feat: Add new gcloud commands, API clients, and third-party libraries across various services.

This commit is contained in:
2026-01-01 20:26:35 +01:00
parent 5e23cbece0
commit a19e592eb7
25221 changed files with 8324611 additions and 0 deletions

View File

@@ -0,0 +1,34 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
"""Manage Access Policy resources."""
from googlecloudsdk.calliope import base
from surface.iam.access_policies import _init_extensions as extensions
@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
@base.Autogenerated
@base.Hidden
class AccessPoliciesAlpha(extensions.AccessPoliciesAlpha):
"""Manage Access Policy resources."""
@base.ReleaseTracks(base.ReleaseTrack.BETA)
@base.Autogenerated
class AccessPoliciesBeta(extensions.AccessPoliciesBeta):
"""Manage Access Policy resources."""

View File

@@ -0,0 +1,31 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
"""File to add optional custom code to extend __init__.py."""
from googlecloudsdk.calliope import base
class AccessPoliciesAlpha(base.Group):
"""Optional no-auto-generated code for ALPHA."""
class AccessPoliciesBeta(base.Group):
"""Optional no-auto-generated code for BETA."""
class AccessPoliciesGa(base.Group):
"""Optional no-auto-generated code for GA."""

View File

@@ -0,0 +1,208 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- ALPHA
auto_generated: true
hidden: true
help_text:
brief: Create AccessPolicy instance.
description: |
Create AccessPolicy instance.
examples: |-
To create a policy instance called `my-policy`, run:
$ {command} my-policy --organization=123 --location=global --details.rules=rule1.json
arguments:
params:
- help_text: |-
Identifier. The resource name of the access policy.
The following formats are supported:
* `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}`
* `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}`
* `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}`
* `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`
is_positional: true
is_primary_resource: true
request_id_field: accessPolicyId
resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
- arg_name: etag
api_field: googleIamV3alphaAccessPolicy.etag
required: false
repeated: false
help_text: |-
The etag for the access policy.
If this is provided on update, it must match the server's etag.
- arg_name: display-name
api_field: googleIamV3alphaAccessPolicy.displayName
required: false
repeated: false
help_text: |-
The description of the access policy. Must be less than
or equal to 63 characters.
- arg_name: annotations
api_field: googleIamV3alphaAccessPolicy.annotations
required: false
repeated: true
help_text: |-
User defined annotations. See https://google.aip.dev/148#annotations for
more details such as format and size limitations
spec:
- api_field: key
- api_field: value
- group:
api_field: googleIamV3alphaAccessPolicy.details
required: false
help_text: |-
Access policy details.
params:
- arg_name: details-rules
api_field: googleIamV3alphaAccessPolicy.details.rules
required: true
repeated: true
help_text: |-
A list of access policy rules.
spec:
- api_field: description
one_of_index: 0
help_text: |-
Customer specified description of the rule. Must be less than or equal to
256 characters.
- api_field: effect
one_of_index: 1
help_text: |-
The effect of the rule.
- api_field: principals
help_text: |-
The identities for which this rule's effect governs using one or more
permissions on Google Cloud resources. This field can contain the
following values:
* `principal://goog/subject/{email_id}`: A specific Google Account.
Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
example, `principal://goog/subject/alice@example.com`.
If an identifier that was previously set on a policy is soft deleted, then
calls to read that policy will return the identifier with a deleted
