feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/__init__.py

@@ -0,0 +1,57 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The command group for the PAM CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA,
+                    base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class Pam(base.Group):
+  r"""Manage Privileged Access Manager (PAM) entitlements and grants.
+
+  The `gcloud pam` command group lets you manage Privileged Access Manager
+  (PAM) entitlements and grants.
+
+  ## EXAMPLES
+
+  To check the PAM onboarding status for a project named `sample-project` and
+  in location `global`, run:
+
+      $ {command} check-onboarding-status --project=sample-project
+      --location=global
+
+  To check the PAM onboarding status for a folder with ID ``FOLDER_ID'' and in
+  location `global`, run:
+
+      $ {command} check-onboarding-status --folder=FOLDER_ID
+      --location=global
+
+  To check the PAM onboarding status for an organization with ID
+  ``ORGANIZATION_ID'' and in location `global`, run:
+
+      $ {command} check-onboarding-status --organization=ORGANIZATION_ID
+      --location=global
+
+  """
+
+  category = base.IDENTITY_AND_SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/check_onboarding_status.yaml

@@ -0,0 +1,41 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Check Privileged Access Manager (PAM) onboarding status for a resource.
+    description: Check Privileged Access Manager (PAM) onboarding status for a project/organization/folder location.
+    examples: |
+      The following command checks the PAM onboarding status for a project named `sample-project`
+      and in location `global`:
+
+      $ {command} --project=sample-project --location=global
+
+      The following command checks the PAM onboarding status for a folder with ID ``FOLDER_ID'' and
+      in location `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global
+
+      The following command checks the PAM onboarding status for an organization with ID
+      ``ORGANIZATION_ID'' and in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: checkOnboardingStatus
+    collection:
+    - privilegedaccessmanager.projects.locations
+    - privilegedaccessmanager.folders.locations
+    - privilegedaccessmanager.organizations.locations
+
+  arguments:
+    resource:
+      arg_name: location
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      is_positional: false
+      help_text: |
+        The project/organization/folder location for which the onboarding status is to be checked.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/__init__.py

