Package cloud.google.com/go/iam/apiv1/iampb (v1.2.1)

var (
	AuditLogConfig_LogType_name = map[int32]string{
		0: "LOG_TYPE_UNSPECIFIED",
		1: "ADMIN_READ",
		2: "DATA_WRITE",
		3: "DATA_READ",
	}
	AuditLogConfig_LogType_value = map[string]int32{
		"LOG_TYPE_UNSPECIFIED": 0,
		"ADMIN_READ":           1,
		"DATA_WRITE":           2,
		"DATA_READ":            3,
	}
)

var (
	BindingDelta_Action_name = map[int32]string{
		0: "ACTION_UNSPECIFIED",
		1: "ADD",
		2: "REMOVE",
	}
	BindingDelta_Action_value = map[string]int32{
		"ACTION_UNSPECIFIED": 0,
		"ADD":                1,
		"REMOVE":             2,
	}
)

var (
	AuditConfigDelta_Action_name = map[int32]string{
		0: "ACTION_UNSPECIFIED",
		1: "ADD",
		2: "REMOVE",
	}
	AuditConfigDelta_Action_value = map[string]int32{
		"ACTION_UNSPECIFIED": 0,
		"ADD":                1,
		"REMOVE":             2,
	}
)

var File_google_iam_v1_iam_policy_proto protoreflect.FileDescriptor

var File_google_iam_v1_options_proto protoreflect.FileDescriptor

var File_google_iam_v1_policy_proto protoreflect.FileDescriptor

func RegisterIAMPolicyServer(s *grpc.Server, srv IAMPolicyServer)

type AuditConfig struct {

	// Specifies a service that will be enabled for audit logging.
	// For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
	// `allServices` is a special value that covers all services.
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// The configuration for logging of each type of permission.
	AuditLogConfigs []*AuditLogConfig `protobuf:"bytes,3,rep,name=audit_log_configs,json=auditLogConfigs,proto3" json:"audit_log_configs,omitempty"`
	// contains filtered or unexported fields
}

func (*AuditConfig) Descriptor() ([]byte, []int)

func (x *AuditConfig) GetAuditLogConfigs() []*AuditLogConfig

func (x *AuditConfig) GetService() string

func (*AuditConfig) ProtoMessage()

func (x *AuditConfig) ProtoReflect() protoreflect.Message

func (x *AuditConfig) Reset()

func (x *AuditConfig) String() string

type AuditConfigDelta struct {

	// The action that was performed on an audit configuration in a policy.
	// Required
	Action AuditConfigDelta_Action `protobuf:"varint,1,opt,name=action,proto3,enum=google.iam.v1.AuditConfigDelta_Action" json:"action,omitempty"`
	// Specifies a service that was configured for Cloud Audit Logging.
	// For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
	// `allServices` is a special value that covers all services.
	// Required
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// A single identity that is exempted from "data access" audit
	// logging for the `service` specified above.
	// Follows the same format of Binding.members.
	ExemptedMember string `protobuf:"bytes,3,opt,name=exempted_member,json=exemptedMember,proto3" json:"exempted_member,omitempty"`
	// Specifies the log_type that was be enabled. ADMIN_ACTIVITY is always
	// enabled, and cannot be configured.
	// Required
	LogType string `protobuf:"bytes,4,opt,name=log_type,json=logType,proto3" json:"log_type,omitempty"`
	// contains filtered or unexported fields
}

func (*AuditConfigDelta) Descriptor() ([]byte, []int)

func (x *AuditConfigDelta) GetAction() AuditConfigDelta_Action

func (x *AuditConfigDelta) GetExemptedMember() string

func (x *AuditConfigDelta) GetLogType() string

func (x *AuditConfigDelta) GetService() string

func (*AuditConfigDelta) ProtoMessage()

func (x *AuditConfigDelta) ProtoReflect() protoreflect.Message

func (x *AuditConfigDelta) Reset()

func (x *AuditConfigDelta) String() string

type AuditConfigDelta_Action int32

const (
	// Unspecified.
	AuditConfigDelta_ACTION_UNSPECIFIED AuditConfigDelta_Action = 0
	// Addition of an audit configuration.
	AuditConfigDelta_ADD AuditConfigDelta_Action = 1
	// Removal of an audit configuration.
	AuditConfigDelta_REMOVE AuditConfigDelta_Action = 2
)

