Google Cloud Native is in preview. Google Cloud Classic is fully supported.
google-native.apigateway/v1.getApiIamPolicy
Explore with Pulumi AI
Google Cloud Native is in preview. Google Cloud Classic is fully supported.
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.
Using getApiIamPolicy
Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.
function getApiIamPolicy(args: GetApiIamPolicyArgs, opts?: InvokeOptions): Promise<GetApiIamPolicyResult>
function getApiIamPolicyOutput(args: GetApiIamPolicyOutputArgs, opts?: InvokeOptions): Output<GetApiIamPolicyResult>
def get_api_iam_policy(api_id: Optional[str] = None,
location: Optional[str] = None,
options_requested_policy_version: Optional[int] = None,
project: Optional[str] = None,
opts: Optional[InvokeOptions] = None) -> GetApiIamPolicyResult
def get_api_iam_policy_output(api_id: Optional[pulumi.Input[str]] = None,
location: Optional[pulumi.Input[str]] = None,
options_requested_policy_version: Optional[pulumi.Input[int]] = None,
project: Optional[pulumi.Input[str]] = None,
opts: Optional[InvokeOptions] = None) -> Output[GetApiIamPolicyResult]
func LookupApiIamPolicy(ctx *Context, args *LookupApiIamPolicyArgs, opts ...InvokeOption) (*LookupApiIamPolicyResult, error)
func LookupApiIamPolicyOutput(ctx *Context, args *LookupApiIamPolicyOutputArgs, opts ...InvokeOption) LookupApiIamPolicyResultOutput
> Note: This function is named LookupApiIamPolicy
in the Go SDK.
public static class GetApiIamPolicy
{
public static Task<GetApiIamPolicyResult> InvokeAsync(GetApiIamPolicyArgs args, InvokeOptions? opts = null)
public static Output<GetApiIamPolicyResult> Invoke(GetApiIamPolicyInvokeArgs args, InvokeOptions? opts = null)
}
public static CompletableFuture<GetApiIamPolicyResult> getApiIamPolicy(GetApiIamPolicyArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet
fn::invoke:
function: google-native:apigateway/v1:getApiIamPolicy
arguments:
# arguments dictionary
The following arguments are supported:
- Api
Id string - Location string
- Options
Requested intPolicy Version - Project string
- Api
Id string - Location string
- Options
Requested intPolicy Version - Project string
- api
Id String - location String
- options
Requested IntegerPolicy Version - project String
- api
Id string - location string
- options
Requested numberPolicy Version - project string
- api_
id str - location str
- options_
requested_ intpolicy_ version - project str
- api
Id String - location String
- options
Requested NumberPolicy Version - project String
getApiIamPolicy Result
The following output properties are available:
- Audit
Configs List<Pulumi.Google Native. APIGateway. V1. Outputs. Apigateway Audit Config Response> - Specifies cloud audit logging configuration for this policy.
- Bindings
List<Pulumi.
Google Native. APIGateway. V1. Outputs. Apigateway Binding Response> - Associates a list of
members
, or principals, with arole
. Optionally, may specify acondition
that determines how and when thebindings
are applied. Each of thebindings
must contain at least one principal. Thebindings
in aPolicy
can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if thebindings
grant 50 different roles touser:alice@example.com
, and not to any other principal, then you can add another 1,450 principals to thebindings
in thePolicy
. - Etag string
etag
is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of theetag
in the read-modify-write cycle to perform policy updates in order to avoid race conditions: Anetag
is returned in the response togetIamPolicy
, and systems are expected to put that etag in the request tosetIamPolicy
to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost.- Version int
- Specifies the format of the policy. Valid values are
0
,1
, and3
. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version3
. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.
- Audit
Configs []ApigatewayAudit Config Response - Specifies cloud audit logging configuration for this policy.
