Resource: AccessPolicy
AccessPolicy
is a container for AccessLevels
(which define the necessary attributes to use Google Cloud services) and ServicePerimeters
(which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization.
| JSON representation |
|---|
{ "name" : string , "parent" : string , "title" : string , "scopes" : [ string ] , "etag" : string } |
name
string
Output only. Identifier. Resource name of the AccessPolicy
. Format: accessPolicies/{access_policy}
parent
string
Required. The parent of this AccessPolicy
in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/{organizationId}
title
string
Required. Human readable title. Does not affect behavior.
scopes[]
string
The scopes of the AccessPolicy
. Scopes define which resources a policy can restrict and where its resources can be referenced. For example, policy A with scopes=["folders/123"]
has the following behavior:
-
ServicePerimetercan only restrict projects withinfolders/123. -
ServicePerimeterwithin policy A can only reference access levels defined within policy A. - Only one policy can include a given scope; thus, attempting to create a second policy which includes
folders/123will result in an error.
If no scopes are provided, then any resource within the organization can be restricted. Scopes cannot be modified after a policy is created. Policies can only have a single scope. Format: list of folders/{folder_number}
or projects/{projectNumber}
etag
string
Output only. An opaque identifier for the current version of the AccessPolicy
. This will always be a strongly validated etag, meaning that two Access Policies will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format.
Methods |
|
|---|---|
|
Creates an access policy. |
|
Deletes an access policy
based on the resource name. |
|
Returns an access policy
based on the name. |
|
Gets the IAM policy for the specified Access Context Manager access policy
. |
|
Lists all access policies
in an organization. |
|
Updates an access policy
. |
|
Sets the IAM policy for the specified Access Context Manager access policy
. |
|
Returns the IAM permissions that the caller has on the specified Access Context Manager resource. |