func (AuditConfigDelta_Action) Descriptor() protoreflect.EnumDescriptor

func (x AuditConfigDelta_Action) Enum() *AuditConfigDelta_Action

func (AuditConfigDelta_Action) EnumDescriptor() ([]byte, []int)

func (x AuditConfigDelta_Action) Number() protoreflect.EnumNumber

func (x AuditConfigDelta_Action) String() string

func (AuditConfigDelta_Action) Type() protoreflect.EnumType

type AuditLogConfig struct {

	// The log type that this config enables.
	LogType AuditLogConfig_LogType `protobuf:"varint,1,opt,name=log_type,json=logType,proto3,enum=google.iam.v1.AuditLogConfig_LogType" json:"log_type,omitempty"`
	// Specifies the identities that do not cause logging for this type of
	// permission.
	// Follows the same format of
	// [Binding.members][google.iam.v1.Binding.members].
	ExemptedMembers []string `protobuf:"bytes,2,rep,name=exempted_members,json=exemptedMembers,proto3" json:"exempted_members,omitempty"`
	// contains filtered or unexported fields
}

func (*AuditLogConfig) Descriptor() ([]byte, []int)

func (x *AuditLogConfig) GetExemptedMembers() []string

func (x *AuditLogConfig) GetLogType() AuditLogConfig_LogType

func (*AuditLogConfig) ProtoMessage()

func (x *AuditLogConfig) ProtoReflect() protoreflect.Message

func (x *AuditLogConfig) Reset()

func (x *AuditLogConfig) String() string

type AuditLogConfig_LogType int32

const (
	// Default case. Should never be this.
	AuditLogConfig_LOG_TYPE_UNSPECIFIED AuditLogConfig_LogType = 0
	// Admin reads. Example: CloudIAM getIamPolicy
	AuditLogConfig_ADMIN_READ AuditLogConfig_LogType = 1
	// Data writes. Example: CloudSQL Users create
	AuditLogConfig_DATA_WRITE AuditLogConfig_LogType = 2
	// Data reads. Example: CloudSQL Users list
	AuditLogConfig_DATA_READ AuditLogConfig_LogType = 3
)

func (AuditLogConfig_LogType) Descriptor() protoreflect.EnumDescriptor

func (x AuditLogConfig_LogType) Enum() *AuditLogConfig_LogType

func (AuditLogConfig_LogType) EnumDescriptor() ([]byte, []int)

func (x AuditLogConfig_LogType) Number() protoreflect.EnumNumber

func (x AuditLogConfig_LogType) String() string

func (AuditLogConfig_LogType) Type() protoreflect.EnumType

type Binding struct {

	// Role that is assigned to the list of `members`, or principals.
	// For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	// Specifies the principals requesting access for a Google Cloud resource.
	// `members` can have the following values:
	//
	//   - `allUsers`: A special identifier that represents anyone who is
	//     on the internet; with or without a Google account.
	//
	//   - `allAuthenticatedUsers`: A special identifier that represents anyone
	//     who is authenticated with a Google account or a service account.
	//
	//   - `user:{emailid}`: An email address that represents a specific Google
	//     account. For example, `alice@example.com` .
	//
	//   - `serviceAccount:{emailid}`: An email address that represents a service
	//     account. For example, `my-other-app@appspot.gserviceaccount.com`.
	//
	//   - `group:{emailid}`: An email address that represents a Google group.
	//     For example, `admins@example.com`.
	//
	//   - `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
	//     identifier) representing a user that has been recently deleted. For
	//     example, `alice@example.com?uid=123456789012345678901`. If the user is
	//     recovered, this value reverts to `user:{emailid}` and the recovered user
	//     retains the role in the binding.
	//
	//   - `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
	//     unique identifier) representing a service account that has been recently
	//     deleted. For example,
	//     `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
	//     If the service account is undeleted, this value reverts to
	//     `serviceAccount:{emailid}` and the undeleted service account retains the
	//     role in the binding.
	//
	//   - `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
	//     identifier) representing a Google group that has been recently
	//     deleted. For example, `admins@example.com?uid=123456789012345678901`. If
	//     the group is recovered, this value reverts to `group:{emailid}` and the
	//     recovered group retains the role in the binding.
	//
	//   - `domain:{domain}`: The G Suite domain (primary) that represents all the
	//     users of that domain. For example, `google.com` or `example.com`.
	Members []string `protobuf:"bytes,2,rep,name=members,proto3" json:"members,omitempty"`
	// The condition that is associated with this binding.
	//
	// If the condition evaluates to `true`, then this binding applies to the
	// current request.
	//
	// If the condition evaluates to `false`, then this binding does not apply to
	// the current request. However, a different role binding might grant the same
	// role to one or more of the principals in this binding.
	//
	// To learn which resources support conditions in their IAM policies, see the
	// [IAM
	// documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
	Condition *expr.Expr `protobuf:"bytes,3,opt,name=condition,proto3" json:"condition,omitempty"`
	// contains filtered or unexported fields
}