prefix. Users cannot set identifiers with this syntax.
* `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
Google Account that was deleted recently. For example,
`deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If
the Google Account is recovered, this identifier reverts to the standard
identifier for a Google Account.
* `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
that was deleted recently. For example,
`deleted:principalSet://goog/group/admins@example.com?uid=1234567890`.
If the Google group is restored, this identifier reverts to the standard
identifier for a Google group.
* `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
A Google Cloud service account that was deleted recently. For example,
`deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`.
If the service account is undeleted, this identifier reverts to the
standard identifier for a service account.
- api_field: excludedPrincipals
help_text: |-
The identities that are excluded from the access policy rule, even if they
are listed in the `principals`. For example, you could add a Google
group to the `principals`, then exclude specific users who belong to
that group.
- api_field: permissions
help_text: |-
The permissions that are explicitly affected by this rule. Each permission
uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
is the fully qualified domain name for the service.
Currently supported permissions are as follows:
* `eventarc.googleapis.com/messageBuses.publish`.
- api_field: excludedPermissions
help_text: |-
Specifies the permissions that this rule excludes from the set of affected
permissions given by `permissions`. If a permission appears in
`permissions` _and_ in `excluded_permissions` then it will _not_ be
subject to the policy effect.
The excluded permissions can be specified using the same syntax as
`permissions`.
- api_field: activationConditions
help_text: |-
The conditions that determine whether this rule applies to a request.
Conditions are identified by their key, which is the FQDN of the service
that they are relevant to. For example: `"activationConditions": {
"iam.googleapis.com": {
"cel_condition": <cel expression>
}
}`. Each rule is evaluated independently. If this rule does not apply
to a request, other rules might still apply.
Currently supported keys are as follows:
* `eventarc.googleapis.com`
spec:
- api_field: key
- api_field: value
spec:
- api_field: celCondition
help_text: |-
The CEL condition that will be evaluated to determine rule applicability.
Note that the attributes and functions that can be used in the condition
will be limited by the namespace it is associated with in the
`activation_conditions` map.
Expr.expression must be less than 512 characters in length.
spec:
- api_field: expression
help_text: |-
Textual representation of an expression in Common Expression Language
syntax.
- api_field: title
help_text: |-
Title for the expression, i.e. a short string describing
its purpose. This can be used e.g. in UIs which allow to enter the
expression.
- api_field: description
help_text: |-
Description of the expression. This is a longer text which
describes the expression, e.g. when hovered over it in a UI.
- api_field: location
help_text: |-
String indicating the location of the expression for error
reporting, e.g. a file name and a position in the file.
- arg_name: validate-only
api_field: validateOnly
action: store_true
required: false
type: bool
help_text: |-
If set, validate the request and preview the creation, but do not actually
post it.
default: null
request:
api_version: v3alpha
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
async:
collection:
- iam.folders.locations.operations
- iam.organizations.locations.operations
- iam.projects.locations.operations

