Skip to content

Commit f44ac0d

Browse files
lesvlesv
authored
Merge pull request #2008 from frankyn/storage-iam-snippets
[Storage] Bucket-level IAM Samples
2 parents 4a614b8 + 00555f3 commit f44ac0d

2 files changed

Lines changed: 146 additions & 0 deletions

File tree

‎google-cloud-examples/src/main/java/com/google/cloud/examples/storage/snippets/BucketIamSnippets.java‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
/*
2+
* Copyright 2017 Google Inc. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package com.google.cloud.examples.storage.snippets;
18+
19+
import com.google.cloud.Identity;
20+
import com.google.cloud.Policy;
21+
import com.google.cloud.Role;
22+
import com.google.cloud.storage.Storage;
23+
import com.google.cloud.storage.StorageOptions;
24+
25+
import java.util.Map;
26+
import java.util.Set;
27+
28+
/**
29+
* This class contains Bucket-level IAM snippets for the {@link Storage} interface.
30+
*/
31+
public class BucketIamSnippets {
32+
33+
/**
34+
* Example of listing the Bucket-Level IAM Roles and Members
35+
*/
36+
public Policy listBucketIamMembers(String bucketName) {
37+
// [START view_bucket_iam_members]
38+
// Initialize a Cloud Storage client
39+
Storage storage = StorageOptions.getDefaultInstance().getService();
40+
41+
// Get IAM Policy for a bucket
42+
Policy policy = storage.getIamPolicy(bucketName);
43+
44+
// Print Roles and its identities
45+
Map<Role, Set<Identity>> policyBindings = policy.getBindings();
46+
for(Map.Entry<Role, Set<Identity>> entry : policyBindings.entrySet()) {
47+
System.out.printf("Role: %s Identities: %s\n", entry.getKey(), entry.getValue());
48+
}
49+
// [END view_bucket_iam_members]
50+
return policy;
51+
}
52+
53+
/**
54+
* Example of adding a member to the Bucket-level IAM
55+
*/
56+
public Policy addBucketIamMember(String bucketName, Role role, Identity identity) {
57+
// [START add_bucket_iam_member]
58+
// Initialize a Cloud Storage client
59+
Storage storage = StorageOptions.getDefaultInstance().getService();
60+
61+
// Get IAM Policy for a bucket
62+
Policy policy = storage.getIamPolicy(bucketName);
63+
64+
// Add identity to Bucket-level IAM role
65+
Policy updatedPolicy = storage.setIamPolicy(bucketName,
66+
policy.toBuilder().addIdentity(role, identity).build());
67+
68+
if (updatedPolicy.getBindings().get(role).contains(identity)) {
69+
System.out.printf("Added %s with role %s to %s\n", identity, role, bucketName);
70+
}
71+
// [END add_bucket_iam_member]
72+
return updatedPolicy;
73+
}
74+
75+
/**
76+
* Example of removing a member from the Bucket-level IAM
77+
*/
78+
public Policy removeBucketIamMember(String bucketName, Role role, Identity identity) {
79+
// [START remove_bucket_iam_member]
80+
// Initialize a Cloud Storage client
81+
Storage storage = StorageOptions.getDefaultInstance().getService();
82+
83+
// Get IAM Policy for a bucket
84+
Policy policy = storage.getIamPolicy(bucketName);
85+
86+
// Remove an identity from a Bucket-level IAM role
87+
Policy updatedPolicy = storage.setIamPolicy(bucketName,
88+
policy.toBuilder().removeIdentity(role, identity).build());
89+
90+
if (updatedPolicy.getBindings().get(role) == null ||
91+
!updatedPolicy.getBindings().get(role).contains(identity)) {
92+
System.out.printf("Removed %s with role %s from %s\n", identity, role, bucketName);
93+
}
94+
// [END remove_bucket_iam_member]
95+
return updatedPolicy;
96+
}
97+
}

‎google-cloud-examples/src/test/java/com/google/cloud/examples/storage/snippets/ITBucketSnippets.java‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,16 @@
2121
import static org.junit.Assert.assertNull;
2222
import static org.junit.Assert.assertTrue;
2323

24+
import com.google.cloud.Identity;
25+
import com.google.cloud.Policy;
2426
import com.google.cloud.storage.Acl;
2527
import com.google.cloud.storage.Acl.Role;
2628
import com.google.cloud.storage.Blob;
2729
import com.google.cloud.storage.Bucket;
2830
import com.google.cloud.storage.BucketInfo;
2931
import com.google.cloud.storage.Storage;
3032
import com.google.cloud.storage.StorageException;
33+
import com.google.cloud.storage.StorageRoles;
3134
import com.google.cloud.storage.testing.RemoteStorageHelper;
3235
import com.google.common.collect.Sets;
3336