func (*Binding) Descriptor() ([]byte, []int)

func (x *Binding) GetCondition() *expr.Expr

func (x *Binding) GetMembers() []string

func (x *Binding) GetRole() string

func (*Binding) ProtoMessage()

func (x *Binding) ProtoReflect() protoreflect.Message

func (x *Binding) Reset()

func (x *Binding) String() string

type BindingDelta struct {

	// The action that was performed on a Binding.
	// Required
	Action BindingDelta_Action `protobuf:"varint,1,opt,name=action,proto3,enum=google.iam.v1.BindingDelta_Action" json:"action,omitempty"`
	// Role that is assigned to `members`.
	// For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
	// Required
	Role string `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
	// A single identity requesting access for a Google Cloud resource.
	// Follows the same format of Binding.members.
	// Required
	Member string `protobuf:"bytes,3,opt,name=member,proto3" json:"member,omitempty"`
	// The condition that is associated with this binding.
	Condition *expr.Expr `protobuf:"bytes,4,opt,name=condition,proto3" json:"condition,omitempty"`
	// contains filtered or unexported fields
}

func (*BindingDelta) Descriptor() ([]byte, []int)

func (x *BindingDelta) GetAction() BindingDelta_Action

func (x *BindingDelta) GetCondition() *expr.Expr

func (x *BindingDelta) GetMember() string

func (x *BindingDelta) GetRole() string

func (*BindingDelta) ProtoMessage()

func (x *BindingDelta) ProtoReflect() protoreflect.Message

func (x *BindingDelta) Reset()

func (x *BindingDelta) String() string

type BindingDelta_Action int32

const (
	// Unspecified.
	BindingDelta_ACTION_UNSPECIFIED BindingDelta_Action = 0
	// Addition of a Binding.
	BindingDelta_ADD BindingDelta_Action = 1
	// Removal of a Binding.
	BindingDelta_REMOVE BindingDelta_Action = 2
)

func (BindingDelta_Action) Descriptor() protoreflect.EnumDescriptor

func (x BindingDelta_Action) Enum() *BindingDelta_Action

func (BindingDelta_Action) EnumDescriptor() ([]byte, []int)

func (x BindingDelta_Action) Number() protoreflect.EnumNumber

func (x BindingDelta_Action) String() string

func (BindingDelta_Action) Type() protoreflect.EnumType

type GetIamPolicyRequest struct {

	// REQUIRED: The resource for which the policy is being requested.
	// See the operation documentation for the appropriate value for this field.
	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// OPTIONAL: A `GetPolicyOptions` object for specifying options to
	// `GetIamPolicy`.
	Options *GetPolicyOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

func (*GetIamPolicyRequest) Descriptor() ([]byte, []int)

func (x *GetIamPolicyRequest) GetOptions() *GetPolicyOptions

func (x *GetIamPolicyRequest) GetResource() string

func (*GetIamPolicyRequest) ProtoMessage()

func (x *GetIamPolicyRequest) ProtoReflect() protoreflect.Message

func (x *GetIamPolicyRequest) Reset()

func (x *GetIamPolicyRequest) String() string

type GetPolicyOptions struct {
	RequestedPolicyVersion int32 "" /* 130 byte string literal not displayed */