View File

@@ -0,0 +1,210 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- BETA
auto_generated: true
help_text:
brief: Create AccessPolicy instance.
description: |
Create AccessPolicy instance.
examples: |-
To create a policy instance called `my-policy`, run:
$ {command} my-policy --organization=123 --location=global --details.rules=rule1.json
arguments:
params:
- help_text: |-
Identifier. The resource name of the access policy.
The following formats are supported:
* `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}`
* `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}`
* `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}`
* `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`
is_positional: true
is_primary_resource: true
request_id_field: accessPolicyId
resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
- arg_name: etag
api_field: googleIamV3betaAccessPolicy.etag
required: false
repeated: false
help_text: |-
The etag for the access policy.
If this is provided on update, it must match the server's etag.
- arg_name: display-name
api_field: googleIamV3betaAccessPolicy.displayName
required: false
repeated: false
help_text: |-
The description of the access policy. Must be less than
or equal to 63 characters.
- arg_name: annotations
api_field: googleIamV3betaAccessPolicy.annotations
required: false
repeated: true
help_text: |-
User defined annotations. See https://google.aip.dev/148#annotations for
more details such as format and size limitations
spec:
- api_field: key
- api_field: value
- group:
api_field: googleIamV3betaAccessPolicy.details
required: false
help_text: |-
Access policy details.
params:
- arg_name: details-rules
api_field: googleIamV3betaAccessPolicy.details.rules
required: true
repeated: true
help_text: |-
A list of access policy rules.
spec:
- api_field: description
one_of_index: 0
help_text: |-
Customer specified description of the rule. Must be less than or equal to
256 characters.
- api_field: effect
one_of_index: 1
help_text: |-
The effect of the rule.
- api_field: principals
help_text: |-
The identities for which this rule's effect governs using one or more
permissions on Google Cloud resources. This field can contain the
following values:
* `principal://goog/subject/{email_id}`: A specific Google Account.
Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
example, `principal://goog/subject/alice@example.com`.
If an identifier that was previously set on a policy is soft deleted, then
calls to read that policy will return the identifier with a deleted
prefix. Users cannot set identifiers with this syntax.
* `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
Google Account that was deleted recently. For example,
`deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If
the Google Account is recovered, this identifier reverts to the standard
identifier for a Google Account.
* `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
that was deleted recently. For example,
`deleted:principalSet://goog/group/admins@example.com?uid=1234567890`.
If the Google group is restored, this identifier reverts to the standard
identifier for a Google group.
* `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
A Google Cloud service account that was deleted recently. For example,
`deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`.
If the service account is undeleted, this identifier reverts to the
standard identifier for a service account.
- api_field: excludedPrincipals
help_text: |-
The identities that are excluded from the access policy rule, even if they
are listed in the `principals`. For example, you could add a Google
group to the `principals`, then exclude specific users who belong to
that group.
- api_field: operation
help_text: |-
Attributes that are used to determine whether this rule applies to a
request.
spec:
- api_field: permissions
help_text: |-
The permissions that are explicitly affected by this rule. Each
permission uses the format `{service_fqdn}/{resource}.{verb}`, where
`{service_fqdn}` is the fully qualified domain name for the service.
Currently supported permissions are as follows:
* `eventarc.googleapis.com/messageBuses.publish`.
- api_field: excludedPermissions
help_text: |-
Specifies the permissions that this rule excludes from the set of
affected permissions given by `permissions`. If a permission appears in
`permissions` _and_ in `excluded_permissions` then it will _not_ be
subject to the policy effect.
The excluded permissions can be specified using the same syntax as
`permissions`.
- api_field: conditions
help_text: |-
The conditions that determine whether this rule applies to a request.
Conditions are identified by their key, which is the FQDN of the service
that they are relevant to. For example: `"conditions": {
"iam.googleapis.com": <cel expression>
}`. Each rule is evaluated independently. If this rule does not apply
to a request, other rules might still apply.
Currently supported keys are as follows:
* `eventarc.googleapis.com`: Can use `CEL` functions that evaluate
resource fields.
* `iam.googleapis.com`: Can use `CEL` functions that evaluate
[resource
tags](https://cloud.google.com/iam/help/conditions/resource-tags) and
combine them using boolean and logical operators. Other functions and
operators are not supported.
spec:
- api_field: key
- api_field: value
spec:
- api_field: expression
help_text: |-
Textual representation of an expression in Common Expression Language
syntax.
- api_field: title
help_text: |-
Title for the expression, i.e. a short string describing
its purpose. This can be used e.g. in UIs which allow to enter the
expression.
- api_field: description
help_text: |-
Description of the expression. This is a longer text which
describes the expression, e.g. when hovered over it in a UI.
- api_field: location
help_text: |-
String indicating the location of the expression for error
reporting, e.g. a file name and a position in the file.
- arg_name: validate-only
api_field: validateOnly
action: store_true
required: false
type: bool
help_text: |-
If set, validate the request and preview the creation, but do not actually
post it.
default: null
request:
api_version: v3beta
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
async:
collection:
- iam.folders.locations.operations
- iam.organizations.locations.operations
- iam.projects.locations.operations

