package google.iam.v1

Get desktop application:
View/edit binary Protocol Buffers messages

## API Overview Manages Identity and Access Management (IAM) policies. Any implementation of an API that offers access control features implements the google.iam.v1.IAMPolicy interface. ## Data model Access control is applied when a principal (user or service account), takes some action on a resource exposed by a service. Resources, identified by URI-like names, are the unit of access control specification. Service implementations can choose the granularity of access control and the supported permissions for their resources. For example one database service may allow access control to be specified only at the Table level, whereas another might allow access control to also be specified at the Column level. ## Policy Structure See google.iam.v1.Policy This is intentionally not a CRUD style API because access control policies are created and deleted implicitly with the resources to which they are attached.

rpc SetIamPolicy (SetIamPolicyRequest, Policy)
iam_policy.proto:65
Sets the access control policy on the specified resource. Replaces any existing policy.
rpc GetIamPolicy (GetIamPolicyRequest, Policy)
iam_policy.proto:75
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
rpc TestIamPermissions (TestIamPermissionsRequest, TestIamPermissionsResponse)
iam_policy.proto:89
Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a NOT_FOUND error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.

One delta entry for AuditConfig. Each individual change (only one exempted_member in each entry) to a AuditConfig will be a separate entry.

Used in: PolicyDelta

AuditConfigDelta.Action action = 1
The action that was performed on an audit configuration in a policy. Required
string service = 2
Specifies a service that was configured for Cloud Audit Logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services. Required
string exempted_member = 3
A single identity that is exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members.
string log_type = 4
Specifies the log_type that was be enabled. ADMIN_ACTIVITY is always enabled, and cannot be configured. Required

The type of action performed on an audit configuration in a policy.

Used in: AuditConfigDelta

ACTION_UNSPECIFIED = 0
Unspecified.
ADD = 1
Addition of an audit configuration.
REMOVE = 2
Removal of an audit configuration.

Associates `members` with a `role`.

Used in: Policy

string role = 1
Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
repeated string members = 2
Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
optional type.Expr condition = 3
The condition that is associated with this binding. NOTE: An unsatisfied condition will not allow user access via current binding. Different bindings, including their conditions, are examined independently.

One delta entry for Binding. Each individual change (only one member in each entry) to a binding will be a separate entry.

Used in: PolicyDelta

BindingDelta.Action action = 1
The action that was performed on a Binding. Required
string role = 2
Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required
string member = 3
A single identity requesting access for a Cloud Platform resource. Follows the same format of Binding.members. Required
optional type.Expr condition = 4
The condition that is associated with this binding.

The type of action performed on a Binding in a policy.

Used in: BindingDelta

ACTION_UNSPECIFIED = 0
Unspecified.
ADD = 1
Addition of a Binding.
REMOVE = 2
Removal of a Binding.

Request message for `GetIamPolicy` method.

Used as request type in: bigtable.admin.v2.BigtableInstanceAdmin.GetIamPolicy, bigtable.admin.v2.BigtableTableAdmin.GetIamPolicy, cloud.bigquery.connection.v1beta1.ConnectionService.GetIamPolicy, cloud.datacatalog.v1beta1.DataCatalog.GetIamPolicy, cloud.iot.v1.DeviceManager.GetIamPolicy, cloud.resourcemanager.v2.Folders.GetIamPolicy, cloud.securitycenter.v1.SecurityCenter.GetIamPolicy, cloud.securitycenter.v1beta1.SecurityCenter.GetIamPolicy, cloud.tasks.v2.CloudTasks.GetIamPolicy, cloud.tasks.v2beta2.CloudTasks.GetIamPolicy, cloud.tasks.v2beta3.CloudTasks.GetIamPolicy, devtools.containeranalysis.v1.ContainerAnalysis.GetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.GetIamPolicy, devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.GetIamPolicy, devtools.sourcerepo.v1.SourceRepo.GetIamPolicy, genomics.v1.DatasetServiceV1.GetIamPolicy, admin.v1.IAM.GetIamPolicy, IAMPolicy.GetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.GetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.GetIamPolicy

string resource = 1
REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.
optional GetPolicyOptions options = 2
OPTIONAL: A `GetPolicyOptions` object for specifying options to `GetIamPolicy`. This field is only used by Cloud IAM.