}

func (*GetPolicyOptions) Descriptor() ([]byte, []int)

func (x *GetPolicyOptions) GetRequestedPolicyVersion() int32

func (*GetPolicyOptions) ProtoMessage()

func (x *GetPolicyOptions) ProtoReflect() protoreflect.Message

func (x *GetPolicyOptions) Reset()

func (x *GetPolicyOptions) String() string

type IAMPolicyClient interface {
	// Sets the access control policy on the specified resource. Replaces any
	// existing policy.
	//
	// Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
	SetIamPolicy(ctx context.Context, in *SetIamPolicyRequest, opts ...grpc.CallOption) (*Policy, error)
	// Gets the access control policy for a resource.
	// Returns an empty policy if the resource exists and does not have a policy
	// set.
	GetIamPolicy(ctx context.Context, in *GetIamPolicyRequest, opts ...grpc.CallOption) (*Policy, error)
	// Returns permissions that a caller has on the specified resource.
	// If the resource does not exist, this will return an empty set of
	// permissions, not a `NOT_FOUND` error.
	//
	// Note: This operation is designed to be used for building permission-aware
	// UIs and command-line tools, not for authorization checking. This operation
	// may "fail open" without warning.
	TestIamPermissions(ctx context.Context, in *TestIamPermissionsRequest, opts ...grpc.CallOption) (*TestIamPermissionsResponse, error)
}

func NewIAMPolicyClient(cc grpc.ClientConnInterface) IAMPolicyClient

type IAMPolicyServer interface {
	// Sets the access control policy on the specified resource. Replaces any
	// existing policy.
	//
	// Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
	SetIamPolicy(context.Context, *SetIamPolicyRequest) (*Policy, error)
	// Gets the access control policy for a resource.
	// Returns an empty policy if the resource exists and does not have a policy
	// set.
	GetIamPolicy(context.Context, *GetIamPolicyRequest) (*Policy, error)
	// Returns permissions that a caller has on the specified resource.
	// If the resource does not exist, this will return an empty set of
	// permissions, not a `NOT_FOUND` error.
	//
	// Note: This operation is designed to be used for building permission-aware
	// UIs and command-line tools, not for authorization checking. This operation
	// may "fail open" without warning.
	TestIamPermissions(context.Context, *TestIamPermissionsRequest) (*TestIamPermissionsResponse, error)
}

type Policy struct {

	// Specifies the format of the policy.
	//
	// Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
	// are rejected.
	//
	// Any operation that affects conditional role bindings must specify version
	// `3`. This requirement applies to the following operations:
	//
	//   - Getting a policy that includes a conditional role binding
	//   - Adding a conditional role binding to a policy
	//   - Changing a conditional role binding in a policy
	//   - Removing any role binding, with or without a condition, from a policy
	//     that includes conditions
	//
	// **Important:** If you use IAM Conditions, you must include the `etag` field
	// whenever you call `setIamPolicy`. If you omit this field, then IAM allows
	// you to overwrite a version `3` policy with a version `1` policy, and all of
	// the conditions in the version `3` policy are lost.
	//
	// If a policy does not include any conditions, operations on that policy may
	// specify any valid version or leave the field unset.
	//
	// To learn which resources support conditions in their IAM policies, see the
	// [IAM
	// documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// Associates a list of `members`, or principals, with a `role`. Optionally,
	// may specify a `condition` that determines how and when the `bindings` are
	// applied. Each of the `bindings` must contain at least one principal.
	//
	// The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
	// of these principals can be Google groups. Each occurrence of a principal
	// counts towards these limits. For example, if the `bindings` grant 50
	// different roles to `user:alice@example.com`, and not to any other
	// principal, then you can add another 1,450 principals to the `bindings` in
	// the `Policy`.
	Bindings []*Binding `protobuf:"bytes,4,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// Specifies cloud audit logging configuration for this policy.
	AuditConfigs []*AuditConfig `protobuf:"bytes,6,rep,name=audit_configs,json=auditConfigs,proto3" json:"audit_configs,omitempty"`
	// `etag` is used for optimistic concurrency control as a way to help
	// prevent simultaneous updates of a policy from overwriting each other.
	// It is strongly suggested that systems make use of the `etag` in the
	// read-modify-write cycle to perform policy updates in order to avoid race
	// conditions: An `etag` is returned in the response to `getIamPolicy`, and
	// systems are expected to put that etag in the request to `setIamPolicy` to
	// ensure that their change will be applied to the same version of the policy.
	//
	// **Important:** If you use IAM Conditions, you must include the `etag` field
	// whenever you call `setIamPolicy`. If you omit this field, then IAM allows
	// you to overwrite a version `3` policy with a version `1` policy, and all of
	// the conditions in the version `3` policy are lost.
	Etag []byte `protobuf:"bytes,3,opt,name=etag,proto3" json:"etag,omitempty"`
	// contains filtered or unexported fields
}

