Class: Google::Apis::CloudassetV1p4beta1::CloudAssetService

Inherits:
Google::Apis::Core::BaseService show all
Defined in:
generated/google/apis/cloudasset_v1p4beta1/service.rb

Overview

Cloud Asset API

The cloud asset API manages the history and inventory of cloud resources.

Examples:

require 'google/apis/cloudasset_v1p4beta1'

Cloudasset = Google::Apis::CloudassetV1p4beta1 # Alias the module
service = Cloudasset::CloudAssetService.new

See Also:

Instance Attribute Summary collapse

Attributes inherited from Google::Apis::Core::BaseService

#authorization, #base_path, #batch_path, #client, #client_options, #request_options, #root_url, #upload_path

Instance Method Summary collapse

Methods inherited from Google::Apis::Core::BaseService

#batch, #batch_upload, #fetch_all, #http

Methods included from Google::Apis::Core::Logging

#logger

Constructor Details

#initializeCloudAssetService

Returns a new instance of CloudAssetService.



45
46
47
48
# File 'generated/google/apis/cloudasset_v1p4beta1/service.rb', line 45

def initialize
  super('https://cloudasset.googleapis.com/', '')
  @batch_path = 'batch'
end

Instance Attribute Details

#keyString

Returns API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.

Returns:

  • (String)

    API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.



38
39
40
# File 'generated/google/apis/cloudasset_v1p4beta1/service.rb', line 38

def key
  @key
end

#quota_userString

Returns Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.

Returns:

  • (String)

    Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.



43
44
45
# File 'generated/google/apis/cloudasset_v1p4beta1/service.rb', line 43

def quota_user
  @quota_user
end

Instance Method Details

#analyze_iam_policy(parent, analysis_query_access_selector_permissions: nil, analysis_query_access_selector_roles: nil, analysis_query_identity_selector_identity: nil, analysis_query_resource_selector_full_resource_name: nil, options_analyze_service_account_impersonation: nil, options_execution_timeout: nil, options_expand_groups: nil, options_expand_resources: nil, options_expand_roles: nil, options_output_group_edges: nil, options_output_resource_edges: nil, fields: nil, quota_user: nil, options: nil) {|result, err| ... } ⇒ Google::Apis::CloudassetV1p4beta1::AnalyzeIamPolicyResponse

Analyzes IAM policies based on the specified request. Returns a list of IamPolicyAnalysisResult matching the request.

Parameters:

  • parent (String)

    Required. The relative name of the root asset. Only resources and IAM policies within the parent will be analyzed. This can only be an organization number (such as "organizations/123") or a folder number (such as "folders/123").

  • analysis_query_access_selector_permissions (Array<String>, String) (defaults to: nil)

    Optional. The permissions to appear in result.

  • analysis_query_access_selector_roles (Array<String>, String) (defaults to: nil)

    Optional. The roles to appear in result.

  • analysis_query_identity_selector_identity (String) (defaults to: nil)

    Required. The identity appear in the form of members in IAM policy binding.

  • analysis_query_resource_selector_full_resource_name (String) (defaults to: nil)

    Required. The full resource name .

  • options_analyze_service_account_impersonation (Boolean) (defaults to: nil)

    Optional. If true, the response will include access analysis from identities to resources via service account impersonation. This is a very expensive operation, because many derived queries will be executed. We highly recommend you use ExportIamPolicyAnalysis rpc instead. For example, if the request analyzes for which resources user A has permission P, and there's an IAM policy states user A has iam.serviceAccounts.getAccessToken permission to a service account SA, and there's another IAM policy states service account SA has permission P to a GCP folder F, then user A potentially has access to the GCP folder F. And those advanced analysis results will be included in AnalyzeIamPolicyResponse.service_account_impersonation_analysis. Another example, if the request analyzes for who has permission P to a GCP folder F, and there's an IAM policy states user A has iam.serviceAccounts.actAs permission to a service account SA, and there's another IAM policy states service account SA has permission P to the GCP folder F, then user A potentially has access to the GCP folder F. And those advanced analysis results will be included in AnalyzeIamPolicyResponse.service_account_impersonation_analysis. Default is false.

  • options_execution_timeout (String) (defaults to: nil)

    Optional. Amount of time executable has to complete. See JSON representation of Duration. If this field is set with a value less than the RPC deadline, and the execution of your query hasn't finished in the specified execution timeout, you will get a response with partial result. Otherwise, your query's execution will continue until the RPC deadline. If it's not finished until then, you will get a DEADLINE_EXCEEDED error. Default is empty.

  • options_expand_groups (Boolean) (defaults to: nil)

    Optional. If true, the identities section of the result will expand any Google groups appearing in an IAM policy binding. If identity_selector is specified, the identity in the result will be determined by the selector, and this flag will have no effect. Default is false.

  • options_expand_resources (Boolean) (defaults to: nil)

    Optional. If true, the resource section of the result will expand any resource attached to an IAM policy to include resources lower in the resource hierarchy. For example, if the request analyzes for which resources user A has permission P, and the results include an IAM policy with P on a GCP folder, the results will also include resources in that folder with permission P. If resource_selector is specified, the resource section of the result will be determined by the selector, and this flag will have no effect. Default is false.

  • options_expand_roles (Boolean) (defaults to: nil)

    Optional. If true, the access section of result will expand any roles appearing in IAM policy bindings to include their permissions. If access_selector is specified, the access section of the result will be determined by the selector, and this flag will have no effect. Default is false.

