permissions`.
List<String>	getExceptionPrincipals() The identities that are excluded from the deny rule, even if they are listed in the `denied_principals`.
GoogleIamV2betaDenyRule	set(String fieldName, Object value)
GoogleIamV2betaDenyRule	setDenialCondition(GoogleTypeExpr denialCondition) The condition that determines whether this deny rule applies to a request.
GoogleIamV2betaDenyRule	setDeniedPermissions(List<String> deniedPermissions) The permissions that are explicitly denied by this rule.
GoogleIamV2betaDenyRule	setDeniedPrincipals(List<String> deniedPrincipals) The identities that are prevented from using one or more permissions on Google Cloud resources.
GoogleIamV2betaDenyRule	setExceptionPermissions(List<String> exceptionPermissions) Specifies the permissions that this rule excludes from the set of denied permissions given by `denied_permissions`.
GoogleIamV2betaDenyRule	setExceptionPrincipals(List<String> exceptionPrincipals) The identities that are excluded from the deny rule, even if they are listed in the `denied_principals`.

Methods inherited from class com.google.api.client.json.GenericJson

getFactory, setFactory, toPrettyString, toString

Methods inherited from class com.google.api.client.util.GenericData

entrySet, equals, get, getClassInfo, getUnknownKeys, hashCode, put, putAll, remove, setUnknownKeys

Methods inherited from class java.util.AbstractMap

clear, containsKey, containsValue, isEmpty, keySet, size, values

Methods inherited from class java.lang.Object

finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.util.Map

compute, computeIfAbsent, computeIfPresent, forEach, getOrDefault, merge, putIfAbsent, remove, replace, replace, replaceAll

Constructor Detail

GoogleIamV2betaDenyRule

public GoogleIamV2betaDenyRule()

Method Detail

getDenialCondition

public GoogleTypeExpr getDenialCondition()

The condition that determines whether this deny rule applies to a request. If the condition expression evaluates to `true`, then the deny rule is applied; otherwise, the deny rule is not applied. Each deny rule is evaluated independently. If this deny rule does not apply to a request, other deny rules might still apply. The condition can use CEL functions that evaluate [resource tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other functions and operators are not supported.

Returns:

value or null for none

setDenialCondition

public GoogleIamV2betaDenyRule setDenialCondition(GoogleTypeExpr denialCondition)

The condition that determines whether this deny rule applies to a request. If the condition expression evaluates to `true`, then the deny rule is applied; otherwise, the deny rule is not applied. Each deny rule is evaluated independently. If this deny rule does not apply to a request, other deny rules might still apply. The condition can use CEL functions that evaluate [resource tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other functions and operators are not supported.

Parameters:

denialCondition - denialCondition or null for none

getDeniedPermissions

public List<String> getDeniedPermissions()

The permissions that are explicitly denied by this rule. Each permission uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.

Returns:

value or null for none

setDeniedPermissions

public GoogleIamV2betaDenyRule setDeniedPermissions(List<String> deniedPermissions)

The permissions that are explicitly denied by this rule. Each permission uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.

Parameters:

deniedPermissions - deniedPermissions or null for none

getDeniedPrincipals

public List<String> getDeniedPrincipals()

The identities that are prevented from using one or more permissions on Google Cloud resources. This field can contain the following values: * `principalSet://goog/public:all`: A special identifier that represents any principal that is on the internet, even if they do not have a Google Account or are not logged in. * `principal://goog/subject/{email_id}`: A specific Google Account. Includes Gmail, Cloud Identity, and Google Workspace user accounts. For example, `principal://goog/subject/alice@example.com`. * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific Google Account that was deleted recently. For example, `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If the Google Account is recovered, this identifier reverts to the standard identifier for a Google Account. * `principalSet://goog/group/{group_id}`: A Google group. For example, `principalSet://goog/group/admins@example.com`. * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group that was deleted recently. For example, `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`. If the Google group is restored, this identifier reverts to the standard identifier for a Google group. * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`: A Google Cloud service account. For example, `principal://iam.googleapis.com/projects/-/serviceAccounts /my-service-account@iam.gserviceaccount.com`. * `deleted:principal://iam.googleapis.com/project s/-/serviceAccounts/{service_account_id}?uid={uid}`: A Google Cloud service account that was deleted recently. For example, `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service- account@iam.gserviceaccount.com?uid=1234567890`. If the service account is undeleted, this identifier reverts to the standard identifier for a service account. * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the principals associated with the specified Google Workspace or Cloud Identity customer ID. For example, `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.