- Bindings
[]Apigateway
Binding Response - Associates a list of
members
, or principals, with arole
. Optionally, may specify acondition
that determines how and when thebindings
are applied. Each of thebindings
must contain at least one principal. Thebindings
in aPolicy
can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if thebindings
grant 50 different roles touser:alice@example.com
, and not to any other principal, then you can add another 1,450 principals to thebindings
in thePolicy
. - Etag string
etag
is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of theetag
in the read-modify-write cycle to perform policy updates in order to avoid race conditions: Anetag
is returned in the response togetIamPolicy
, and systems are expected to put that etag in the request tosetIamPolicy
to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost.- Version int
- Specifies the format of the policy. Valid values are
0
,1
, and3
. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version3
. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.
- audit
Configs List<ApigatewayAudit Config Response> - Specifies cloud audit logging configuration for this policy.
- bindings
List<Apigateway
Binding Response> - Associates a list of
members
, or principals, with arole
. Optionally, may specify acondition
that determines how and when thebindings
are applied. Each of thebindings
must contain at least one principal. Thebindings
in aPolicy
can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if thebindings
grant 50 different roles touser:alice@example.com
, and not to any other principal, then you can add another 1,450 principals to thebindings
in thePolicy
. - etag String
etag
is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of theetag
in the read-modify-write cycle to perform policy updates in order to avoid race conditions: Anetag
is returned in the response togetIamPolicy
, and systems are expected to put that etag in the request tosetIamPolicy
to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost.- version Integer
- Specifies the format of the policy. Valid values are
0
,1
, and3
. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version3
. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.
- audit
Configs ApigatewayAudit Config Response[] - Specifies cloud audit logging configuration for this policy.
- bindings
Apigateway
Binding Response[] - Associates a list of
members
, or principals, with arole
. Optionally, may specify acondition
that determines how and when thebindings
are applied. Each of thebindings
must contain at least one principal. Thebindings
in aPolicy
can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if thebindings
grant 50 different roles touser:alice@example.com
, and not to any other principal, then you can add another 1,450 principals to thebindings
in thePolicy
. - etag string
etag
is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of theetag
in the read-modify-write cycle to perform policy updates in order to avoid race conditions: Anetag
is returned in the response togetIamPolicy
, and systems are expected to put that etag in the request tosetIamPolicy
to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost.- version number
- Specifies the format of the policy. Valid values are
0
,1
, and3
. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version3
. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.
- audit_
configs Sequence[ApigatewayAudit Config Response] - Specifies cloud audit logging configuration for this policy.
- bindings
Sequence[Apigateway
Binding Response] - Associates a list of
members
, or principals, with arole
. Optionally, may specify acondition
that determines how and when thebindings
are applied. Each of thebindings
must contain at least one principal. Thebindings
in aPolicy
can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if thebindings
grant 50 different roles touser:alice@example.com
, and not to any other principal, then you can add another 1,450 principals to thebindings
in thePolicy
. - etag str
etag
is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of theetag
in the read-modify-write cycle to perform policy updates in order to avoid race conditions: Anetag
is returned in the response togetIamPolicy
, and systems are expected to put that etag in the request tosetIamPolicy
to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost.- version int
- Specifies the format of the policy. Valid values are
0
,1
, and3
. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version3
. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.
- audit
Configs List<Property Map> - Specifies cloud audit logging configuration for this policy.
- bindings List<Property Map>
- Associates a list of
members
, or principals, with arole
. Optionally, may specify acondition
that determines how and when thebindings
are applied. Each of thebindings
must contain at least one principal. Thebindings
in aPolicy
can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if thebindings
grant 50 different roles touser:alice@example.com
, and not to any other principal, then you can add another 1,450 principals to thebindings
in thePolicy
. - etag String
etag
is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of theetag
in the read-modify-write cycle to perform policy updates in order to avoid race conditions: Anetag
is returned in the response togetIamPolicy
, and systems are expected to put that etag in the request tosetIamPolicy
to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost.- version Number
- Specifies the format of the policy. Valid values are
0
,1
, and3
. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version3
. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include theetag
field whenever you callsetIamPolicy
. If you omit this field, then IAM allows you to overwrite a version3
policy with a version1
policy, and all of the conditions in the version3
policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.
Supporting Types
ApigatewayAuditConfigResponse
- Audit
Log List<Pulumi.Configs Google Native. APIGateway. V1. Inputs. Apigateway Audit Log Config Response> - The configuration for logging of each type of permission.
