Class: Google::Cloud::Asset::V1::IamPolicyAnalysisQuery

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/cloud/asset/v1/asset_service.rb

Overview

IAM policy analysis query message.

Defined Under Namespace

Classes: AccessSelector, IdentitySelector, Options, ResourceSelector

Instance Attribute Summary collapse

Instance Attribute Details

#access_selector ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::AccessSelector

Returns Optional. Specifies roles or permissions for analysis. This is optional.

Returns:



655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 655

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#identity_selector ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::IdentitySelector

Returns Optional. Specifies an identity for analysis.

Returns:



655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 655

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#options ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::Options

Returns Optional. The query options.

Returns:



655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 655

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#resource_selector ⇒ ::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::ResourceSelector

Returns Optional. Specifies a resource for analysis.

Returns:



655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 655

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end

#scope ⇒ ::String

Returns Required. The relative name of the root asset. Only resources and IAM policies within the scope will be analyzed.

This can only be an organization number (such as "organizations/123"), a folder number (such as "folders/123"), a project ID (such as "projects/my-project-id"), or a project number (such as "projects/12345").

To know how to get organization id, visit here .

To know how to get folder or project id, visit here .

Returns:

  • (::String) —

    Required. The relative name of the root asset. Only resources and IAM policies within the scope will be analyzed.

    This can only be an organization number (such as "organizations/123"), a folder number (such as "folders/123"), a project ID (such as "projects/my-project-id"), or a project number (such as "projects/12345").

    To know how to get organization id, visit here .

    To know how to get folder or project id, visit here .



655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
 
# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 655

class IamPolicyAnalysisQuery
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Specifies the resource to analyze for access policies, which may be set
  # directly on the resource, or on ancestors such as organizations, folders or
  # projects.
  # @!attribute [rw] full_resource_name
  #   @return [::String]
  #     Required. The [full resource name]
  #     (https://cloud.google.com/asset-inventory/docs/resource-name-format)
  #     of a resource of [supported resource
  #     types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
  class ResourceSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies an identity for which to determine resource access, based on
  # roles assigned either directly to them or to the groups they belong to,
  # directly or indirectly.
  # @!attribute [rw] identity
  #   @return [::String]
  #     Required. The identity appear in the form of members in
  #     [IAM policy
  #     binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
  #
  #     The examples of supported forms are:
  #     "user:[email protected]",
  #     "group:[email protected]",
  #     "domain:google.com",
  #     "serviceAccount:[email protected]".
  #
  #     Notice that wildcard characters (such as * and ?) are not supported.
  #     You must give a specific identity.
  class IdentitySelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Specifies roles and/or permissions to analyze, to determine both the
  # identities possessing them and the resources they control. If multiple
  # values are specified, results will include roles or permissions matching
  # any of them. The total number of roles and permissions should be equal or
  # less than 10.
  # @!attribute [rw] roles
  #   @return [::Array<::String>]
  #     Optional. The roles to appear in result.
  # @!attribute [rw] permissions
  #   @return [::Array<::String>]
  #     Optional. The permissions to appear in result.
  class AccessSelector
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Contains query options.
  # @!attribute [rw] expand_groups
  #   @return [::Boolean]
  #     Optional. If true, the identities section of the result will expand any
  #     Google groups appearing in an IAM policy binding.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} is specified, the
  #     identity in the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_roles
  #   @return [::Boolean]
  #     Optional. If true, the access section of result will expand any roles
  #     appearing in IAM policy bindings to include their permissions.
  #
  #     If {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} is specified, the access
  #     section of the result will be determined by the selector, and this flag
  #     is not allowed to set.
  #
  #     Default is false.
  # @!attribute [rw] expand_resources
  #   @return [::Boolean]
  #     Optional. If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is not
  #     specified, the resource section of the result will expand any resource
  #     attached to an IAM policy to include resources lower in the resource
  #     hierarchy.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and the results include an IAM policy with P on a GCP
  #     folder, the results will also include resources in that folder with
  #     permission P.
  #
  #     If true and {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} is specified,
  #     the resource section of the result will expand the specified resource to
  #     include resources lower in the resource hierarchy. Only project or
  #     lower resources are supported. Folder and organization resource cannot be
  #     used together with this option.
  #
  #     For example, if the request analyzes for which users have permission P on
  #     a GCP project with this option enabled, the results will include all
  #     users who have permission P on that project or any lower resource.
  #
  #     Default is false.
  # @!attribute [rw] output_resource_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output resource edges, starting
  #     from the policy attached resource, to any expanded resources.
  #     Default is false.
  # @!attribute [rw] output_group_edges
  #   @return [::Boolean]
  #     Optional. If true, the result will output group identity edges, starting
  #     from the binding's group members, to any expanded identities.
  #     Default is false.
  # @!attribute [rw] analyze_service_account_impersonation
  #   @return [::Boolean]
  #     Optional. If true, the response will include access analysis from identities to
  #     resources via service account impersonation. This is a very expensive
  #     operation, because many derived queries will be executed. We highly
  #     recommend you use {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} rpc
  #     instead.
  #
  #     For example, if the request analyzes for which resources user A has
  #     permission P, and there's an IAM policy states user A has
  #     iam.serviceAccounts.getAccessToken permission to a service account SA,
  #     and there's another IAM policy states service account SA has permission P
  #     to a GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Another example, if the request analyzes for who has
  #     permission P to a GCP folder F, and there's an IAM policy states user A
  #     has iam.serviceAccounts.actAs permission to a service account SA, and
  #     there's another IAM policy states service account SA has permission P to
  #     the GCP folder F, then user A potentially has access to the GCP folder
  #     F. And those advanced analysis results will be included in
  #     {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}.
  #
  #     Default is false.
  class Options
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end
end