As of January 1, 2020 this library no longer supports Python 2 on the latest released version. Library versions released prior to that date will continue to be available. For more information please visit Python 2 support on Google Cloud.

Types for Google Cloud Policytroubleshooter v1 API¶

class google.cloud.policytroubleshooter_v1.types.AccessState(value)[source]¶

Bases: proto.enums.Enum

Whether a principal has a permission for a resource.

Values:

ACCESS_STATE_UNSPECIFIED (0):: Default value. This value is unused.
GRANTED (1):: The principal has the permission.
NOT_GRANTED (2):: The principal does not have the permission.
UNKNOWN_CONDITIONAL (3):: The principal has the permission only if a condition expression evaluates to true.
UNKNOWN_INFO_DENIED (4):: The sender of the request does not have access to all of the policies that Policy Troubleshooter needs to evaluate.

class google.cloud.policytroubleshooter_v1.types.AccessTuple(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Information about the principal, resource, and permission to check.

principal¶

Required. The principal whose access you want to check, in the form of the email address that represents that principal. For example, alice@example.com or my-service-account@my-project.iam.gserviceaccount.com.

The principal must be a Google Account or a service account. Other types of principals are not supported.

Type: str

full_resource_name¶

Required. The full resource name that identifies the resource. For example, //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance.

For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.

Type: str

permission¶

Required. The IAM permission to check for the specified principal and resource.

For a complete list of IAM permissions, see https://cloud.google.com/iam/help/permissions/reference.

For a complete list of predefined IAM roles and the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.

Type: str

class google.cloud.policytroubleshooter_v1.types.BindingExplanation(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Details about how a binding in a policy affects a principal’s ability to use a permission.

access¶

Required. Indicates whether this binding provides the specified permission to the specified principal for the specified resource.

This field does not indicate whether the principal actually has the permission for the resource. There might be another binding that overrides this binding. To determine whether the principal actually has the permission, use the access field in the [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].

Type: google.cloud.policytroubleshooter_v1.types.AccessState

role¶

The role that this binding grants. For example, roles/compute.serviceAgent.

For a complete list of predefined IAM roles, as well as the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.

Type: str

role_permission¶

Indicates whether the role granted by this binding contains the specified permission.

Type: google.cloud.policytroubleshooter_v1.types.BindingExplanation.RolePermission

role_permission_relevance¶

The relevance of the permission’s existence, or nonexistence, in the role to the overall determination for the entire policy.

Type: google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

memberships¶

Indicates whether each principal in the binding includes the principal specified in the request, either directly or indirectly. Each key identifies a principal in the binding, and each value indicates whether the principal in the binding includes the principal in the request.

For example, suppose that a binding includes the following principals:

user:alice@example.com
group:product-eng@example.com

You want to troubleshoot access for user:bob@example.com. This user is a principal of the group group:product-eng@example.com.

For the first principal in the binding, the key is user:alice@example.com, and the membership field in the value is set to MEMBERSHIP_NOT_INCLUDED.

For the second principal in the binding, the key is group:product-eng@example.com, and the membership field in the value is set to MEMBERSHIP_INCLUDED.

Type: MutableMapping[str, google.cloud.policytroubleshooter_v1.types.BindingExplanation.AnnotatedMembership]

relevance¶

The relevance of this binding to the overall determination for the entire policy.

Type: google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

condition¶

A condition expression that prevents this binding from granting access unless the expression evaluates to true.

To learn about IAM Conditions, see https://cloud.google.com/iam/help/conditions/overview.

Type: google.type.expr_pb2.Expr

class AnnotatedMembership(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Details about whether the binding includes the principal.

membership¶

Indicates whether the binding includes the principal.

Type: google.cloud.policytroubleshooter_v1.types.BindingExplanation.Membership

relevance¶

The relevance of the principal’s status to the overall determination for the binding.

Type: google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

class Membership(value)[source]¶

Bases: proto.enums.Enum

Whether the binding includes the principal.

Values:

MEMBERSHIP_UNSPECIFIED (0):

Default value. This value is unused.

MEMBERSHIP_INCLUDED (1):

The binding includes the principal. The principal can be included directly or indirectly. For example:

A principal is included directly if that principal is listed in the binding.
A principal is included indirectly if that principal is in a Google group or Google Workspace domain that is listed in the binding.

MEMBERSHIP_NOT_INCLUDED (2):

The binding does not include the principal.