- Service string
- Specifies a service that will be enabled for audit logging. For example,
storage.googleapis.com
,cloudsql.googleapis.com
.allServices
is a special value that covers all services.
- Audit
Log []ApigatewayConfigs Audit Log Config Response - The configuration for logging of each type of permission.
- Service string
- Specifies a service that will be enabled for audit logging. For example,
storage.googleapis.com
,cloudsql.googleapis.com
.allServices
is a special value that covers all services.
- audit
Log List<ApigatewayConfigs Audit Log Config Response> - The configuration for logging of each type of permission.
- service String
- Specifies a service that will be enabled for audit logging. For example,
storage.googleapis.com
,cloudsql.googleapis.com
.allServices
is a special value that covers all services.
- audit
Log ApigatewayConfigs Audit Log Config Response[] - The configuration for logging of each type of permission.
- service string
- Specifies a service that will be enabled for audit logging. For example,
storage.googleapis.com
,cloudsql.googleapis.com
.allServices
is a special value that covers all services.
- audit_
log_ Sequence[Apigatewayconfigs Audit Log Config Response] - The configuration for logging of each type of permission.
- service str
- Specifies a service that will be enabled for audit logging. For example,
storage.googleapis.com
,cloudsql.googleapis.com
.allServices
is a special value that covers all services.
- audit
Log List<Property Map>Configs - The configuration for logging of each type of permission.
- service String
- Specifies a service that will be enabled for audit logging. For example,
storage.googleapis.com
,cloudsql.googleapis.com
.allServices
is a special value that covers all services.
ApigatewayAuditLogConfigResponse
- Exempted
Members List<string> - Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- Log
Type string - The log type that this config enables.
- Exempted
Members []string - Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- Log
Type string - The log type that this config enables.
- exempted
Members List<String> - Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- log
Type String - The log type that this config enables.
- exempted
Members string[] - Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- log
Type string - The log type that this config enables.
- exempted_
members Sequence[str] - Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- log_
type str - The log type that this config enables.
- exempted
Members List<String> - Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
- log
Type String - The log type that this config enables.
ApigatewayBindingResponse
- Condition
Pulumi.
Google Native. APIGateway. V1. Inputs. Apigateway Expr Response - The condition that is associated with this binding. If the condition evaluates to
true
, then this binding applies to the current request. If the condition evaluates tofalse
, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. - Members List<string>
- Specifies the principals requesting access for a Google Cloud resource.
members
can have the following values: *allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account. *allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. *user:{emailid}
: An email address that represents a specific Google account. For example,alice@example.com
. *serviceAccount:{emailid}
: An email address that represents a Google service account. For example,my-other-app@appspot.gserviceaccount.com
. *serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]
: An identifier for a Kubernetes service account. For example,my-project.svc.id.goog[my-namespace/my-kubernetes-sa]
. *group:{emailid}
: An email address that represents a Google group. For example,admins@example.com
. *domain:{domain}
: The G Suite domain (primary) that represents all the users of that domain. For example,google.com
orexample.com
. *deleted:user:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a user that has been recently deleted. For example,alice@example.com?uid=123456789012345678901
. If the user is recovered, this value reverts touser:{emailid}
and the recovered user retains the role in the binding. *deleted:serviceAccount:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a service account that has been recently deleted. For example,my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901
. If the service account is undeleted, this value reverts toserviceAccount:{emailid}
and the undeleted service account retains the role in the binding. *deleted:group:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example,admins@example.com?uid=123456789012345678901
. If the group is recovered, this value reverts togroup:{emailid}
and the recovered group retains the role in the binding. - Role string
- Role that is assigned to the list of
members
, or principals. For example,roles/viewer
,roles/editor
, orroles/owner
.
