feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The super-group for the IAP TCP DestGroup CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Iap(base.Group):
+  """Manage IAP TCP Destination Group resources."""
+
+  category = 'Identity and Security'

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/add_iam_policy_binding.py

@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Add IAM Policy Binding."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iam import iam_util
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class AddIamPolicyBinding(base.Command):
+  """Add IAM policy binding to an IAP TCP Tunnel Destination Group resource.
+
+  Adds a policy binding to the IAM policy of an IAP TCP Tunnel Destination Group
+  resource. One binding consists of a member, a role, and an optional condition.
+  """
+  detailed_help = {
+      'EXAMPLES':
+          """\
+          To add an IAM policy binding for the role of
+          'roles/iap.tunnelResourceAccessor' for the user 'test-user@gmail.com'
+          in the group 'my-group' located in the region 'us-west1', run:
+
+            $ {command} --member='user:test-user@gmail.com'
+               --role='roles/iap.tunnelResourceAccessor'
+               --dest-group='my-group' --region='us-west1'
+
+          To add an IAM policy binding for the role of
+          'roles/iap.tunnelResourceAccessor' for all authenticated users in the
+          group 'my-group' located in the region 'us-west1', run:
+
+            $ {command} --member='allAuthenticatedUsers'
+              --role='roles/iap.tunnelResourceAccessor'
+              --dest-group='my-group' --region='us-west1'
+
+          To add an IAM policy binding which expires at the end of the year 2018
+          for the role of 'roles/iap.tunnelResourceAccessor' and the user
+          'test-user@gmail.com' in the group 'my-group' located in the region
+          'us-west1', run:
+
+            $ {command} --member='user:test-user@gmail.com'
+                --role='roles/iap.tunnelResourceAccessor'
+                --condition='expression=request.time <
+                timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,
+                description=Expires at midnight on 2018-12-31'
+                --dest-group='my-group' --region='us-west1'
+
+          See https://cloud.google.com/iam/docs/managing-policies for details of
+          policy role and member types.
+  """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddAddIamPolicyBindingArgs(parser)
+    iap_util.AddIamDestGroupArgs(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter.
+    """
+    condition = iam_util.ValidateAndExtractConditionMutexRole(args)
+    iap_iam_ref = iap_util.ParseIapDestGroupResource(self.ReleaseTrack(), args)
+    return iap_iam_ref.AddIamPolicyBinding(args.member, args.role, condition)

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/create.py

@@ -0,0 +1,82 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create IAP TCP Destination Group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Create(base.Command):
+  """Create the IAP TCP Destination Group resource."""
+  detailed_help = {
+      'EXAMPLES':
+          """\
+          To create a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          in the current project run:
+
+          $ {command} GROUP_NAME --region=REGION
+
+          To create a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          with ip ranges ``CIDR1'', ``CIDR2'' in the current project run:
+
+          $ {command} GROUP_NAME --region=REGION --ip-range-list=CIDR1,CIDR2
+
+          To create a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          with fqdns ``FQDN1'', ``FQDN2'' in the current project run:
+
+          $ {command} GROUP_NAME --region=REGION --fqdn-list=FQDN1,FQDN2
+
+          To create a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          with fqdns ``FQDN1'', ``FQDN2'' and ip ranges ``CIDR1'',``CIDR2'' in
+          the project ``PROJECT_ID'' run:
+
+          $ {command} GROUP_NAME --region=REGION --fqdn-list=FQDN1,FQDN2
+          --ip-range-list=CIDR1,CIDR2 --project=PROJECT_ID
+
+          GROUP_NAME can only contain lower-case letters (a-z) and dashes (-).
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Registers flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddDestGroupArgs(parser)
+    iap_util.AddDestGroupCreateIpAndFqdnArgs(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter
+    """
+    iap_setting_ref = iap_util.ParseIapDestGroupResource(
+        self.ReleaseTrack(), args)
+    return iap_setting_ref.Create(args.ip_range_list, args.fqdn_list)

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/delete.py

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create IAP TCP Destination Group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Delete(base.Command):
+  """Delete the IAP TCP Destination Group resource."""
+  detailed_help = {
+      'EXAMPLES':
+          """\
+          To delete a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          in the current project run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION
+
+          To delete a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          in the project ``PROJECT_ID'' run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --project=PROJECT_ID
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddDestGroupArgs(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter
+    """
+    iap_setting_ref = iap_util.ParseIapDestGroupResource(
+        self.ReleaseTrack(), args)
+    return iap_setting_ref.Delete()

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/describe.py

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create IAP TCP Destination Group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Describe(base.Command):
+  """Describe the IAP TCP Destination Group resource."""
+  detailed_help = {
+      'EXAMPLES':
+          """\
+
+          To get a DestGroup with name ``GROUP_NAME'', in region ``REGION'' in the
+          current project run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION
+
+          To get a DestGroup with name ``GROUP_NAME'', in region ``REGION'' in the
+          project ``PROJECT'' run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --project=PROJECT
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddDestGroupArgs(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter
+    """
+    iap_setting_ref = iap_util.ParseIapDestGroupResource(
+        self.ReleaseTrack(), args)
+    return iap_setting_ref.Get()