MEMBERSHIP_UNKNOWN_INFO_DENIED (3):

The sender of the request is not allowed to access the binding.

MEMBERSHIP_UNKNOWN_UNSUPPORTED (4):

The principal is an unsupported type. Only Google Accounts and service accounts are supported.

class MembershipsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶: Bases: proto.message.Message

class RolePermission(value)[source]¶

Bases: proto.enums.Enum

Whether a role includes a specific permission.

Values:

ROLE_PERMISSION_UNSPECIFIED (0):: Default value. This value is unused.
ROLE_PERMISSION_INCLUDED (1):: The permission is included in the role.
ROLE_PERMISSION_NOT_INCLUDED (2):: The permission is not included in the role.
ROLE_PERMISSION_UNKNOWN_INFO_DENIED (3):: The sender of the request is not allowed to access the binding.

class google.cloud.policytroubleshooter_v1.types.ExplainedPolicy(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Details about how a specific IAM [Policy][google.iam.v1.Policy] contributed to the access check.

access¶

Indicates whether this policy provides the specified permission to the specified principal for the specified resource.

This field does not indicate whether the principal actually has the permission for the resource. There might be another policy that overrides this policy. To determine whether the principal actually has the permission, use the access field in the [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].

Type: google.cloud.policytroubleshooter_v1.types.AccessState

full_resource_name¶

The full resource name that identifies the resource. For example, //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance.

If the sender of the request does not have access to the policy, this field is omitted.

For examples of full resource names for Google Cloud services, see https://cloud.google.com/iam/help/troubleshooter/full-resource-names.

Type: str

policy¶

The IAM policy attached to the resource.

If the sender of the request does not have access to the policy, this field is empty.

Type: google.iam.v1.policy_pb2.Policy

binding_explanations¶

Details about how each binding in the policy affects the principal’s ability, or inability, to use the permission for the resource.

If the sender of the request does not have access to the policy, this field is omitted.

Type: MutableSequence[google.cloud.policytroubleshooter_v1.types.BindingExplanation]

relevance¶

The relevance of this policy to the overall determination in the [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].

If the sender of the request does not have access to the policy, this field is omitted.

Type: google.cloud.policytroubleshooter_v1.types.HeuristicRelevance

class google.cloud.policytroubleshooter_v1.types.HeuristicRelevance(value)[source]¶

Bases: proto.enums.Enum

The extent to which a single data point, such as the existence of a binding or whether a binding includes a specific principal, contributes to an overall determination.

Values:

HEURISTIC_RELEVANCE_UNSPECIFIED (0):: Default value. This value is unused.
NORMAL (1):: The data point has a limited effect on the result. Changing the data point is unlikely to affect the overall determination.
HIGH (2):: The data point has a strong effect on the result. Changing the data point is likely to affect the overall determination.

class google.cloud.policytroubleshooter_v1.types.TroubleshootIamPolicyRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Request for [TroubleshootIamPolicy][google.cloud.policytroubleshooter.v1.IamChecker.TroubleshootIamPolicy].

access_tuple¶

The information to use for checking whether a principal has a permission for a resource.

Type: google.cloud.policytroubleshooter_v1.types.AccessTuple

class google.cloud.policytroubleshooter_v1.types.TroubleshootIamPolicyResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Response for [TroubleshootIamPolicy][google.cloud.policytroubleshooter.v1.IamChecker.TroubleshootIamPolicy].

access¶

Indicates whether the principal has the specified permission for the specified resource, based on evaluating all of the applicable IAM policies.

Type: google.cloud.policytroubleshooter_v1.types.AccessState

explained_policies¶

List of IAM policies that were evaluated to check the principal’s permissions, with annotations to indicate how each policy contributed to the final result.

The list of policies can include the policy for the resource itself. It can also include policies that are inherited from higher levels of the resource hierarchy, including the organization, the folder, and the project.

To learn more about the resource hierarchy, see https://cloud.google.com/iam/help/resource-hierarchy.

Type: MutableSequence[google.cloud.policytroubleshooter_v1.types.ExplainedPolicy]

errors¶

The general errors contained in the troubleshooting response.

Type: MutableSequence[google.rpc.status_pb2.Status]

Types for Google Cloud Policytroubleshooter v1 API¶

google-cloud-policy-troubleshooter

Navigation

Related Topics