View File

@@ -0,0 +1,79 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- ALPHA
auto_generated: true
hidden: true
help_text:
brief: Delete AccessPolicy instance.
description: |
Delete AccessPolicy instance.
examples: |-
To delete `my-policy` instance, run:
$ {command} my-policy
arguments:
params:
- help_text: |-
The name of the access policy to delete.
Format:
`projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`
`folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}`
`organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
- arg_name: etag
api_field: etag
required: false
repeated: false
help_text: |-
The etag of the access policy. If this is provided, it must match the
server's etag.
- arg_name: validate-only
api_field: validateOnly
action: store_true
required: false
type: bool
help_text: |-
If set, validate the request and preview the deletion, but do not actually
post it.
default: null
- arg_name: force
api_field: force
action: store_true
required: false
type: bool
help_text: |-
If set to true, the request will force the deletion of the Policy even if
the Policy references PolicyBindings.
default: null
request:
api_version: v3alpha
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
async:
collection:
- iam.folders.locations.operations
- iam.organizations.locations.operations
- iam.projects.locations.operations

View File

@@ -0,0 +1,78 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- BETA
auto_generated: true
help_text:
brief: Delete AccessPolicy instance.
description: |
Delete AccessPolicy instance.
examples: |-
To delete `my-policy` instance, run:
$ {command} my-policy
arguments:
params:
- help_text: |-
The name of the access policy to delete.
Format:
`projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`
`folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}`
`organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
- arg_name: etag
api_field: etag
required: false
repeated: false
help_text: |-
The etag of the access policy. If this is provided, it must match the
server's etag.
- arg_name: validate-only
api_field: validateOnly
action: store_true
required: false
type: bool
help_text: |-
If set, validate the request and preview the deletion, but do not actually
post it.
default: null
- arg_name: force
api_field: force
action: store_true
required: false
type: bool
help_text: |-
If set to true, the request will force the deletion of the Policy even if
the Policy references PolicyBindings.
default: null
request:
api_version: v3beta
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
async:
collection:
- iam.folders.locations.operations
- iam.organizations.locations.operations
- iam.projects.locations.operations

View File

@@ -0,0 +1,49 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- ALPHA
auto_generated: true
hidden: true
help_text:
brief: Get AccessPolicy instance.
description: |
Get AccessPolicy instance.
examples: |-
To get the details of a single policy `my-policy` in organization `123`, run:
$ {command} my-policy --organization=123 --location=global
arguments:
params:
- help_text: |-
The name of the access policy to retrieve.
Format:
`projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`
`folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}`
`organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
request:
api_version: v3alpha
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies

View File

@@ -0,0 +1,48 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- BETA
auto_generated: true
help_text:
brief: Get AccessPolicy instance.
description: |
Get AccessPolicy instance.
examples: |-
To get the details of a single policy `my-policy` in organization `123`, run:
$ {command} my-policy --organization=123 --location=global
arguments:
params:
- help_text: |-
The name of the access policy to retrieve.
Format:
`projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`
`folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}`
`organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
request:
api_version: v3beta
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies

View File

@@ -0,0 +1,52 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- ALPHA
auto_generated: true
hidden: true
help_text:
brief: List AccessPolicy instances.
description: |
List AccessPolicy instances.
examples: |-
To list all policy instances in organization `123`, run:
$ {command} --organization=123 --location=global
arguments:
params:
- help_text: |-
The parent resource, which owns the collection of access policy
resources.
Format:
`projects/{project_id}/locations/{location}`
`projects/{project_number}/locations/{location}`
`folders/{folder_id}/locations/{location}`
`organizations/{organization_id}/locations/{location}`
is_positional: false
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations
required: true
request:
api_version: v3alpha
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
response:
id_field: name

View File

@@ -0,0 +1,51 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- BETA
auto_generated: true
help_text:
brief: List AccessPolicy instances.
description: |
List AccessPolicy instances.
examples: |-
To list all policy instances in organization `123`, run:
$ {command} --organization=123 --location=global
arguments:
params:
- help_text: |-
The parent resource, which owns the collection of access policy
resources.
Format:
`projects/{project_id}/locations/{location}`
`projects/{project_number}/locations/{location}`
`folders/{folder_id}/locations/{location}`
`organizations/{organization_id}/locations/{location}`
is_positional: false
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations
required: true
request:
api_version: v3beta
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
response:
id_field: name