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/get_iam_policy.py

@@ -0,0 +1,78 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Get IAM Policy."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class GetIamPolicy(base.ListCommand):
+  """Get IAM policy for an IAP TCP Destination Group resource.
+
+  *{command}* displays the IAM policy associated with an IAP TCP Destination
+  Group resource. If formatted as JSON, the output can be edited and used as a
+  policy  file for set-iam-policy. The output includes an "etag" field
+  identifying the version emitted and allowing detection of concurrent policy
+  updates; see
+  $ {parent_command} set-iam-policy for additional details.
+  """
+  detailed_help = {
+      'EXAMPLES':
+          """\
+          To get the IAM policy for the TCP Destination Group resource with name
+          'my-group' and located in the region 'us-west1' within the active
+          project, run:
+
+            $ {command} --dest-group='my-group' --region='us-west1'
+
+          To get the IAM policy for the TCP Destination Group resource with name
+          'my-group' and located in the region 'us-west1' within project
+          'project', run:
+
+            $ {command} --dest-group='my-group' --region='us-west1'
+            --project='project'
+
+  """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddIamDestGroupArgs(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter.
+    """
+    iap_iam_ref = iap_util.ParseIapDestGroupResource(self.ReleaseTrack(), args)
+    return iap_iam_ref.GetIamPolicy()

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/list.py

@@ -0,0 +1,99 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create IAP TCP Destination Group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class List(base.ListCommand):
+  """Lists the IAP TCP Destination Group resource."""
+  detailed_help = {
+      'EXAMPLES':
+          """\
+
+          To list all Destination Groups in the current project run:
+
+          $ {command}
+
+          To list all Destination Groups in region ``REGION'' in the current
+          project run:
+
+          $ {command} --region=REGION
+
+          To limit the results returned by the server to be at most ``PAGE_SIZE'',
+          run:
+
+          $ {command} --page-size=PAGE_SIZE
+
+          To list at most `5` Destination Groups sorted alphabetically by project
+          ID, run:
+
+          $ {command} --sort-by=projectId --limit=5
+
+          To list all Destination Groups in the project ``PROJECT'' run:
+
+          $ {command} --project=PROJECT
+
+          To list all Destination Groups that have cidr ``CIDR'' run:
+
+          $ {command} --filter="cidrs=CIDR"
+
+          To list all Destination Groups that have FQDN ``FQDN'' run:
+
+          $ {command} --filter="fqdns=FQDN"
+
+          To list all Destination Groups that have name ``NAME'' run:
+
+          $ {command} --filter="name=NAME"
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Registers flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddDestGroupListRegionArgs(parser)
+    # Remove unsupported default List flags.
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: An argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter
+    """
+    iap_setting_ref = iap_util.ParseIapDestGroupResourceWithNoGroupId(
+        self.ReleaseTrack(), args)
+    results_to_yield = iap_setting_ref.List(args.page_size, args.limit)
+    # The List method will return a generator to yield the next values. If we
+    # return it directly, it will work with gcloud but the Displayer class in
+    # calliope won't be able to apply any filters to it.
+    # So we will make it a litst first before returning.
+    return list(results_to_yield)

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/remove_iam_policy_binding.py

@@ -0,0 +1,100 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Remove IAM Policy Binding."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iam import iam_util
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class RemoveIamPolicyBinding(base.Command):
+  """Remove IAM policy binding from an IAP TCP Destination Group resource.
+
+  Removes a policy binding from the IAM policy of an IAP TCP Destination Group
+  resource. One binding consists of a member, a role and an optional condition.
+  """
+  detailed_help = {
+      'EXAMPLES':
+          """\
+
+          To remove an IAM policy binding for the role of
+          'roles/iap.tunnelResourceAccessor' for the user 'test-user@gmail.com'
+          in the group 'my-group' located in the region 'us-west1', run:
+
+            $ {command} --member='user:test-user@gmail.com'
+              --role='roles/iap.tunnelResourceAccessor' --dest-group='my-group'
+              --region='us-west1'
+
+          To remove an IAM policy binding for the role of
+          'roles/iap.tunnelResourceAccessor' from all authenticated users in the
+          group 'my-group' located in the region 'us-west1', run:
+
+            $ {command} --member='allAuthenticatedUsers'
+              --role='roles/iap.tunnelResourceAccessor' --dest-group='my-group'
+              --region='us-west1'
+
+          To remove an IAM policy binding which expires at the end of the year
+          2018 for the role of 'roles/iap.tunnelResourceAccessor' for the user
+          'test-user@gmail.com' in the group 'my-group' located in the region
+          'us-west1', run:
+
+            $ {command} --member='user:test-user@gmail.com'
+              --role='roles/iap.tunnelResourceAccessor'
+              --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018, description=Expires at midnight on 2018-12-31'
+              --dest-group='my-group' --region='us-west1'
+
+          To remove all IAM policy bindings regardless of the condition for the
+          role of 'roles/iap.tunnelResourceAccessor' and for the user
+          'test-user@gmail.com' in the group 'my-group' located in the region
+          'us-west1', run:
+
+            $ {command} --member='user:test-user@gmail.com'
+              --role='roles/iap.tunnelResourceAccessor' --dest-group='my-group'
+              --region='us-west1'
+
+          See https://cloud.google.com/iam/docs/managing-policies for details of
+          policy role and member types.
+  """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Registers flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddRemoveIamPolicyBindingArgs(parser)
+    iap_util.AddIamDestGroupArgs(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """Handles the execution when users run this command.
+
+    Args:
+      args: An argparse namespace. All the arguments that were provided to this
+        command invocation.
+    """
+    condition = iam_util.ValidateAndExtractCondition(args)
+    iap_iam_ref = iap_util.ParseIapDestGroupResource(self.ReleaseTrack(), args)
+    iap_iam_ref.RemoveIamPolicyBinding(args.member, args.role, condition,
+                                       args.all)