@@ -0,0 +1,188 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The command group for the PAM Entitlements CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA,
+                    base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class Entitlements(base.Group):
+  r"""Manage Privileged Access Manager (PAM) entitlements.
+
+  The `gcloud pam entitlements` command group lets you manage Privileged Access
+  Manager (PAM) entitlements.
+
+  ## EXAMPLES
+
+  To create a new entitlement with a name of `sample-entitlement`, in a project
+  named `sample-project`, in location `global`, and the entitlement
+  configuration stored in a file named `sample-entitlement.yaml`, run:
+
+      $ {command} create sample-entitlement --project=sample-project
+      --location=global --entitlement-file=sample-entitlement.yaml
+
+  To create a new entitlement with a name of `sample-entitlement`, in a folder
+  with ID ``FOLDER_ID'', in location `global`, and the entitlement
+  configuration stored in a file named `sample-entitlement.yaml`, run:
+
+      $ {command} create sample-entitlement --folder=FOLDER_ID
+      --location=global --entitlement-file=sample-entitlement.yaml
+
+  To create a new entitlement with a name of `sample-entitlement`, in an
+  organization with ID ``ORGANIZATION_ID'', in location `global`, and the
+  entitlement configuration stored in a file named `sample-entitlement.yaml`,
+  run:
+
+      $ {command} create sample-entitlement --organization=ORGANIZATION_ID
+      --location=global --entitlement-file=sample-entitlement.yaml
+
+  To update an entitlement with a name of `sample-entitlement`, in a project
+  named `sample-project`, in location `global`, and the new entitlement
+  configuration stored in a file named `sample-entitlement.yaml`, run:
+
+      $ {command} update sample-entitlement --project=sample-project
+      --location=global --entitlement-file=sample-entitlement.yaml
+
+  To update an entitlement with a name of `sample-entitlement`, in a folder
+  with ID ``FOLDER_ID'', in location `global`, and the new entitlement
+  configuration stored in a file named `sample-entitlement.yaml`, run:
+
+      $ {command} update sample-entitlement --folder=FOLDER_ID
+      --location=global --entitlement-file=sample-entitlement.yaml
+
+  To update an entitlement with a name of `sample-entitlement`, in an
+  organization with ID ``ORGANIZATION_ID'', in location `global`, and the new
+  entitlement configuration stored in a file named `sample-entitlement.yaml`,
+  run:
+
+      $ {command} update sample-entitlement --organization=ORGANIZATION_ID
+      --location=global --entitlement-file=sample-entitlement.yaml
+
+  To describe an entitlement with a name of `sample-entitlement`, in a project
+  named `sample-project`, and in location `global`, run:
+
+      $ {command} describe sample-entitlement --project=sample-project
+      --location=global
+
+  To describe an entitlement with a name of `sample-entitlement`, in a folder
+  with ID ``FOLDER_ID'', and in location `global`, run:
+
+      $ {command} describe sample-entitlement --folder=FOLDER_ID
+      --location=global
+
+  To describe an entitlement with a name of `sample-entitlement`, in an
+  organization with ID ``ORGANIZATION_ID'', and in location `global`, run:
+
+      $ {command} describe sample-entitlement --organization=ORGANIZATION_ID
+      --location=global
+
+  To search for and list all entitlements for which you are a requester, in a
+  project named `sample-project`, and in location `global`, run:
+
+      $ {command} search --project=sample-project --location=global
+      --caller-access-type=grant-requester
+
+  To search for and list all entitlements for which you are an approver, in a
+  project named `sample-project`, and in location `global`, run:
+
+      $ {command} search --project=sample-project --location=global
+      --caller-access-type=grant-approver
+
+  To search for and list all entitlements for which you are a requester, in a
+  folder with ID ``FOLDER_ID'', and in location `global`, run:
+
+      $ {command} search --folder=FOLDER_ID --location=global
+      --caller-access-type=grant-requester
+
+  To search for and list all entitlements for which you are an approver, in a
+  folder with ID ``FOLDER_ID'', and in location `global`, run:
+
+      $ {command} search --folder=FOLDER_ID --location=global
+      --caller-access-type=grant-approver
+
+  To search for and list all entitlements for which you are a requester, in an
+  organization with ID ``ORGANIZATION_ID'', and in location `global`, run:
+
+      $ {command} search --organization=ORGANIZATION_ID --location=global
+      --caller-access-type=grant-requester
+
+  To search for and list all entitlements for which you are an approver, in an
+  organization with ID ``ORGANIZATION_ID'', and in location `global`, run:
+
+      $ {command} search --organization=ORGANIZATION_ID --location=global
+      --caller-access-type=grant-approver
+
+  To list all entitlements in a project named `sample-project` and in location
+  `global`, run:
+
+      $ {command} list --project=sample-project --location=global
+
+  To list all entitlements in a folder with ID ``FOLDER_ID'' and in location
+  `global`, run:
+
+      $ {command} list --folder=FOLDER_ID --location=global
+
+  To list all entitlements in an organization with ID ``ORGANIZATION_ID'' and
+  in location `global`, run:
+
+      $ {command} list --organization=ORGANIZATION_ID --location=global
+
+  To delete an entitlement with a name of `sample-entitlement`, in a project
+  named `sample-project`, and in location `global`, run:
+
+      $ {command} delete sample-entitlement --project=sample-project
+      --location=global
+
+  To delete an entitlement with a name of `sample-entitlement`, in a folder
+  with ID ``FOLDER_ID'', and in location `global`, run:
+
+      $ {command} delete sample-entitlement --folder=FOLDER_ID
+      --location=global
+
+  To delete an entitlement with a name of `sample-entitlement`, in an
+  organization with ID ``ORGANIZATION_ID'', and in location `global`, run:
+
+      $ {command} delete sample-entitlement --organization=ORGANIZATION_ID
+      --location=global
+
+  To export an entitlement with a name of `sample-entitlement`, in a project
+  named `sample-project`, and in location `global` to a local YAML file named
+  `sample-entitlement.yaml`, run:
+
+      $ {command} export sample-entitlement --project=sample-project
+      --location=global --destination=sample-entitlement.yaml
+
+  To export an entitlement with a name of `sample-entitlement`, in a folder
+  with ID ``FOLDER_ID'', and in location `global` to a local YAML file named
+  `sample-entitlement.yaml`, run:
+
+      $ {command} export sample-entitlement --folder=FOLDER_ID
+      --location=global --destination=sample-entitlement.yaml
+
+  To export an entitlement with a name of `sample-entitlement`, in an
+  organization with ID ``ORGANIZATION_ID'', and in location `global` to a local
+  YAML file named `sample-entitlement.yaml`, run:
+
+      $ {command} export sample-entitlement --organization=ORGANIZATION_ID
+      --location=global --destination=sample-entitlement.yaml
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/create.yaml