- Condition
Apigateway
Expr Response - The condition that is associated with this binding. If the condition evaluates to
true
, then this binding applies to the current request. If the condition evaluates tofalse
, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. - Members []string
- Specifies the principals requesting access for a Google Cloud resource.
members
can have the following values: *allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account. *allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. *user:{emailid}
: An email address that represents a specific Google account. For example,alice@example.com
. *serviceAccount:{emailid}
: An email address that represents a Google service account. For example,my-other-app@appspot.gserviceaccount.com
. *serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]
: An identifier for a Kubernetes service account. For example,my-project.svc.id.goog[my-namespace/my-kubernetes-sa]
. *group:{emailid}
: An email address that represents a Google group. For example,admins@example.com
. *domain:{domain}
: The G Suite domain (primary) that represents all the users of that domain. For example,google.com
orexample.com
. *deleted:user:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a user that has been recently deleted. For example,alice@example.com?uid=123456789012345678901
. If the user is recovered, this value reverts touser:{emailid}
and the recovered user retains the role in the binding. *deleted:serviceAccount:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a service account that has been recently deleted. For example,my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901
. If the service account is undeleted, this value reverts toserviceAccount:{emailid}
and the undeleted service account retains the role in the binding. *deleted:group:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example,admins@example.com?uid=123456789012345678901
. If the group is recovered, this value reverts togroup:{emailid}
and the recovered group retains the role in the binding. - Role string
- Role that is assigned to the list of
members
, or principals. For example,roles/viewer
,roles/editor
, orroles/owner
.
- condition
Apigateway
Expr Response - The condition that is associated with this binding. If the condition evaluates to
true
, then this binding applies to the current request. If the condition evaluates tofalse
, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. - members List<String>
- Specifies the principals requesting access for a Google Cloud resource.
members
can have the following values: *allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account. *allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. *user:{emailid}
: An email address that represents a specific Google account. For example,alice@example.com
. *serviceAccount:{emailid}
: An email address that represents a Google service account. For example,my-other-app@appspot.gserviceaccount.com
. *serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]
: An identifier for a Kubernetes service account. For example,my-project.svc.id.goog[my-namespace/my-kubernetes-sa]
. *group:{emailid}
: An email address that represents a Google group. For example,admins@example.com
. *domain:{domain}
: The G Suite domain (primary) that represents all the users of that domain. For example,google.com
orexample.com
. *deleted:user:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a user that has been recently deleted. For example,alice@example.com?uid=123456789012345678901
. If the user is recovered, this value reverts touser:{emailid}
and the recovered user retains the role in the binding. *deleted:serviceAccount:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a service account that has been recently deleted. For example,my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901
. If the service account is undeleted, this value reverts toserviceAccount:{emailid}
and the undeleted service account retains the role in the binding. *deleted:group:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example,admins@example.com?uid=123456789012345678901
. If the group is recovered, this value reverts togroup:{emailid}
and the recovered group retains the role in the binding. - role String
- Role that is assigned to the list of
members
, or principals. For example,roles/viewer
,roles/editor
, orroles/owner
.
- condition
Apigateway
Expr Response - The condition that is associated with this binding. If the condition evaluates to
true
, then this binding applies to the current request. If the condition evaluates tofalse
, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. - members string[]
- Specifies the principals requesting access for a Google Cloud resource.
members
can have the following values: *allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account. *allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. *user:{emailid}
: An email address that represents a specific Google account. For example,alice@example.com
. *serviceAccount:{emailid}
: An email address that represents a Google service account. For example,my-other-app@appspot.gserviceaccount.com
. *serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]
: An identifier for a Kubernetes service account. For example,my-project.svc.id.goog[my-namespace/my-kubernetes-sa]
. *group:{emailid}
: An email address that represents a Google group. For example,admins@example.com
. *domain:{domain}
: The G Suite domain (primary) that represents all the users of that domain. For example,google.com
orexample.com
. *deleted:user:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a user that has been recently deleted. For example,alice@example.com?uid=123456789012345678901
. If the user is recovered, this value reverts touser:{emailid}
and the recovered user retains the role in the binding. *deleted:serviceAccount:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a service account that has been recently deleted. For example,my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901
. If the service account is undeleted, this value reverts toserviceAccount:{emailid}
and the undeleted service account retains the role in the binding. *deleted:group:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example,admins@example.com?uid=123456789012345678901
. If the group is recovered, this value reverts togroup:{emailid}
and the recovered group retains the role in the binding. - role string
- Role that is assigned to the list of
members
, or principals. For example,roles/viewer
,roles/editor
, orroles/owner
.