  • options_output_group_edges (Boolean) (defaults to: nil)

    Optional. If true, the result will output group identity edges, starting from the binding's group members, to any expanded identities. Default is false.

  • options_output_resource_edges (Boolean) (defaults to: nil)

    Optional. If true, the result will output resource edges, starting from the policy attached resource, to any expanded resources. Default is false.

  • fields (String) (defaults to: nil)

    Selector specifying which fields to include in a partial response.

  • quota_user (String) (defaults to: nil)

    Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.

  • options (Google::Apis::RequestOptions) (defaults to: nil)

    Request-specific options

Yields:

  • (result, err)

    Result & error if block supplied

Yield Parameters:

Returns:

Raises:



148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
# File 'generated/google/apis/cloudasset_v1p4beta1/service.rb', line 148

def analyze_iam_policy(parent, analysis_query_access_selector_permissions: nil, analysis_query_access_selector_roles: nil, analysis_query_identity_selector_identity: nil, analysis_query_resource_selector_full_resource_name: nil, options_analyze_service_account_impersonation: nil, options_execution_timeout: nil, options_expand_groups: nil, options_expand_resources: nil, options_expand_roles: nil, options_output_group_edges: nil, options_output_resource_edges: nil, fields: nil, quota_user: nil, options: nil, &block)
  command = make_simple_command(:get, 'v1p4beta1/{+parent}:analyzeIamPolicy', options)
  command.response_representation = Google::Apis::CloudassetV1p4beta1::AnalyzeIamPolicyResponse::Representation
  command.response_class = Google::Apis::CloudassetV1p4beta1::AnalyzeIamPolicyResponse
  command.params['parent'] = parent unless parent.nil?
  command.query['analysisQuery.accessSelector.permissions'] = analysis_query_access_selector_permissions unless analysis_query_access_selector_permissions.nil?
  command.query['analysisQuery.accessSelector.roles'] = analysis_query_access_selector_roles unless analysis_query_access_selector_roles.nil?
  command.query['analysisQuery.identitySelector.identity'] = analysis_query_identity_selector_identity unless analysis_query_identity_selector_identity.nil?
  command.query['analysisQuery.resourceSelector.fullResourceName'] = analysis_query_resource_selector_full_resource_name unless analysis_query_resource_selector_full_resource_name.nil?
  command.query['options.analyzeServiceAccountImpersonation'] =  unless .nil?
  command.query['options.executionTimeout'] = options_execution_timeout unless options_execution_timeout.nil?
  command.query['options.expandGroups'] = options_expand_groups unless options_expand_groups.nil?
  command.query['options.expandResources'] = options_expand_resources unless options_expand_resources.nil?
  command.query['options.expandRoles'] = options_expand_roles unless options_expand_roles.nil?
  command.query['options.outputGroupEdges'] = options_output_group_edges unless options_output_group_edges.nil?
  command.query['options.outputResourceEdges'] = options_output_resource_edges unless options_output_resource_edges.nil?
  command.query['fields'] = fields unless fields.nil?
  command.query['quotaUser'] = quota_user unless quota_user.nil?
  execute_or_queue_command(command, &block)
end

#export_iam_policy_analysis(parent, export_iam_policy_analysis_request_object = nil, fields: nil, quota_user: nil, options: nil) {|result, err| ... } ⇒ Google::Apis::CloudassetV1p4beta1::Operation

Exports IAM policy analysis based on the specified request. This API implements the google.longrunning.Operation API allowing you to keep track of the export. The metadata contains the request to help callers to map responses to requests.

Parameters:

  • parent (String)

    Required. The relative name of the root asset. Only resources and IAM policies within the parent will be analyzed. This can only be an organization number (such as "organizations/123") or a folder number (such as "folders/123").

  • export_iam_policy_analysis_request_object (Google::Apis::CloudassetV1p4beta1::ExportIamPolicyAnalysisRequest) (defaults to: nil)
  • fields (String) (defaults to: nil)

    Selector specifying which fields to include in a partial response.

  • quota_user (String) (defaults to: nil)

    Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.

  • options (Google::Apis::RequestOptions) (defaults to: nil)

    Request-specific options

Yields:

  • (result, err)

    Result & error if block supplied

Yield Parameters:

Returns:

Raises:



196
197
198
199
200
201
202
203
204
205
206
# File 'generated/google/apis/cloudasset_v1p4beta1/service.rb', line 196

def export_iam_policy_analysis(parent, export_iam_policy_analysis_request_object = nil, fields: nil, quota_user: nil, options: nil, &block)
  command = make_simple_command(:post, 'v1p4beta1/{+parent}:exportIamPolicyAnalysis', options)
  command.request_representation = Google::Apis::CloudassetV1p4beta1::ExportIamPolicyAnalysisRequest::Representation
  command.request_object = export_iam_policy_analysis_request_object
  command.response_representation = Google::Apis::CloudassetV1p4beta1::Operation::Representation
  command.response_class = Google::Apis::CloudassetV1p4beta1::Operation
  command.params['parent'] = parent unless parent.nil?
  command.query['fields'] = fields unless fields.nil?
  command.query['quotaUser'] = quota_user unless quota_user.nil?
  execute_or_queue_command(command, &block)
end