Class: Google::Apis::CloudassetV1::Options
- Inherits:
-
Object
- Object
- Google::Apis::CloudassetV1::Options
- Includes:
- Google::Apis::Core::Hashable, Google::Apis::Core::JsonObjectSupport
- Defined in:
- lib/google/apis/cloudasset_v1/classes.rb,
lib/google/apis/cloudasset_v1/representations.rb,
lib/google/apis/cloudasset_v1/representations.rb
Overview
Contains query options.
Instance Attribute Summary collapse
-
#analyze_service_account_impersonation ⇒ Boolean
(also: #analyze_service_account_impersonation?)
Optional.
-
#expand_groups ⇒ Boolean
(also: #expand_groups?)
Optional.
-
#expand_resources ⇒ Boolean
(also: #expand_resources?)
Optional.
-
#expand_roles ⇒ Boolean
(also: #expand_roles?)
Optional.
-
#output_group_edges ⇒ Boolean
(also: #output_group_edges?)
Optional.
-
#output_resource_edges ⇒ Boolean
(also: #output_resource_edges?)
Optional.
Instance Method Summary collapse
-
#initialize(**args) ⇒ Options
constructor
A new instance of Options.
-
#update!(**args) ⇒ Object
Update properties of this object.
Constructor Details
#initialize(**args) ⇒ Options
Returns a new instance of Options.
4500 4501 4502 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4500 def initialize(**args) update!(**args) end |
Instance Attribute Details
#analyze_service_account_impersonation ⇒ Boolean Also known as: analyze_service_account_impersonation?
Optional. If true, the response will include access analysis from identities
to resources via service account impersonation. This is a very expensive
operation, because many derived queries will be executed. We highly recommend
you use AssetService.AnalyzeIamPolicyLongrunning RPC instead. For example, if
the request analyzes for which resources user A has permission P, and there's
an IAM policy states user A has iam.serviceAccounts.getAccessToken permission
to a service account SA, and there's another IAM policy states service account
SA has permission P to a Google Cloud folder F, then user A potentially has
access to the Google Cloud folder F. And those advanced analysis results will
be included in AnalyzeIamPolicyResponse.service_account_impersonation_analysis.
Another example, if the request analyzes for who has permission P to a Google
Cloud folder F, and there's an IAM policy states user A has iam.
serviceAccounts.actAs permission to a service account SA, and there's another
IAM policy states service account SA has permission P to the Google Cloud
folder F, then user A potentially has access to the Google Cloud folder F. And
those advanced analysis results will be included in AnalyzeIamPolicyResponse.
service_account_impersonation_analysis. Only the following permissions are
considered in this analysis: * iam.serviceAccounts.actAs
* iam.
serviceAccounts.signBlob
* iam.serviceAccounts.signJwt
* iam.
serviceAccounts.getAccessToken
* iam.serviceAccounts.getOpenIdToken
* iam.
serviceAccounts.implicitDelegation
Default is false.
Corresponds to the JSON property analyzeServiceAccountImpersonation
4440 4441 4442 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4440 def analyze_service_account_impersonation @analyze_service_account_impersonation end |
#expand_groups ⇒ Boolean Also known as: expand_groups?
Optional. If true, the identities section of the result will expand any Google
groups appearing in an IAM policy binding. If IamPolicyAnalysisQuery.
identity_selector is specified, the identity in the result will be determined
by the selector, and this flag is not allowed to set. If true, the default max
expansion per group is 1000 for AssetService.AnalyzeIamPolicy][]. Default is
false.
Corresponds to the JSON property expandGroups
4451 4452 4453 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4451 def @expand_groups end |
#expand_resources ⇒ Boolean Also known as: expand_resources?
Optional. If true and IamPolicyAnalysisQuery.resource_selector is not
specified, the resource section of the result will expand any resource
attached to an IAM policy to include resources lower in the resource hierarchy.
For example, if the request analyzes for which resources user A has
permission P, and the results include an IAM policy with P on a Google Cloud
folder, the results will also include resources in that folder with permission
P. If true and IamPolicyAnalysisQuery.resource_selector is specified, the
resource section of the result will expand the specified resource to include
resources lower in the resource hierarchy. Only project or lower resources are
supported. Folder and organization resources cannot be used together with this
option. For example, if the request analyzes for which users have permission P
on a Google Cloud project with this option enabled, the results will include
all users who have permission P on that project or any lower resource. If true,
the default max expansion per resource is 1000 for AssetService.
AnalyzeIamPolicy][] and 100000 for AssetService.AnalyzeIamPolicyLongrunning][].
Default is false.
Corresponds to the JSON property expandResources
4472 4473 4474 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4472 def @expand_resources end |
#expand_roles ⇒ Boolean Also known as: expand_roles?
Optional. If true, the access section of result will expand any roles
appearing in IAM policy bindings to include their permissions. If
IamPolicyAnalysisQuery.access_selector is specified, the access section of the
result will be determined by the selector, and this flag is not allowed to set.
Default is false.
Corresponds to the JSON property expandRoles
4482 4483 4484 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4482 def @expand_roles end |
#output_group_edges ⇒ Boolean Also known as: output_group_edges?
Optional. If true, the result will output the relevant membership
relationships between groups and other groups, and between groups and
principals. Default is false.
Corresponds to the JSON property outputGroupEdges
4490 4491 4492 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4490 def output_group_edges @output_group_edges end |
#output_resource_edges ⇒ Boolean Also known as: output_resource_edges?
Optional. If true, the result will output the relevant parent/child
relationships between resources. Default is false.
Corresponds to the JSON property outputResourceEdges
4497 4498 4499 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4497 def output_resource_edges @output_resource_edges end |
Instance Method Details
#update!(**args) ⇒ Object
Update properties of this object
4505 4506 4507 4508 4509 4510 4511 4512 |
# File 'lib/google/apis/cloudasset_v1/classes.rb', line 4505 def update!(**args) @analyze_service_account_impersonation = args[:analyze_service_account_impersonation] if args.key?(:analyze_service_account_impersonation) @expand_groups = args[:expand_groups] if args.key?(:expand_groups) @expand_resources = args[:expand_resources] if args.key?(:expand_resources) @expand_roles = args[:expand_roles] if args.key?(:expand_roles) @output_group_edges = args[:output_group_edges] if args.key?(:output_group_edges) @output_resource_edges = args[:output_resource_edges] if args.key?(:output_resource_edges) end |