Encapsulates settings provided to GetIamPolicy.

Used in: GetIamPolicyRequest

int32 requested_policy_version = 1
Optional. The policy format version to be returned. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional bindings must specify version 3. Policies without any conditional bindings may specify any valid value or leave the field unset.

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members` to a single `role`. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions (defined by IAM or configured by users). A `binding` can optionally specify a `condition`, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource. **JSON Example** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": ["user:eve@example.com"], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ] } **YAML Example** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam/docs).

Used as response type in: bigtable.admin.v2.BigtableInstanceAdmin.GetIamPolicy, bigtable.admin.v2.BigtableInstanceAdmin.SetIamPolicy, bigtable.admin.v2.BigtableTableAdmin.GetIamPolicy, bigtable.admin.v2.BigtableTableAdmin.SetIamPolicy, cloud.bigquery.connection.v1beta1.ConnectionService.GetIamPolicy, cloud.bigquery.connection.v1beta1.ConnectionService.SetIamPolicy, cloud.datacatalog.v1beta1.DataCatalog.GetIamPolicy, cloud.datacatalog.v1beta1.DataCatalog.SetIamPolicy, cloud.iot.v1.DeviceManager.GetIamPolicy, cloud.iot.v1.DeviceManager.SetIamPolicy, cloud.resourcemanager.v2.Folders.GetIamPolicy, cloud.resourcemanager.v2.Folders.SetIamPolicy, cloud.securitycenter.v1.SecurityCenter.GetIamPolicy, cloud.securitycenter.v1.SecurityCenter.SetIamPolicy, cloud.securitycenter.v1beta1.SecurityCenter.GetIamPolicy, cloud.securitycenter.v1beta1.SecurityCenter.SetIamPolicy, cloud.tasks.v2.CloudTasks.GetIamPolicy, cloud.tasks.v2.CloudTasks.SetIamPolicy, cloud.tasks.v2beta2.CloudTasks.GetIamPolicy, cloud.tasks.v2beta2.CloudTasks.SetIamPolicy, cloud.tasks.v2beta3.CloudTasks.GetIamPolicy, cloud.tasks.v2beta3.CloudTasks.SetIamPolicy, devtools.containeranalysis.v1.ContainerAnalysis.GetIamPolicy, devtools.containeranalysis.v1.ContainerAnalysis.SetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.GetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.SetIamPolicy, devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.GetIamPolicy, devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.SetIamPolicy, devtools.sourcerepo.v1.SourceRepo.GetIamPolicy, devtools.sourcerepo.v1.SourceRepo.SetIamPolicy, genomics.v1.DatasetServiceV1.GetIamPolicy, genomics.v1.DatasetServiceV1.SetIamPolicy, admin.v1.IAM.GetIamPolicy, admin.v1.IAM.SetIamPolicy, IAMPolicy.GetIamPolicy, IAMPolicy.SetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.GetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.SetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.GetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.SetIamPolicy

Used as field type in: cloud.asset.v1.Asset, cloud.asset.v1beta1.Asset, cloud.asset.v1p2beta1.Asset, SetIamPolicyRequest

int32 version = 1
Specifies the format of the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Operations affecting conditional bindings must specify version 3. This can be either setting a conditional policy, modifying a conditional binding, or removing a conditional binding from the stored conditional policy. Operations on non-conditional policies may specify any valid value or leave the field unset. If no etag is provided in the call to `setIamPolicy`, any version compliance checks on the incoming and/or stored policy is skipped.
repeated Binding bindings = 4
Associates a list of `members` to a `role`. Optionally may specify a `condition` that determines when binding is in effect. `bindings` with no members will result in an error.
bytes etag = 3
`etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten. Due to blind-set semantics of an etag-less policy, 'setIamPolicy' will not fail even if either of incoming or stored policy does not meet the version requirements.