@@ -49,13 +52,15 @@ public class ITBucketSnippets {
4952

5053
private static final Logger log = Logger.getLogger(ITBucketSnippets.class.getName());
5154
private static final String BUCKET = RemoteStorageHelper.generateBucketName();
55+
private static final String USER_EMAIL = "[email protected]";
5256
private static final String BLOB1 = "blob1";
5357
private static final String BLOB2 = "blob2";
5458
private static final String BLOB3 = "blob3";
5559
private static final String BLOB4 = "blob4";
5660

5761
private static Storage storage;
5862
private static BucketSnippets bucketSnippets;
63+
private static BucketIamSnippets bucketIamSnippets;
5964

6065
@Rule
6166
public ExpectedException thrown = ExpectedException.none();
@@ -68,6 +73,7 @@ public static void beforeClass() {
6873
RemoteStorageHelper helper = RemoteStorageHelper.create();
6974
storage = helper.getOptions().getService();
7075
bucketSnippets = new BucketSnippets(storage.create(BucketInfo.of(BUCKET)));
76+
bucketIamSnippets = new BucketIamSnippets();
7177
}
7278

7379
@AfterClass
@@ -133,4 +139,47 @@ public void testBucket() throws InterruptedException {
133139
thrown.expect(StorageException.class);
134140
assertTrue(bucketSnippets.delete());
135141
}
142+
143+
@Test
144+
public void testListBucketIamMembers() {
145+
// Test an added Bucket-level IAM member is listed
146+
Policy policy = storage.getIamPolicy(BUCKET);
147+
policy = storage.setIamPolicy(BUCKET,
148+
policy.toBuilder().removeRole(StorageRoles.admin()).build());
149+
assertNull(policy.getBindings().get(StorageRoles.admin()));
150+
policy = storage.setIamPolicy(BUCKET, policy.toBuilder().addIdentity(StorageRoles.admin(),
151+
Identity.user(USER_EMAIL)).build());
152+
assertTrue(policy.getBindings().get(StorageRoles.admin()).contains(Identity.user(USER_EMAIL)));
153+
Policy snippetPolicy = bucketIamSnippets.listBucketIamMembers(BUCKET);
154+
assertTrue(snippetPolicy.getBindings().get(StorageRoles.admin()).
155+
contains(Identity.user(USER_EMAIL)));
156+
}
157+
158+
@Test
159+
public void testAddBucketIamMemeber() {
160+
// Test a member is added to Bucket-level IAM
161+
Policy policy = storage.getIamPolicy(BUCKET);
162+
policy = storage.setIamPolicy(BUCKET,
163+
policy.toBuilder().removeRole(StorageRoles.admin()).build());
164+
assertNull(policy.getBindings().get(StorageRoles.admin()));
165+
Policy snippetPolicy = bucketIamSnippets.addBucketIamMember(BUCKET, StorageRoles.admin(),
166+
Identity.user(USER_EMAIL));
167+
assertTrue(snippetPolicy.getBindings().get(StorageRoles.admin()).
168+
contains(Identity.user(USER_EMAIL)));
169+
}
170+
171+
@Test
172+
public void testRemoveBucketIamMember() {
173+
// Test a member is removed from Bucket-level IAM
174+
Policy policy = storage.getIamPolicy(BUCKET);
175+
policy = storage.setIamPolicy(BUCKET,
176+
policy.toBuilder().removeRole(StorageRoles.admin()).build());
177+
assertNull(policy.getBindings().get(StorageRoles.admin()));
178+
policy = storage.setIamPolicy(BUCKET, policy.toBuilder().addIdentity(StorageRoles.admin(),
179+
Identity.user(USER_EMAIL)).build());
180+
assertTrue(policy.getBindings().get(StorageRoles.admin()).contains(Identity.user(USER_EMAIL)));
181+
Policy snippetPolicy = bucketIamSnippets.removeBucketIamMember(BUCKET, StorageRoles.admin(),
182+
Identity.user(USER_EMAIL));
183+
assertNull(snippetPolicy.getBindings().get(StorageRoles.admin()));
184+
}
136185
}

0 commit comments

Comments
 (0)