View File

@@ -0,0 +1,49 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- ALPHA
auto_generated: true
hidden: true
help_text:
brief: search accessPolicies
description: search accessPolicies
examples: |-
To search all accessPolicies, run:
$ {command}
arguments:
params:
- help_text: |-
The name of the access policy.
Format:
`organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`
`folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
request:
api_version: v3alpha
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
method: searchPolicyBindings
command_type: GENERIC

View File

@@ -0,0 +1,48 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- BETA
auto_generated: true
help_text:
brief: search accessPolicies
description: search accessPolicies
examples: |-
To search all accessPolicies, run:
$ {command}
arguments:
params:
- help_text: |-
The name of the access policy.
Format:
`organizations/{organization_id}/locations/{location}/accessPolicies/{access_policy_id}`
`folders/{folder_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_id}/locations/{location}/accessPolicies/{access_policy_id}`
`projects/{project_number}/locations/{location}/accessPolicies/{access_policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
request:
api_version: v3beta
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
method: searchPolicyBindings
command_type: GENERIC

View File

@@ -0,0 +1,212 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- ALPHA
auto_generated: true
hidden: true
help_text:
brief: Update AccessPolicy instance.
description: |
Update AccessPolicy instance.
examples: |-
To update display name of `my-policy` in organization `123`, run:
$ {command} my-policy --organization=123 --location=global --display-name=new-display-name
arguments:
params:
- help_text: |-
Identifier. The resource name of the access policy.
The following formats are supported:
* `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}`
* `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}`
* `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}`
* `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
- arg_name: etag
api_field: googleIamV3alphaAccessPolicy.etag
required: false
repeated: false
help_text: |-
The etag for the access policy.
If this is provided on update, it must match the server's etag.
- arg_name: display-name
api_field: googleIamV3alphaAccessPolicy.displayName
required: false
repeated: false
help_text: |-
The description of the access policy. Must be less than
or equal to 63 characters.
- arg_name: annotations
api_field: googleIamV3alphaAccessPolicy.annotations
required: false
repeated: true
help_text: |-
User defined annotations. See https://google.aip.dev/148#annotations for
more details such as format and size limitations
clearable: true
spec:
- api_field: key
- api_field: value
- group:
api_field: googleIamV3alphaAccessPolicy.details
arg_name: details
clearable: true
required: false
help_text: |-
Access policy details.
params:
- arg_name: details-rules
api_field: googleIamV3alphaAccessPolicy.details.rules
required: false
repeated: true
help_text: |-
A list of access policy rules.
clearable: true
spec:
- api_field: description
one_of_index: 0
help_text: |-
Customer specified description of the rule. Must be less than or equal to
256 characters.
- api_field: effect
one_of_index: 1
help_text: |-
The effect of the rule.
- api_field: principals
help_text: |-
The identities for which this rule's effect governs using one or more
permissions on Google Cloud resources. This field can contain the
following values:
* `principal://goog/subject/{email_id}`: A specific Google Account.
Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
example, `principal://goog/subject/alice@example.com`.
If an identifier that was previously set on a policy is soft deleted, then
