Class: Google::Cloud::Asset::V1::IamPolicySearchResult

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/cloud/asset/v1/assets.rb

Overview

A result of IAM Policy search, containing information of an IAM policy.

Defined Under Namespace

Classes: Explanation

Instance Attribute Summary collapse

Instance Attribute Details

#explanation ⇒ ::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation

Returns Explanation about the IAM policy search result. It contains additional information to explain why the search result matches the query.

Returns:



367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
 
# File 'proto_docs/google/cloud/asset/v1/assets.rb', line 367

class IamPolicySearchResult
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Explanation about the IAM policy search result.
  # @!attribute [rw] matched_permissions
  #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions}]
  #     The map from roles to their included permissions that match the
  #     permission query (i.e., a query containing `policy.role.permissions:`).
  #     Example: if query `policy.role.permissions:compute.disk.get`
  #     matches a policy binding that contains owner role, the
  #     matched_permissions will be `{"roles/owner": ["compute.disk.get"]}`. The
  #     roles can also be found in the returned `policy` bindings. Note that the
  #     map is populated only for requests with permission queries.
  class Explanation
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # IAM permissions
    # @!attribute [rw] permissions
    #   @return [::Array<::String>]
    #     A list of permissions. A sample permission string: `compute.disk.get`.
    class Permissions
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # @!attribute [rw] key
    #   @return [::String]
    # @!attribute [rw] value
    #   @return [::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions]
    class MatchedPermissionsEntry
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end
  end
end

#policy ⇒ ::Google::Iam::V1::Policy

Returns The IAM policy directly set on the given resource. Note that the original IAM policy can contain multiple bindings. This only contains the bindings that match the given query. For queries that don't contain a constrain on policies (e.g., an empty query), this contains all the bindings.

To search against the policy bindings:

  • use a field query:
    • query by the policy contained members. Example: policy:[email protected]
    • query by the policy contained roles. Example: policy:roles/compute.admin
    • query by the policy contained roles' included permissions. Example: policy.role.permissions:compute.instances.create.

Returns:

  • (::Google::Iam::V1::Policy) —

    The IAM policy directly set on the given resource. Note that the original IAM policy can contain multiple bindings. This only contains the bindings that match the given query. For queries that don't contain a constrain on policies (e.g., an empty query), this contains all the bindings.

    To search against the policy bindings:

    • use a field query:
      • query by the policy contained members. Example: policy:[email protected]
      • query by the policy contained roles. Example: policy:roles/compute.admin
      • query by the policy contained roles' included permissions. Example: policy.role.permissions:compute.instances.create


367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
 
# File 'proto_docs/google/cloud/asset/v1/assets.rb', line 367

class IamPolicySearchResult
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Explanation about the IAM policy search result.
  # @!attribute [rw] matched_permissions
  #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions}]
  #     The map from roles to their included permissions that match the
  #     permission query (i.e., a query containing `policy.role.permissions:`).
  #     Example: if query `policy.role.permissions:compute.disk.get`
  #     matches a policy binding that contains owner role, the
  #     matched_permissions will be `{"roles/owner": ["compute.disk.get"]}`. The
  #     roles can also be found in the returned `policy` bindings. Note that the
  #     map is populated only for requests with permission queries.
  class Explanation
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # IAM permissions
    # @!attribute [rw] permissions
    #   @return [::Array<::String>]
    #     A list of permissions. A sample permission string: `compute.disk.get`.
    class Permissions
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # @!attribute [rw] key
    #   @return [::String]
    # @!attribute [rw] value
    #   @return [::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions]
    class MatchedPermissionsEntry
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end
  end
end

#project ⇒ ::String

Returns The project that the associated GCP resource belongs to, in the form of projects/{PROJECT_NUMBER}. If an IAM policy is set on a resource (like VM instance, Cloud Storage bucket), the project field will indicate the project that contains the resource. If an IAM policy is set on a folder or orgnization, the project field will be empty.

To search against the project:

  • specify the scope field as this project in your search request.

Returns:

  • (::String) —

    The project that the associated GCP resource belongs to, in the form of projects/{PROJECT_NUMBER}. If an IAM policy is set on a resource (like VM instance, Cloud Storage bucket), the project field will indicate the project that contains the resource. If an IAM policy is set on a folder or orgnization, the project field will be empty.

    To search against the project:

    • specify the scope field as this project in your search request.


367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
 
# File 'proto_docs/google/cloud/asset/v1/assets.rb', line 367

class IamPolicySearchResult
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Explanation about the IAM policy search result.
  # @!attribute [rw] matched_permissions
  #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions}]
  #     The map from roles to their included permissions that match the
  #     permission query (i.e., a query containing `policy.role.permissions:`).
  #     Example: if query `policy.role.permissions:compute.disk.get`
  #     matches a policy binding that contains owner role, the
  #     matched_permissions will be `{"roles/owner": ["compute.disk.get"]}`. The
  #     roles can also be found in the returned `policy` bindings. Note that the
  #     map is populated only for requests with permission queries.
  class Explanation
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # IAM permissions
    # @!attribute [rw] permissions
    #   @return [::Array<::String>]
    #     A list of permissions. A sample permission string: `compute.disk.get`.
    class Permissions
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # @!attribute [rw] key
    #   @return [::String]
    # @!attribute [rw] value
    #   @return [::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions]
    class MatchedPermissionsEntry
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end
  end
end

#resource ⇒ ::String

Returns The full resource name of the resource associated with this IAM policy. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Cloud Asset Inventory Resource Name Format for more information.

To search against the resource:

  • use a field query. Example: resource:organizations/123.

Returns:

  • (::String) —

    The full resource name of the resource associated with this IAM policy. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Cloud Asset Inventory Resource Name Format for more information.

    To search against the resource:

    • use a field query. Example: resource:organizations/123


367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
 
# File 'proto_docs/google/cloud/asset/v1/assets.rb', line 367

class IamPolicySearchResult
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Explanation about the IAM policy search result.
  # @!attribute [rw] matched_permissions
  #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions}]
  #     The map from roles to their included permissions that match the
  #     permission query (i.e., a query containing `policy.role.permissions:`).
  #     Example: if query `policy.role.permissions:compute.disk.get`
  #     matches a policy binding that contains owner role, the
  #     matched_permissions will be `{"roles/owner": ["compute.disk.get"]}`. The
  #     roles can also be found in the returned `policy` bindings. Note that the
  #     map is populated only for requests with permission queries.
  class Explanation
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # IAM permissions
    # @!attribute [rw] permissions
    #   @return [::Array<::String>]
    #     A list of permissions. A sample permission string: `compute.disk.get`.
    class Permissions
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # @!attribute [rw] key
    #   @return [::String]
    # @!attribute [rw] value
    #   @return [::Google::Cloud::Asset::V1::IamPolicySearchResult::Explanation::Permissions]
    class MatchedPermissionsEntry
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end
  end
end