Class: Google::Cloud::Asset::V1::IamPolicyAnalysisQuery

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/cloud/asset/v1/asset_service.rb

Overview

IAM policy analysis query message.

Defined Under Namespace

Classes: AccessSelector, ConditionContext, IdentitySelector, Options, ResourceSelector

Instance Attribute Summary collapse

Instance Attribute Details

#access_selector ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::AccessSelector

Returns Optional. Specifies roles or permissions for analysis. This is optional.

Returns:



917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 917

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The IAM conditions context.
  # @!attribute [rw] access_time
  #   @return [::Google::Protobuf::Timestamp]
  #     The hypothetical access timestamp to evaluate IAM conditions. Note that
  #     this value must not be earlier than the current time; otherwise, an
  #     INVALID_ARGUMENT error will be returned.
  class ConditionContext
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#condition_context ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::ConditionContext

Returns Optional. The hypothetical context for IAM conditions evaluation.

Returns:



917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 917

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The IAM conditions context.
  # @!attribute [rw] access_time
  #   @return [::Google::Protobuf::Timestamp]
  #     The hypothetical access timestamp to evaluate IAM conditions. Note that
  #     this value must not be earlier than the current time; otherwise, an
  #     INVALID_ARGUMENT error will be returned.
  class ConditionContext
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#identity_selector ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::IdentitySelector

Returns Optional. Specifies an identity for analysis.

Returns:



917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 917

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The IAM conditions context.
  # @!attribute [rw] access_time
  #   @return [::Google::Protobuf::Timestamp]
  #     The hypothetical access timestamp to evaluate IAM conditions. Note that
  #     this value must not be earlier than the current time; otherwise, an
  #     INVALID_ARGUMENT error will be returned.
  class ConditionContext
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#options ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::Options

Returns Optional. The query options.

Returns:



917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 917

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The IAM conditions context.
  # @!attribute [rw] access_time
  #   @return [::Google::Protobuf::Timestamp]
  #     The hypothetical access timestamp to evaluate IAM conditions. Note that
  #     this value must not be earlier than the current time; otherwise, an
  #     INVALID_ARGUMENT error will be returned.
  class ConditionContext
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#resource_selector ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::ResourceSelector

Returns Optional. Specifies a resource for analysis.

Returns:



917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 917

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The IAM conditions context.
  # @!attribute [rw] access_time
  #   @return [::Google::Protobuf::Timestamp]
  #     The hypothetical access timestamp to evaluate IAM conditions. Note that
  #     this value must not be earlier than the current time; otherwise, an
  #     INVALID_ARGUMENT error will be returned.
  class ConditionContext
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#scope ⇒ ::String

Returns Required. The relative name of the root asset. Only resources and IAM policies within the scope will be analyzed.

This can only be an organization number (such as "organizations/123"), a folder number (such as "folders/123"), a project ID (such as "projects/my-project-id"), or a project number (such as "projects/12345").

To know how to get organization id, visit here .

To know how to get folder or project id, visit here .

Returns:

  • (::String) —

    Required. The relative name of the root asset. Only resources and IAM policies within the scope will be analyzed.

    This can only be an organization number (such as "organizations/123"), a folder number (such as "folders/123"), a project ID (such as "projects/my-project-id"), or a project number (such as "projects/12345").

    To know how to get organization id, visit here .

    To know how to get folder or project id, visit here .



917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 917

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The IAM conditions context.
  # @!attribute [rw] access_time
  #   @return [::Google::Protobuf::Timestamp]
  #     The hypothetical access timestamp to evaluate IAM conditions. Note that
  #     this value must not be earlier than the current time; otherwise, an
  #     INVALID_ARGUMENT error will be returned.
  class ConditionContext
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end