func (*Policy) Descriptor() ([]byte, []int)

func (x *Policy) GetAuditConfigs() []*AuditConfig

func (x *Policy) GetBindings() []*Binding

func (x *Policy) GetEtag() []byte

func (x *Policy) GetVersion() int32

func (*Policy) ProtoMessage()

func (x *Policy) ProtoReflect() protoreflect.Message

func (x *Policy) Reset()

func (x *Policy) String() string

type PolicyDelta struct {

	// The delta for Bindings between two policies.
	BindingDeltas []*BindingDelta `protobuf:"bytes,1,rep,name=binding_deltas,json=bindingDeltas,proto3" json:"binding_deltas,omitempty"`
	// The delta for AuditConfigs between two policies.
	AuditConfigDeltas []*AuditConfigDelta `protobuf:"bytes,2,rep,name=audit_config_deltas,json=auditConfigDeltas,proto3" json:"audit_config_deltas,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyDelta) Descriptor() ([]byte, []int)

func (x *PolicyDelta) GetAuditConfigDeltas() []*AuditConfigDelta

func (x *PolicyDelta) GetBindingDeltas() []*BindingDelta

func (*PolicyDelta) ProtoMessage()

func (x *PolicyDelta) ProtoReflect() protoreflect.Message

func (x *PolicyDelta) Reset()

func (x *PolicyDelta) String() string

type SetIamPolicyRequest struct {

	// REQUIRED: The resource for which the policy is being specified.
	// See the operation documentation for the appropriate value for this field.
	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// REQUIRED: The complete policy to be applied to the `resource`. The size of
	// the policy is limited to a few 10s of KB. An empty policy is a
	// valid policy but certain Cloud Platform services (such as Projects)
	// might reject them.
	Policy *Policy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
	// OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
	// the fields in the mask will be modified. If no mask is provided, the
	// following default mask is used:
	//
	// `paths: "bindings, etag"`
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

func (*SetIamPolicyRequest) Descriptor() ([]byte, []int)

func (x *SetIamPolicyRequest) GetPolicy() *Policy

func (x *SetIamPolicyRequest) GetResource() string

func (x *SetIamPolicyRequest) GetUpdateMask() *fieldmaskpb.FieldMask

func (*SetIamPolicyRequest) ProtoMessage()

func (x *SetIamPolicyRequest) ProtoReflect() protoreflect.Message

func (x *SetIamPolicyRequest) Reset()

func (x *SetIamPolicyRequest) String() string

type TestIamPermissionsRequest struct {

	// REQUIRED: The resource for which the policy detail is being requested.
	// See the operation documentation for the appropriate value for this field.
	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// The set of permissions to check for the `resource`. Permissions with
	// wildcards (such as '*' or 'storage.*') are not allowed. For more
	// information see
	// [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
	Permissions []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

func (*TestIamPermissionsRequest) Descriptor() ([]byte, []int)

func (x *TestIamPermissionsRequest) GetPermissions() []string

func (x *TestIamPermissionsRequest) GetResource() string

func (*TestIamPermissionsRequest) ProtoMessage()

func (x *TestIamPermissionsRequest) ProtoReflect() protoreflect.Message

func (x *TestIamPermissionsRequest) Reset()

func (x *TestIamPermissionsRequest) String() string

type TestIamPermissionsResponse struct {

	// A subset of `TestPermissionsRequest.permissions` that the caller is
	// allowed.
	Permissions []string `protobuf:"bytes,1,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

func (*TestIamPermissionsResponse) Descriptor() ([]byte, []int)

func (x *TestIamPermissionsResponse) GetPermissions() []string

func (*TestIamPermissionsResponse) ProtoMessage()

func (x *TestIamPermissionsResponse) ProtoReflect() protoreflect.Message

func (x *TestIamPermissionsResponse) Reset()

func (x *TestIamPermissionsResponse) String() string

type UnimplementedIAMPolicyServer struct {
}

func (*UnimplementedIAMPolicyServer) GetIamPolicy(context.Context, *GetIamPolicyRequest) (*Policy, error)

func (*UnimplementedIAMPolicyServer) SetIamPolicy(context.Context, *SetIamPolicyRequest) (*Policy, error)

func (*UnimplementedIAMPolicyServer) TestIamPermissions(context.Context, *TestIamPermissionsRequest) (*TestIamPermissionsResponse, error)