package google.iam.v1

Get desktop application:
View/edit binary Protocol Buffers messages

## API Overview Manages Identity and Access Management (IAM) policies. Any implementation of an API that offers access control features implements the google.iam.v1.IAMPolicy interface. ## Data model Access control is applied when a principal (user or service account), takes some action on a resource exposed by a service. Resources, identified by URI-like names, are the unit of access control specification. Service implementations can choose the granularity of access control and the supported permissions for their resources. For example one database service may allow access control to be specified only at the Table level, whereas another might allow access control to also be specified at the Column level. ## Policy Structure See google.iam.v1.Policy This is intentionally not a CRUD style API because access control policies are created and deleted implicitly with the resources to which they are attached.

rpc GetIamPolicy (GetIamPolicyRequest, Policy)
iam_policy.proto:66
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
rpc SetIamPolicy (SetIamPolicyRequest, Policy)
iam_policy.proto:59
Sets the access control policy on the specified resource. Replaces any existing policy.
rpc TestIamPermissions (TestIamPermissionsRequest, TestIamPermissionsResponse)
iam_policy.proto:73
Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a NOT_FOUND error.

Associates `members` with a `role`.

Used in: Policy

string role = 1
Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required
repeated string members = 2
Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.

One delta entry for Binding. Each individual change (only one member in each entry) to a binding will be a separate entry.

Used in: PolicyDelta

BindingDelta.Action action = 1
The action that was performed on a Binding. Required
string role = 2
Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required
string member = 3
A single identity requesting access for a Cloud Platform resource. Follows the same format of Binding.members. Required

The type of action performed on a Binding in a policy.

Used in: BindingDelta

ACTION_UNSPECIFIED = 0
Unspecified.
ADD = 1
Addition of a Binding.
REMOVE = 2
Removal of a Binding.

Request message for `GetIamPolicy` method.

Used as request type in: bigtable.admin.v2.BigtableInstanceAdmin.GetIamPolicy, cloud.iot.v1.DeviceManager.GetIamPolicy, cloud.resourcemanager.v2.Folders.GetIamPolicy, cloud.tasks.v2beta2.CloudTasks.GetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.GetIamPolicy, devtools.sourcerepo.v1.SourceRepo.GetIamPolicy, genomics.v1.DatasetServiceV1.GetIamPolicy, admin.v1.IAM.GetIamPolicy, IAMPolicy.GetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.GetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.GetIamPolicy

string resource = 1
REQUIRED: The resource for which the policy is being requested. `resource` is usually specified as a path. For example, a Project resource is specified as `projects/{project}`.

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. **Example** { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam).

Used as response type in: bigtable.admin.v2.BigtableInstanceAdmin.GetIamPolicy, bigtable.admin.v2.BigtableInstanceAdmin.SetIamPolicy, cloud.iot.v1.DeviceManager.GetIamPolicy, cloud.iot.v1.DeviceManager.SetIamPolicy, cloud.resourcemanager.v2.Folders.GetIamPolicy, cloud.resourcemanager.v2.Folders.SetIamPolicy, cloud.tasks.v2beta2.CloudTasks.GetIamPolicy, cloud.tasks.v2beta2.CloudTasks.SetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.GetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.SetIamPolicy, devtools.sourcerepo.v1.SourceRepo.GetIamPolicy, devtools.sourcerepo.v1.SourceRepo.SetIamPolicy, genomics.v1.DatasetServiceV1.GetIamPolicy, genomics.v1.DatasetServiceV1.SetIamPolicy, admin.v1.IAM.GetIamPolicy, admin.v1.IAM.SetIamPolicy, IAMPolicy.GetIamPolicy, IAMPolicy.SetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.GetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.SetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.GetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.SetIamPolicy

Used as field type in: SetIamPolicyRequest

int32 version = 1
Version of the `Policy`. The default version is 0.
repeated Binding bindings = 4
Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
bytes etag = 3
`etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.

The difference delta between two policies.

Used in: logging.AuditData

repeated BindingDelta binding_deltas = 1
The delta for Bindings between two policies.

Request message for `SetIamPolicy` method.

Used as request type in: bigtable.admin.v2.BigtableInstanceAdmin.SetIamPolicy, cloud.iot.v1.DeviceManager.SetIamPolicy, cloud.resourcemanager.v2.Folders.SetIamPolicy, cloud.tasks.v2beta2.CloudTasks.SetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.SetIamPolicy, devtools.sourcerepo.v1.SourceRepo.SetIamPolicy, genomics.v1.DatasetServiceV1.SetIamPolicy, admin.v1.IAM.SetIamPolicy, IAMPolicy.SetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.SetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.SetIamPolicy

string resource = 1
REQUIRED: The resource for which the policy is being specified. `resource` is usually specified as a path. For example, a Project resource is specified as `projects/{project}`.
optional Policy policy = 2
REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.

Request message for `TestIamPermissions` method.

string resource = 1
REQUIRED: The resource for which the policy detail is being requested. `resource` is usually specified as a path. For example, a Project resource is specified as `projects/{project}`.
repeated string permissions = 2
The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Response message for `TestIamPermissions` method.

repeated string permissions = 1
A subset of `TestPermissionsRequest.permissions` that the caller is allowed.

package google.iam.v1

service IAMPolicy

rpc GetIamPolicy (GetIamPolicyRequest, Policy)

rpc SetIamPolicy (SetIamPolicyRequest, Policy)

rpc TestIamPermissions (TestIamPermissionsRequest, TestIamPermissionsResponse)

message Binding

string role = 1

repeated string members = 2

message BindingDelta

BindingDelta.Action action = 1

string role = 2

string member = 3

enum BindingDelta.Action

ACTION_UNSPECIFIED = 0

ADD = 1

REMOVE = 2

message GetIamPolicyRequest

string resource = 1

message Policy

int32 version = 1

repeated Binding bindings = 4

bytes etag = 3

message PolicyDelta

repeated BindingDelta binding_deltas = 1

message SetIamPolicyRequest

string resource = 1

optional Policy policy = 2

message TestIamPermissionsRequest

string resource = 1

repeated string permissions = 2

message TestIamPermissionsResponse

repeated string permissions = 1