calls to read that policy will return the identifier with a deleted
prefix. Users cannot set identifiers with this syntax.
* `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
Google Account that was deleted recently. For example,
`deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If
the Google Account is recovered, this identifier reverts to the standard
identifier for a Google Account.
* `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
that was deleted recently. For example,
`deleted:principalSet://goog/group/admins@example.com?uid=1234567890`.
If the Google group is restored, this identifier reverts to the standard
identifier for a Google group.
* `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
A Google Cloud service account that was deleted recently. For example,
`deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`.
If the service account is undeleted, this identifier reverts to the
standard identifier for a service account.
- api_field: excludedPrincipals
help_text: |-
The identities that are excluded from the access policy rule, even if they
are listed in the `principals`. For example, you could add a Google
group to the `principals`, then exclude specific users who belong to
that group.
- api_field: permissions
help_text: |-
The permissions that are explicitly affected by this rule. Each permission
uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
is the fully qualified domain name for the service.
Currently supported permissions are as follows:
* `eventarc.googleapis.com/messageBuses.publish`.
- api_field: excludedPermissions
help_text: |-
Specifies the permissions that this rule excludes from the set of affected
permissions given by `permissions`. If a permission appears in
`permissions` _and_ in `excluded_permissions` then it will _not_ be
subject to the policy effect.
The excluded permissions can be specified using the same syntax as
`permissions`.
- api_field: activationConditions
help_text: |-
The conditions that determine whether this rule applies to a request.
Conditions are identified by their key, which is the FQDN of the service
that they are relevant to. For example: `"activationConditions": {
"iam.googleapis.com": {
"cel_condition": <cel expression>
}
}`. Each rule is evaluated independently. If this rule does not apply
to a request, other rules might still apply.
Currently supported keys are as follows:
* `eventarc.googleapis.com`
spec:
- api_field: key
- api_field: value
spec:
- api_field: celCondition
help_text: |-
The CEL condition that will be evaluated to determine rule applicability.
Note that the attributes and functions that can be used in the condition
will be limited by the namespace it is associated with in the
`activation_conditions` map.
Expr.expression must be less than 512 characters in length.
spec:
- api_field: expression
help_text: |-
Textual representation of an expression in Common Expression Language
syntax.
- api_field: title
help_text: |-
Title for the expression, i.e. a short string describing
its purpose. This can be used e.g. in UIs which allow to enter the
expression.
- api_field: description
help_text: |-
Description of the expression. This is a longer text which
describes the expression, e.g. when hovered over it in a UI.
- api_field: location
help_text: |-
String indicating the location of the expression for error
reporting, e.g. a file name and a position in the file.
- arg_name: validate-only
api_field: validateOnly
action: store_true_false
required: false
type: bool
help_text: |-
If set, validate the request and preview the update, but do not actually
post it.
request:
api_version: v3alpha
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
async:
collection:
- iam.folders.locations.operations
- iam.organizations.locations.operations
- iam.projects.locations.operations
update:
read_modify_update: true