Returns:

value or null for none

setDeniedPrincipals

public GoogleIamV2betaDenyRule setDeniedPrincipals(List<String> deniedPrincipals)

The identities that are prevented from using one or more permissions on Google Cloud resources. This field can contain the following values: * `principalSet://goog/public:all`: A special identifier that represents any principal that is on the internet, even if they do not have a Google Account or are not logged in. * `principal://goog/subject/{email_id}`: A specific Google Account. Includes Gmail, Cloud Identity, and Google Workspace user accounts. For example, `principal://goog/subject/alice@example.com`. * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific Google Account that was deleted recently. For example, `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If the Google Account is recovered, this identifier reverts to the standard identifier for a Google Account. * `principalSet://goog/group/{group_id}`: A Google group. For example, `principalSet://goog/group/admins@example.com`. * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group that was deleted recently. For example, `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`. If the Google group is restored, this identifier reverts to the standard identifier for a Google group. * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`: A Google Cloud service account. For example, `principal://iam.googleapis.com/projects/-/serviceAccounts /my-service-account@iam.gserviceaccount.com`. * `deleted:principal://iam.googleapis.com/project s/-/serviceAccounts/{service_account_id}?uid={uid}`: A Google Cloud service account that was deleted recently. For example, `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service- account@iam.gserviceaccount.com?uid=1234567890`. If the service account is undeleted, this identifier reverts to the standard identifier for a service account. * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the principals associated with the specified Google Workspace or Cloud Identity customer ID. For example, `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.

Parameters:

deniedPrincipals - deniedPrincipals or null for none

getExceptionPermissions

public List<String> getExceptionPermissions()

Specifies the permissions that this rule excludes from the set of denied permissions given by `denied_permissions`. If a permission appears in `denied_permissions` _and_ in `exception_permissions` then it will _not_ be denied. The excluded permissions can be specified using the same syntax as `denied_permissions`.

Returns:

value or null for none

setExceptionPermissions

public GoogleIamV2betaDenyRule setExceptionPermissions(List<String> exceptionPermissions)

Specifies the permissions that this rule excludes from the set of denied permissions given by `denied_permissions`. If a permission appears in `denied_permissions` _and_ in `exception_permissions` then it will _not_ be denied. The excluded permissions can be specified using the same syntax as `denied_permissions`.

Parameters:

exceptionPermissions - exceptionPermissions or null for none

getExceptionPrincipals

public List<String> getExceptionPrincipals()

The identities that are excluded from the deny rule, even if they are listed in the `denied_principals`. For example, you could add a Google group to the `denied_principals`, then exclude specific users who belong to that group. This field can contain the same values as the `denied_principals` field, excluding `principalSet://goog/public:all`, which represents all users on the internet.

Returns:

value or null for none

setExceptionPrincipals

public GoogleIamV2betaDenyRule setExceptionPrincipals(List<String> exceptionPrincipals)

The identities that are excluded from the deny rule, even if they are listed in the `denied_principals`. For example, you could add a Google group to the `denied_principals`, then exclude specific users who belong to that group. This field can contain the same values as the `denied_principals` field, excluding `principalSet://goog/public:all`, which represents all users on the internet.

Parameters:

exceptionPrincipals - exceptionPrincipals or null for none

set

public GoogleIamV2betaDenyRule set(String fieldName,
                                   Object value)

Overrides:

set in class GenericJson

clone

public GoogleIamV2betaDenyRule clone()

Overrides:

clone in class GenericJson