Skip to content

Commit afa2ba1

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: AuditConfig for IAM v1
PiperOrigin-RevId: 439356405
1 parent bbe5618 commit afa2ba1

5 files changed

Lines changed: 241 additions & 98 deletions

File tree

‎google/iam/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ proto_library(
1818
"//google/api:client_proto",
1919
"//google/api:field_behavior_proto",
2020
"//google/api:resource_proto",
21+
"@com_google_protobuf//:field_mask_proto",
2122
],
2223
)
2324

‎google/iam/v1/iam_meta_api.yaml‎

Lines changed: 5 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
type: google.api.Service
2-
config_version: 2
2+
config_version: 3
33
name: iam-meta-api.googleapis.com
44
title: IAM Meta API
55

@@ -11,46 +11,6 @@ types:
1111

1212
documentation:
1313
summary: Manages access control for Google Cloud Platform resources.
14-
overview: |-
15-
# Google Identity and Access Management (IAM) API
16-
17-
Documentation of the access control API that will be implemented by all
18-
1st party services provided by the Google Cloud Platform (like Cloud
19-
Storage, Compute Engine, App Engine).
20-
21-
Any implementation of an API that offers access control features
22-
will implement the google.iam.v1.IAMPolicy interface.
23-
24-
## Data model
25-
26-
Access control is applied when a principal (user or service account),
27-
takes some action on a resource exposed by a service. Resources,
28-
identified by
29-
URI-like names, are the unit of access control specification. It is up to
30-
the service implementations to choose what granularity of access control
31-
to support and what set of actions (permissions) to support for the
32-
resources
33-
they provide. For example one database service may allow access control to
34-
be specified only at the Table level, whereas another might allow access
35-
control to also be specified at the Column level.
36-
37-
This is intentionally not a CRUD style API because access control policies
38-
are created and deleted implicitly with the resources to which they are
39-
attached.
40-
41-
## Policy
42-
43-
A `Policy` consists of a list of bindings. A `Binding` binds a set of
44-
members to a role, where the members can include user accounts, user
45-
groups, user
46-
domains, and service accounts. A role is a named set of permissions,
47-
defined by the IAM system. The definition of a role is outside the
48-
policy.
49-
50-
A permission check involves determining the roles that include the
51-
specified permission, and then determining if the principal specified by
52-
the check is a member of a binding to at least one of these roles. The
53-
membership check is recursive when a group is bound to a role.
5414
rules:
5515
- selector: google.iam.v1.IAMPolicy.GetIamPolicy
5616
description: |-
@@ -62,11 +22,14 @@ documentation:
6222
Sets the access control policy on the specified resource. Replaces
6323
any existing policy.
6424
25+
Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED`
26+
errors.
27+
6528
- selector: google.iam.v1.IAMPolicy.TestIamPermissions
6629
description: |-
6730
Returns permissions that a caller has on the specified resource. If the
6831
resource does not exist, this will return an empty set of
69-
permissions, not a NOT_FOUND error.
32+
permissions, not a `NOT_FOUND` error.
7033
7134
Note: This operation is designed to be used for building
7235
permission-aware UIs and command-line tools, not for authorization

‎google/iam/v1/iam_policy.proto‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2019 Google LLC.
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -11,18 +11,18 @@
1111
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
14-
//
1514

1615
syntax = "proto3";
1716

1817
package google.iam.v1;
1918

20-
import "google/iam/v1/options.proto";
21-
import "google/iam/v1/policy.proto";
2219
import "google/api/annotations.proto";
2320
import "google/api/client.proto";
2421
import "google/api/field_behavior.proto";
2522
import "google/api/resource.proto";
23+
import "google/iam/v1/options.proto";
24+
import "google/iam/v1/policy.proto";
25+
import "google/protobuf/field_mask.proto";
2626