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/set_iam_policy.py

@@ -0,0 +1,80 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Set IAM Policy."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class SetIamPolicy(base.Command):
+  """Set the IAM policy for an IAP TCP Destination Group resource.
+
+  This command replaces the existing IAM policy for an IAP TCP Destination Group
+  resource, given a file encoded in JSON or YAML that contains the IAM policy.
+  If the given policy file specifies an "etag" value, then the replacement will
+  succeed only if the policy already in place matches that etag. (An etag
+  obtained via $ {parent_command} get-iam-policy will prevent the replacement if
+  the policy for the resource has been subsequently updated.) A policy file that
+  does not contain an etag value will replace any existing policy for the
+  resource.
+  """
+  detailed_help = {
+      'EXAMPLES':
+          """\
+          To set the IAM policy for the TCP Destination Group resource within
+          the active project in the group 'my-group' located in the region
+          'us-west1', run:
+
+            $ {command} POLICY_FILE  --dest-group=='my-group' --region='us-west1'
+
+          To set the IAM policy for the TCP Destination Group resource within
+          project PROJECT_ID in the group 'my-group' located in the region
+          'us-west1', run:
+
+            $ {command} POLICY_FILE --project=PROJECT_ID --dest-group=='my-group'
+              --region='us-west1'
+  """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Register flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddIAMPolicyFileArg(parser)
+    iap_util.AddIamDestGroupArgs(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter.
+    """
+    iap_iam_ref = iap_util.ParseIapDestGroupResource(self.ReleaseTrack(), args)
+    return iap_iam_ref.SetIamPolicy(args.policy_file)

gcloud auth application-default login/google-cloud-sdk/lib/surface/iap/tcp/dest_groups/update.py

@@ -0,0 +1,98 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create IAP TCP Destination Group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.iap import util as iap_util
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+class Update(base.Command):
+  """Update the IAP TCP Destination Group resource."""
+  detailed_help = {
+      "EXAMPLES":
+          """\
+          To update a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          with ip ranges ``CIDR1'', ``CIDR2'' in the current project run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --ip-range-list=CIDR1,CIDR2
+
+          To update a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          with fqdns ``FQDN1'', ``FQDN2'' in the current project run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --fqdn-list=FQDN1,FQDN2
+
+          To update a DestGroup with name ``GROUP_NAME'', in region ``REGION''
+          with fqdns ``FQDN1'', ``FQDN2'' and ip ranges ``CIDR1'', ``CIDR2'' in
+          the project  ``PROJECT_ID'' run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --fqdn-list=FQDN1,FQDN2
+          --ip-range-list=CIDR1,CIDR2 --project=PROJECT_ID
+
+          To clear the fqdn list in a DestGroup with name ``GROUP_NAME'', in
+          region ``REGION'' in the current project run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --fqdn-list=""
+
+          To clear the ip range list in a DestGroup with name ``GROUP_NAME'', in
+          region ``REGION'' in the current project run:
+
+          $ {command} DEST_GROUP_NAME --region=REGION --ip-range-list=""
+          """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Registers flags for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser-like object. It is mocked out in order
+        to capture some information, but behaves like an ArgumentParser.
+    """
+    iap_util.AddDestGroupArgs(parser)
+    iap_util.AddDestGroupUpdateIpAndFqdnArgs(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      The specified function with its description and configured filter
+    Raises:
+      ValueError: If both ip-range-list and fqdn-list are not provided
+    """
+    iap_setting_ref = iap_util.ParseIapDestGroupResource(
+        self.ReleaseTrack(), args)
+
+    update_mask = ""
+    if args.IsSpecified("ip_range_list") and args.IsSpecified("fqdn_list"):
+      update_mask = "*"
+    elif args.IsSpecified("ip_range_list"):
+      update_mask = "cidrs"
+    elif args.IsSpecified("fqdn_list"):
+      update_mask = "fqdns"
+    else:
+      raise ValueError(
+          "The flags --fqdn-list or --ip-range-list must be provided.")
+    return iap_setting_ref.Update(args.ip_range_list, args.fqdn_list,
+                                  update_mask)