PolicyBinding
(
mapping
=
None
,
*
,
ignore_unknown_fields
=
False
,
**
kwargs
)
IAM policy binding resource.
Attributes
Name
Description
name
str
Identifier. The name of the policy binding, in the format
{binding_parent/locations/{location}/policyBindings/{policy_binding_id}
.
The binding parent is the closest Resource Manager resource
(project, folder, or organization) to the binding target.
Format:
- projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}
- projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}
- folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}
- organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}
uid
str
Output only. The globally unique ID of the policy binding. Assigned when the policy binding is created.
etag
str
Optional. The etag for the policy binding. If this is provided on update, it must match the server's etag.
display_name
str
Optional. The description of the policy binding. Must be less than or equal to 63 characters.
annotations
MutableMapping[str, str]
Optional. User-defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations
target
google.cloud.iam_v3.types.PolicyBinding.Target
Required. Immutable. Target is the full resource name of the resource to which the policy will be bound. Immutable once set.
policy_kind
google.cloud.iam_v3.types.PolicyBinding.PolicyKind
Immutable. The kind of the policy to attach in this binding. This field must be one of the following: - Left empty (will be automatically set to the policy kind) - The input policy kind
policy
str
Required. Immutable. The resource name of the policy to be bound. The binding parent and policy must belong to the same organization.
policy_uid
str
Output only. The globally unique ID of the policy to be bound.
condition
google.type.expr_pb2.Expr
Optional. The condition to apply to the policy binding. When set, the
expression
field in the Expr
must include
from 1 to 10 subexpressions, joined by the "||"(Logical OR),
"&&"(Logical AND) or "!"(Logical NOT) operators and cannot
contain more than 250 characters.
The condition is currently only supported when bound to
policies of kind principal access boundary.
When the bound policy is a principal access boundary policy,
the only supported attributes in any subexpression are principal.type
and principal.subject
. An example
expression is: "principal.type ==
'iam.googleapis.com/ServiceAccount'" or "principal.subject
== 'bob@example.com'".
Allowed operations for principal.subject
:
- principal.subject ==
- principal.subject !=
- principal.subject in [
- principal.subject.startsWith(
- principal.subject.endsWith(
Allowed operations for principal.type
:
- principal.type ==
- principal.type !=
- principal.type in [
Supported principal types are Workspace, Workforce Pool,
Workload Pool and Service Account. Allowed string must be
one of:
- iam.googleapis.com/WorkspaceIdentity
- iam.googleapis.com/WorkforcePoolIdentity
- iam.googleapis.com/WorkloadPoolIdentity
- iam.googleapis.com/ServiceAccountcreate_time
google.protobuf.timestamp_pb2.Timestamp
Output only. The time when the policy binding was created.
update_time
google.protobuf.timestamp_pb2.Timestamp
Output only. The time when the policy binding was most recently updated.
Classes
AnnotationsEntry
AnnotationsEntry
(
mapping
=
None
,
*
,
ignore_unknown_fields
=
False
,
**
kwargs
)
The abstract base class for a message.
Parameters
Name
Description
kwargs
dict
Keys and values corresponding to the fields of the message.
mapping
Union[dict, .Message
]
A dictionary or message to be used to determine the values for this message.
ignore_unknown_fields
Optional(bool)
If True, do not raise errors for unknown fields. Only applied if mapping
is a mapping type or there are keyword parameters.
PolicyKind
PolicyKind
(
value
)
Different policy kinds supported in this binding.
Target
Target
(
mapping
=
None
,
*
,
ignore_unknown_fields
=
False
,
**
kwargs
)
Target is the full resource name of the resource to which the policy will be bound. Immutable once set.
.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