@@ -0,0 +1,64 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Create a new Privileged Access Manager (PAM) entitlement.
+    description: Create a new Privileged Access Manager (PAM) entitlement in a project/folder/organization location.
+    examples: |
+      The following command creates a new entitlement with a name of `sample-entitlement`, in a
+      project named `sample-project`, in location `global`, and the entitlement configuration stored
+      in a file named `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --project=sample-project --location=global --entitlement-file=sample-entitlement.yaml
+
+      The following command creates a new entitlement with a name of `sample-entitlement`, in a
+      folder with ID ``FOLDER_ID'', in location `global`, and the entitlement configuration stored
+      in a file named `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --folder=FOLDER_ID --location=global --entitlement-file=sample-entitlement.yaml
+
+      The following command creates a new entitlement with a name of `sample-entitlement`, in an
+      organization with ID ``ORGANIZATION_ID'', in location `global`, and the entitlement
+      configuration stored in a file named `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --organization=ORGANIZATION_ID --location=global --entitlement-file=sample-entitlement.yaml
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.pam.util:ParseEntitlementNameIntoCreateEntitlementRequest
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Name of the entitlement to create.
+    params:
+    - arg_name: entitlement-file
+      api_field: entitlement
+      required: true
+      type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+      processor: googlecloudsdk.core.yaml:load
+      help_text: |
+        YAML file containing the configuration of the entitlement.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  output:
+    format: yaml

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/delete.yaml

@@ -0,0 +1,58 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Delete a Privileged Access Manager (PAM) entitlement.
+    description: |
+      Delete a Privileged Access Manager (PAM) entitlement along with all grants associated with it.
+
+      This command can fail for the following reasons:
+        * There are non-terminal grants under the entitlement.
+    examples: |
+      The following command deletes an entitlement with a name of `sample-entitlement`, in a
+      project named `sample-project`, and in location `global`:
+
+      $ {command} sample-entitlement --project=sample-project --location=global
+
+      The following command deletes an entitlement with a name of `sample-entitlement`, in a folder
+      with ID ``FOLDER_ID'', and in location `global`:
+
+      $ {command} sample-entitlement --folder=FOLDER_ID --location=global
+
+      The following command deletes an entitlement with a name of `sample-entitlement`, in an
+      organization with ID ``ORGANIZATION_ID'', and in location `global`:
+
+      $ {command} sample-entitlement --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.pam.util:SetForceFieldInDeleteEntitlementRequest
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Name of the entitlement to delete.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  input:
+    confirmation_prompt: |
+      All grants associated with the entitlement are also deleted upon deleting the entitlement.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/describe.yaml

