As of January 1, 2020 this library no longer supports Python 2 on the latest released version. Library versions released prior to that date will continue to be available. For more information please visit Python 2 support on Google Cloud.

Types for Google Cloud Policytroubleshooter v1 API

class google.cloud.policytroubleshooter_v1.types.AccessState(value)[source]

Bases: proto.enums.Enum

Whether a member has a permission for a resource.

ACCESS_STATE_UNSPECIFIED = 0
GRANTED = 1
NOT_GRANTED = 2
UNKNOWN_CONDITIONAL = 3
UNKNOWN_INFO_DENIED = 4
class google.cloud.policytroubleshooter_v1.types.AccessTuple(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Information about the member, resource, and permission to check.

principal

Required. The member, or principal, whose access you want to check, in the form of the email address that represents that member. For example, alice@example.com or my-service-account@my-project.iam.gserviceaccount.com.

The member must be a Google Account or a service account. Other types of members are not supported.

Type

str

full_resource_name

Required. The full resource name that identifies the resource. For example, //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance.

For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.

Type

str

permission

Required. The IAM permission to check for the specified member and resource. For a complete list of IAM permissions, see https://cloud.google.com/iam/help/permissions/reference. For a complete list of predefined IAM roles and the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.

Type

str

class google.cloud.policytroubleshooter_v1.types.BindingExplanation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details about how a binding in a policy affects a member’s ability to use a permission.

access

Required. Indicates whether this binding provides the specified permission to the specified member for the specified resource.

This field does not indicate whether the member actually has the permission for the resource. There might be another binding that overrides this binding. To determine whether the member actually has the permission, use the access field in the [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].

Type

google.cloud.policytroubleshooter_v1.types.AccessState

role

The role that this binding grants. For example, roles/compute.serviceAgent.

For a complete list of predefined IAM roles, as well as the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.

Type

str

role_permission

Indicates whether the role granted by this binding contains the specified permission.

Type

google.cloud.policytroubleshooter_v1.types.BindingExplanation.RolePermission

role_permission_relevance

The relevance of the permission’s existence, or nonexistence, in the role to the overall determination for the entire policy.

Type

google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

memberships

Indicates whether each member in the binding includes the member specified in the request, either directly or indirectly. Each key identifies a member in the binding, and each value indicates whether the member in the binding includes the member in the request.

For example, suppose that a binding includes the following members:

  • user:alice@example.com

  • group:product-eng@example.com

You want to troubleshoot access for user:bob@example.com. This user is a member of the group group:product-eng@example.com.

For the first member in the binding, the key is user:alice@example.com, and the membership field in the value is set to MEMBERSHIP_NOT_INCLUDED.

For the second member in the binding, the key is group:product-eng@example.com, and the membership field in the value is set to MEMBERSHIP_INCLUDED.

Type

Sequence[google.cloud.policytroubleshooter_v1.types.BindingExplanation.MembershipsEntry]

relevance

The relevance of this binding to the overall determination for the entire policy.

Type

google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

condition

A condition expression that prevents access unless the expression evaluates to true.

To learn about IAM Conditions, see http://cloud.google.com/iam/help/conditions/overview.

Type

google.type.expr_pb2.Expr

class AnnotatedMembership(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details about whether the binding includes the member.

membership

Indicates whether the binding includes the member.

Type

google.cloud.policytroubleshooter_v1.types.BindingExplanation.Membership

relevance

The relevance of the member’s status to the overall determination for the binding.

Type

google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

class Membership(value)[source]

Bases: proto.enums.Enum

Whether the binding includes the member.

MEMBERSHIP_INCLUDED = 1
MEMBERSHIP_NOT_INCLUDED = 2
MEMBERSHIP_UNKNOWN_INFO_DENIED = 3
MEMBERSHIP_UNKNOWN_UNSUPPORTED = 4
MEMBERSHIP_UNSPECIFIED = 0
class MembershipsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

class RolePermission(value)[source]

Bases: proto.enums.Enum

Whether a role includes a specific permission.

ROLE_PERMISSION_INCLUDED = 1
ROLE_PERMISSION_NOT_INCLUDED = 2
ROLE_PERMISSION_UNKNOWN_INFO_DENIED = 3
ROLE_PERMISSION_UNSPECIFIED = 0
class google.cloud.policytroubleshooter_v1.types.ExplainedPolicy(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Details about how a specific IAM [Policy][google.iam.v1.Policy] contributed to the access check.

access

Indicates whether this policy provides the specified permission to the specified member for the specified resource.

This field does not indicate whether the member actually has the permission for the resource. There might be another policy that overrides this policy. To determine whether the member actually has the permission, use the access field in the [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].

Type

google.cloud.policytroubleshooter_v1.types.AccessState

full_resource_name

The full resource name that identifies the resource. For example, //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance.

If the sender of the request does not have access to the policy, this field is omitted.

For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.

Type

str

policy

The IAM policy attached to the resource. If the sender of the request does not have access to the policy, this field is empty.

Type

google.iam.v1.policy_pb2.Policy

binding_explanations

Details about how each binding in the policy affects the member’s ability, or inability, to use the permission for the resource. If the sender of the request does not have access to the policy, this field is omitted.

Type

Sequence[google.cloud.policytroubleshooter_v1.types.BindingExplanation]

relevance

The relevance of this policy to the overall determination in the [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].

If the sender of the request does not have access to the policy, this field is omitted.

Type

google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

class google.cloud.policytroubleshooter_v1.types.HeuristicRelevance(value)[source]

Bases: proto.enums.Enum

The extent to which a single data point contributes to an overall determination.

HEURISTIC_RELEVANCE_UNSPECIFIED = 0
HIGH = 2
NORMAL = 1
class google.cloud.policytroubleshooter_v1.types.TroubleshootIamPolicyRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Request for [TroubleshootIamPolicy][google.cloud.policytroubleshooter.v1.IamChecker.TroubleshootIamPolicy].

access_tuple

The information to use for checking whether a member has a permission for a resource.

Type

google.cloud.policytroubleshooter_v1.types.AccessTuple

class google.cloud.policytroubleshooter_v1.types.TroubleshootIamPolicyResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]

Bases: proto.message.Message

Response for [TroubleshootIamPolicy][google.cloud.policytroubleshooter.v1.IamChecker.TroubleshootIamPolicy].

access

Indicates whether the member has the specified permission for the specified resource, based on evaluating all of the applicable IAM policies.

Type

google.cloud.policytroubleshooter_v1.types.AccessState

explained_policies

List of IAM policies that were evaluated to check the member’s permissions, with annotations to indicate how each policy contributed to the final result.

The list of policies can include the policy for the resource itself. It can also include policies that are inherited from higher levels of the resource hierarchy, including the organization, the folder, and the project. To learn more about the resource hierarchy, see https://cloud.google.com/iam/help/resource- hierarchy.

Type

Sequence[google.cloud.policytroubleshooter_v1.types.ExplainedPolicy]