The difference delta between two policies.

Used in: logging.AuditData

repeated BindingDelta binding_deltas = 1
The delta for Bindings between two policies.
repeated AuditConfigDelta audit_config_deltas = 2
The delta for AuditConfigs between two policies.

Request message for `SetIamPolicy` method.

Used as request type in: bigtable.admin.v2.BigtableInstanceAdmin.SetIamPolicy, bigtable.admin.v2.BigtableTableAdmin.SetIamPolicy, cloud.bigquery.connection.v1beta1.ConnectionService.SetIamPolicy, cloud.datacatalog.v1beta1.DataCatalog.SetIamPolicy, cloud.iot.v1.DeviceManager.SetIamPolicy, cloud.resourcemanager.v2.Folders.SetIamPolicy, cloud.securitycenter.v1.SecurityCenter.SetIamPolicy, cloud.securitycenter.v1beta1.SecurityCenter.SetIamPolicy, cloud.tasks.v2.CloudTasks.SetIamPolicy, cloud.tasks.v2beta2.CloudTasks.SetIamPolicy, cloud.tasks.v2beta3.CloudTasks.SetIamPolicy, devtools.containeranalysis.v1.ContainerAnalysis.SetIamPolicy, devtools.containeranalysis.v1alpha1.ContainerAnalysis.SetIamPolicy, devtools.containeranalysis.v1beta1.ContainerAnalysisV1Beta1.SetIamPolicy, devtools.sourcerepo.v1.SourceRepo.SetIamPolicy, genomics.v1.DatasetServiceV1.SetIamPolicy, admin.v1.IAM.SetIamPolicy, IAMPolicy.SetIamPolicy, spanner.admin.database.v1.DatabaseAdmin.SetIamPolicy, spanner.admin.instance.v1.InstanceAdmin.SetIamPolicy

string resource = 1
REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.
optional Policy policy = 2
REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.

Request message for `TestIamPermissions` method.

string resource = 1
REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.
repeated string permissions = 2
The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Response message for `TestIamPermissions` method.

repeated string permissions = 1
A subset of `TestPermissionsRequest.permissions` that the caller is allowed.

package google.iam.v1

service IAMPolicy

rpc SetIamPolicy (SetIamPolicyRequest, Policy)

rpc GetIamPolicy (GetIamPolicyRequest, Policy)

rpc TestIamPermissions (TestIamPermissionsRequest, TestIamPermissionsResponse)

message AuditConfigDelta

AuditConfigDelta.Action action = 1

string service = 2

string exempted_member = 3

string log_type = 4

enum AuditConfigDelta.Action

ACTION_UNSPECIFIED = 0

ADD = 1

REMOVE = 2

message Binding

string role = 1

repeated string members = 2

optional type.Expr condition = 3

message BindingDelta

BindingDelta.Action action = 1

string role = 2

string member = 3

optional type.Expr condition = 4

enum BindingDelta.Action

ACTION_UNSPECIFIED = 0

ADD = 1

REMOVE = 2

message GetIamPolicyRequest

string resource = 1

optional GetPolicyOptions options = 2

message GetPolicyOptions

int32 requested_policy_version = 1

message Policy

int32 version = 1

repeated Binding bindings = 4

bytes etag = 3

message PolicyDelta

repeated BindingDelta binding_deltas = 1

repeated AuditConfigDelta audit_config_deltas = 2

message SetIamPolicyRequest

string resource = 1

optional Policy policy = 2

message TestIamPermissionsRequest

string resource = 1

repeated string permissions = 2

message TestIamPermissionsResponse

repeated string permissions = 1