View File

@@ -0,0 +1,214 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
- BETA
auto_generated: true
help_text:
brief: Update AccessPolicy instance.
description: |
Update AccessPolicy instance.
examples: |-
To update display name of `my-policy` in organization `123`, run:
$ {command} my-policy --organization=123 --location=global --display-name=new-display-name
arguments:
params:
- help_text: |-
Identifier. The resource name of the access policy.
The following formats are supported:
* `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}`
* `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}`
* `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}`
* `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`
is_positional: true
is_primary_resource: true
resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations_access_policies
required: true
- arg_name: etag
api_field: googleIamV3betaAccessPolicy.etag
required: false
repeated: false
help_text: |-
The etag for the access policy.
If this is provided on update, it must match the server's etag.
- arg_name: display-name
api_field: googleIamV3betaAccessPolicy.displayName
required: false
repeated: false
help_text: |-
The description of the access policy. Must be less than
or equal to 63 characters.
- arg_name: annotations
api_field: googleIamV3betaAccessPolicy.annotations
required: false
repeated: true
help_text: |-
User defined annotations. See https://google.aip.dev/148#annotations for
more details such as format and size limitations
clearable: true
spec:
- api_field: key
- api_field: value
- group:
api_field: googleIamV3betaAccessPolicy.details
arg_name: details
clearable: true
required: false
help_text: |-
Access policy details.
params:
- arg_name: details-rules
api_field: googleIamV3betaAccessPolicy.details.rules
required: false
repeated: true
help_text: |-
A list of access policy rules.
clearable: true
spec:
- api_field: description
one_of_index: 0
help_text: |-
Customer specified description of the rule. Must be less than or equal to
256 characters.
- api_field: effect
one_of_index: 1
help_text: |-
The effect of the rule.
- api_field: principals
help_text: |-
The identities for which this rule's effect governs using one or more
permissions on Google Cloud resources. This field can contain the
following values:
* `principal://goog/subject/{email_id}`: A specific Google Account.
Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
example, `principal://goog/subject/alice@example.com`.
If an identifier that was previously set on a policy is soft deleted, then
calls to read that policy will return the identifier with a deleted
prefix. Users cannot set identifiers with this syntax.
* `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
Google Account that was deleted recently. For example,
`deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If
the Google Account is recovered, this identifier reverts to the standard
identifier for a Google Account.
* `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
that was deleted recently. For example,
`deleted:principalSet://goog/group/admins@example.com?uid=1234567890`.
If the Google group is restored, this identifier reverts to the standard
identifier for a Google group.
* `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
A Google Cloud service account that was deleted recently. For example,
`deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`.
If the service account is undeleted, this identifier reverts to the
standard identifier for a service account.
- api_field: excludedPrincipals
help_text: |-
The identities that are excluded from the access policy rule, even if they
are listed in the `principals`. For example, you could add a Google
group to the `principals`, then exclude specific users who belong to
that group.
- api_field: operation
help_text: |-
Attributes that are used to determine whether this rule applies to a
request.
spec:
- api_field: permissions
help_text: |-
The permissions that are explicitly affected by this rule. Each
permission uses the format `{service_fqdn}/{resource}.{verb}`, where
`{service_fqdn}` is the fully qualified domain name for the service.
Currently supported permissions are as follows:
* `eventarc.googleapis.com/messageBuses.publish`.
- api_field: excludedPermissions
help_text: |-
Specifies the permissions that this rule excludes from the set of
affected permissions given by `permissions`. If a permission appears in
`permissions` _and_ in `excluded_permissions` then it will _not_ be
subject to the policy effect.
The excluded permissions can be specified using the same syntax as
`permissions`.
- api_field: conditions
help_text: |-
The conditions that determine whether this rule applies to a request.
Conditions are identified by their key, which is the FQDN of the service
that they are relevant to. For example: `"conditions": {
"iam.googleapis.com": <cel expression>
}`. Each rule is evaluated independently. If this rule does not apply
to a request, other rules might still apply.
Currently supported keys are as follows:
* `eventarc.googleapis.com`: Can use `CEL` functions that evaluate
resource fields.
* `iam.googleapis.com`: Can use `CEL` functions that evaluate
[resource
tags](https://cloud.google.com/iam/help/conditions/resource-tags) and
combine them using boolean and logical operators. Other functions and
operators are not supported.
spec:
- api_field: key
- api_field: value
spec:
- api_field: expression
help_text: |-
Textual representation of an expression in Common Expression Language
syntax.
- api_field: title
help_text: |-
Title for the expression, i.e. a short string describing
its purpose. This can be used e.g. in UIs which allow to enter the
expression.
- api_field: description
help_text: |-
Description of the expression. This is a longer text which
describes the expression, e.g. when hovered over it in a UI.
- api_field: location
help_text: |-
String indicating the location of the expression for error
reporting, e.g. a file name and a position in the file.
- arg_name: validate-only
api_field: validateOnly
action: store_true_false
required: false
type: bool
help_text: |-
If set, validate the request and preview the update, but do not actually
post it.
request:
api_version: v3beta
collection:
- iam.folders.locations.accessPolicies
- iam.organizations.locations.accessPolicies
- iam.projects.locations.accessPolicies
async:
collection:
- iam.folders.locations.operations
- iam.organizations.locations.operations
- iam.projects.locations.operations
update:
read_modify_update: true

View File

@@ -0,0 +1,18 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
_PARTIALS_: true

View File

@@ -0,0 +1,18 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
_PARTIALS_: true

View File

@@ -0,0 +1,18 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
_PARTIALS_: true

View File

@@ -0,0 +1,18 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
_PARTIALS_: true

View File

@@ -0,0 +1,18 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
_PARTIALS_: true

View File

@@ -0,0 +1,18 @@
# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
_PARTIALS_: true