@@ -0,0 +1,38 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Show details of a Privileged Access Manager (PAM) entitlement.
+    description: Show details of a Privileged Access Manager (PAM) entitlement.
+    examples: |
+      The following command describes an entitlement with a name of `sample-entitlement`, in a
+      project named `sample-project`, and in location `global`:
+
+      $ {command} sample-entitlement --project=sample-project --location=global
+
+      The following command describes an entitlement with a name of `sample-entitlement`, in a folder
+      with ID ``FOLDER_ID'', and in location `global`:
+
+      $ {command} sample-entitlement --folder=FOLDER_ID --location=global
+
+      The following command describes an entitlement with a name of `sample-entitlement`, in an
+      organization with ID ``ORGANIZATION_ID'', and in location `global`:
+
+      $ {command} sample-entitlement --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Name of the entitlement to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/export.yaml

@@ -0,0 +1,41 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Export a Privileged Access Manager (PAM) entitlement into a local YAML file.
+    description: Export a Privileged Access Manager (PAM) entitlement into a local YAML file.
+    examples: |
+      The following command exports an entitlement with a name of `sample-entitlement`, in a
+      project named `sample-project`, and in location `global` to a local YAML file named
+      `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --project=sample-project --location=global --destination=sample-entitlement.yaml
+
+      The following command exports an entitlement with a name of `sample-entitlement`, in a folder
+      with ID ``FOLDER_ID'', and in location `global` to a local YAML file named
+      `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --folder=FOLDER_ID --location=global --destination=sample-entitlement.yaml
+
+      The following command exports an entitlement with a name of `sample-entitlement`, in an
+      organization with ID ``ORGANIZATION_ID'', and in location `global` to a local YAML file named
+      `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --organization=ORGANIZATION_ID --location=global --destination=sample-entitlement.yaml
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Name of the entitlement to export.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/list.yaml

@@ -0,0 +1,38 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List all Privileged Access Manager (PAM) entitlements under a parent.
+    description: List all Privileged Access Manager (PAM) entitlements in a project/folder/organization location.
+    examples: |
+      The following command lists all entitlements in a project named `sample-project` and in
+      location `global`:
+
+      $ {command} --project=sample-project --location=global
+
+      The following command lists all entitlements in a folder with ID ``FOLDER_ID'' and in
+      location `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global
+
+      The following command lists all entitlements in an organization with ID ``ORGANIZATION_ID''
+      and in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      help_text: |
+        Location of the entitlements.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/search.yaml

@@ -0,0 +1,71 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  command_type: LIST
+
+  help_text:
+    brief: Search and list all Privileged Access Manager (PAM) entitlements in a parent for which you are a requester/approver.
+    description: Search and list all Privileged Access Manager (PAM) entitlements in a project/folder/organization location for which you are a requester/approver.
+    examples: |
+      The following command searches for and lists all entitlements for which you are a requester,
+      in a project named `sample-project`, and in location `global`:
+
+      $ {command} --project=sample-project --location=global --caller-access-type=grant-requester
+
+      The following command searches for and lists all entitlements for which you are an approver,
+      in a project named `sample-project`, and in location `global`:
+
+      $ {command} --project=sample-project --location=global --caller-access-type=grant-approver
+
+      The following command searches for and lists all entitlements for which you are a requester,
+      in a folder with ID ``FOLDER_ID'', and in location `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global --caller-access-type=grant-requester
+
+      The following command searches for and lists all entitlements for which you are an approver,
+      in a folder with ID ``FOLDER_ID'', and in location `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global --caller-access-type=grant-approver
+
+      The following command searches for and lists all entitlements for which you are a requester,
+      in an organization with ID ``ORGANIZATION_ID'', and in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global --caller-access-type=grant-requester
+
+      The following command searches for and lists all entitlements for which you are an approver,
+      in an organization with ID ``ORGANIZATION_ID'', and in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global --caller-access-type=grant-approver
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: search
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+
+  arguments:
+    params:
+    - arg_name: location
+      resource_spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      is_parent_resource: true
+      is_primary_resource: true
+      is_positional: false
+      required: true
+      help_text: |
+        Location of the entitlements.
+    - api_field: callerAccessType
+      arg_name: caller-access-type
+      required: true
+      choices:
+      - arg_value: grant-requester
+        enum_value: GRANT_REQUESTER
+      - arg_value: grant-approver
+        enum_value: GRANT_APPROVER
+      help_text: |
+        Search for entitlements based on whether you are a requester or approver.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/entitlements/update.yaml