2727
option cc_enable_arenas = true;
2828
option csharp_namespace = "Google.Cloud.Iam.V1";
@@ -32,7 +32,8 @@ option java_outer_classname = "IamPolicyProto";
3232
option java_package = "com.google.iam.v1";
3333
option php_namespace = "Google\\Cloud\\Iam\\V1";
3434

35-
// ## API Overview
35+
// API Overview
36+
//
3637
//
3738
// Manages Identity and Access Management (IAM) policies.
3839
//
@@ -62,6 +63,8 @@ service IAMPolicy {
6263

6364
// Sets the access control policy on the specified resource. Replaces any
6465
// existing policy.
66+
//
67+
// Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
6568
rpc SetIamPolicy(SetIamPolicyRequest) returns (Policy) {
6669
option (google.api.http) = {
6770
post: "/v1/{resource=**}:setIamPolicy"
@@ -81,7 +84,7 @@ service IAMPolicy {
8184

8285
// Returns permissions that a caller has on the specified resource.
8386
// If the resource does not exist, this will return an empty set of
84-
// permissions, not a NOT_FOUND error.
87+
// permissions, not a `NOT_FOUND` error.
8588
//
8689
// Note: This operation is designed to be used for building permission-aware
8790
// UIs and command-line tools, not for authorization checking. This operation
@@ -107,6 +110,13 @@ message SetIamPolicyRequest {
107110
// valid policy but certain Cloud Platform services (such as Projects)
108111
// might reject them.
109112
Policy policy = 2 [(google.api.field_behavior) = REQUIRED];
113+
114+
// OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
115+
// the fields in the mask will be modified. If no mask is provided, the
116+
// following default mask is used:
117+
//
118+
// `paths: "bindings, etag"`
119+
google.protobuf.FieldMask update_mask = 3;
110120
}
111121

112122
// Request message for `GetIamPolicy` method.
@@ -118,7 +128,7 @@ message GetIamPolicyRequest {
118128
(google.api.resource_reference).type = "*"];
119129

120130
// OPTIONAL: A `GetPolicyOptions` object for specifying options to
121-
// `GetIamPolicy`. This field is only used by Cloud IAM.
131+
// `GetIamPolicy`.
122132
GetPolicyOptions options = 2;
123133
}
124134

‎google/iam/v1/options.proto‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2019 Google LLC.
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -11,14 +11,11 @@
1111
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
14-
//
1514

1615
syntax = "proto3";
1716

1817
package google.iam.v1;
1918

20-
import "google/api/annotations.proto";
21-
2219
option cc_enable_arenas = true;
2320
option csharp_namespace = "Google.Cloud.Iam.V1";
2421
option go_package = "google.golang.org/genproto/googleapis/iam/v1;iam";
@@ -29,13 +26,23 @@ option php_namespace = "Google\\Cloud\\Iam\\V1";
2926

3027
// Encapsulates settings provided to GetIamPolicy.
3128
message GetPolicyOptions {
32-
// Optional. The policy format version to be returned.
29+
// Optional. The maximum policy version that will be used to format the
30+
// policy.
3331
//
3432
// Valid values are 0, 1, and 3. Requests specifying an invalid value will be
3533
// rejected.
3634
//
37-
// Requests for policies with any conditional bindings must specify version 3.
38-
// Policies without any conditional bindings may specify any valid value or
39-
// leave the field unset.
35+
// Requests for policies with any conditional role bindings must specify
36+
// version 3. Policies with no conditional role bindings may specify any valid
37+
// value or leave the field unset.
38+
//
39+
// The policy in the response might use the policy version that you specified,
40+
// or it might use a lower policy version. For example, if you specify version
41+
// 3, but the policy has no conditional role bindings, the response uses
42+
// version 1.
43+
//
44+
// To learn which resources support conditions in their IAM policies, see the
45+
// [IAM
46+
// documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
4047
int32 requested_policy_version = 1;
4148
}

0 commit comments

Comments
 (0)