- condition
Apigateway
Expr Response - The condition that is associated with this binding. If the condition evaluates to
true
, then this binding applies to the current request. If the condition evaluates tofalse
, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. - members Sequence[str]
- Specifies the principals requesting access for a Google Cloud resource.
members
can have the following values: *allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account. *allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. *user:{emailid}
: An email address that represents a specific Google account. For example,alice@example.com
. *serviceAccount:{emailid}
: An email address that represents a Google service account. For example,my-other-app@appspot.gserviceaccount.com
. *serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]
: An identifier for a Kubernetes service account. For example,my-project.svc.id.goog[my-namespace/my-kubernetes-sa]
. *group:{emailid}
: An email address that represents a Google group. For example,admins@example.com
. *domain:{domain}
: The G Suite domain (primary) that represents all the users of that domain. For example,google.com
orexample.com
. *deleted:user:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a user that has been recently deleted. For example,alice@example.com?uid=123456789012345678901
. If the user is recovered, this value reverts touser:{emailid}
and the recovered user retains the role in the binding. *deleted:serviceAccount:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a service account that has been recently deleted. For example,my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901
. If the service account is undeleted, this value reverts toserviceAccount:{emailid}
and the undeleted service account retains the role in the binding. *deleted:group:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example,admins@example.com?uid=123456789012345678901
. If the group is recovered, this value reverts togroup:{emailid}
and the recovered group retains the role in the binding. - role str
- Role that is assigned to the list of
members
, or principals. For example,roles/viewer
,roles/editor
, orroles/owner
.
- condition Property Map
- The condition that is associated with this binding. If the condition evaluates to
true
, then this binding applies to the current request. If the condition evaluates tofalse
, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. - members List<String>
- Specifies the principals requesting access for a Google Cloud resource.
members
can have the following values: *allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account. *allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. *user:{emailid}
: An email address that represents a specific Google account. For example,alice@example.com
. *serviceAccount:{emailid}
: An email address that represents a Google service account. For example,my-other-app@appspot.gserviceaccount.com
. *serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]
: An identifier for a Kubernetes service account. For example,my-project.svc.id.goog[my-namespace/my-kubernetes-sa]
. *group:{emailid}
: An email address that represents a Google group. For example,admins@example.com
. *domain:{domain}
: The G Suite domain (primary) that represents all the users of that domain. For example,google.com
orexample.com
. *deleted:user:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a user that has been recently deleted. For example,alice@example.com?uid=123456789012345678901
. If the user is recovered, this value reverts touser:{emailid}
and the recovered user retains the role in the binding. *deleted:serviceAccount:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a service account that has been recently deleted. For example,my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901
. If the service account is undeleted, this value reverts toserviceAccount:{emailid}
and the undeleted service account retains the role in the binding. *deleted:group:{emailid}?uid={uniqueid}
: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example,admins@example.com?uid=123456789012345678901
. If the group is recovered, this value reverts togroup:{emailid}
and the recovered group retains the role in the binding. - role String
- Role that is assigned to the list of
members
, or principals. For example,roles/viewer
,roles/editor
, orroles/owner
.
ApigatewayExprResponse
- Description string
- Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- Expression string
- Textual representation of an expression in Common Expression Language syntax.
- Location string
- Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- Title string
- Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
- Description string
- Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- Expression string
- Textual representation of an expression in Common Expression Language syntax.
- Location string
- Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- Title string
- Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
- description String
- Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- expression String
- Textual representation of an expression in Common Expression Language syntax.
- location String
- Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- title String
- Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
- description string
- Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- expression string
- Textual representation of an expression in Common Expression Language syntax.
- location string
- Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- title string
- Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
- description str
- Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- expression str
- Textual representation of an expression in Common Expression Language syntax.
- location str
- Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- title str
- Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
- description String
- Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
- expression String
- Textual representation of an expression in Common Expression Language syntax.
- location String
- Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
- title String
- Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
Package Details
- Repository
- Google Cloud Native pulumi/pulumi-google-native
- License
- Apache-2.0
Google Cloud Native is in preview. Google Cloud Classic is fully supported.