@@ -0,0 +1,68 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Update an existing Privileged Access Manager (PAM) entitlement.
+    description: Update an existing Privileged Access Manager (PAM) entitlement.
+    examples: |
+      The following command updates an entitlement with a name of `sample-entitlement`, in a
+      project named `sample-project`, in location `global`, and the new entitlement configuration
+      stored in a file named `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --project=sample-project --location=global --entitlement-file=sample-entitlement.yaml
+
+      The following command updates an entitlement with a name of `sample-entitlement`, in a folder
+      with ID ``FOLDER_ID'', in location `global`, and the new entitlement configuration stored in
+      a file named `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --folder=FOLDER_ID --location=global --entitlement-file=sample-entitlement.yaml
+
+      The following command updates an entitlement with a name of `sample-entitlement`, in an
+      organization with ID ``ORGANIZATION_ID'', in location `global`, and the new entitlement
+      configuration stored in a file named `sample-entitlement.yaml`:
+
+      $ {command} sample-entitlement --organization=ORGANIZATION_ID --location=global --entitlement-file=sample-entitlement.yaml
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements
+    - privilegedaccessmanager.folders.locations.entitlements
+    - privilegedaccessmanager.organizations.locations.entitlements
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.pam.util:SetUpdateMaskInUpdateEntitlementRequest
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Name of the entitlement to update.
+    params:
+    - arg_name: entitlement-file
+      api_field: entitlement
+      required: true
+      type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+      processor: googlecloudsdk.core.yaml:load
+      help_text: |
+        YAML file containing the new configuration of the entitlement.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  output:
+    format: yaml
+
+  input:
+    confirmation_prompt: |
+      Only new grants created against the entitlement are affected by the changes.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/__init__.py

@@ -0,0 +1,155 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The command group for the PAM Grants CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+class AlphaBetaGrants(base.Group):
+  r"""Manage Privileged Access Manager (PAM) grants.
+
+  The `gcloud pam grants` command group lets you manage Privileged Access
+  Manager (PAM) grants.
+
+  ## EXAMPLES
+
+  To create a new grant against an entitlement with the full name
+  ``ENTITLEMENT_NAME'', a requested duration of `1 hour 30 minutes`, a
+  justification of `some justification`, and two additional email recipients
+  `abc@example.com` and `xyz@example.com`, run:
+
+      $ {command} create --entitlement=ENTITLEMENT_NAME
+      --requested-duration=5400s
+      --justification="some justification"
+      --additional-email-recipients=abc@example.com,xyz@example.com
+
+  To describe a grant with the full name ``GRANT_NAME'', run:
+
+      $ {command} describe GRANT_NAME
+
+  To list all grants associated with an entitlement with the full name
+  ``ENTITLEMENT_NAME'', run:
+
+      $ {command} list --entitlement=ENTITLEMENT_NAME
+
+  To deny a grant with the full name ``GRANT_NAME'' and a reason
+  `denial reason`, run:
+
+      $ {command} deny GRANT_NAME --reason="denial reason"
+
+  To approve a grant with the full name ``GRANT_NAME'' and a reason
+  `approval reason`, run:
+
+      $ {command} approve GRANT_NAME --reason="approval reason"
+
+  To revoke a grant with the full name ``GRANT_NAME'' and a reason
+  `revoke reason`, run:
+
+      $ {command} revoke GRANT_NAME --reason="revoke reason"
+
+  To search for and list all grants that you have created that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-created
+
+  To search for and list all grants that you have approved or denied, that are
+  associated with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-approved
+
+  To search for and list all grants that you can approve that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=can-approve
+
+  To withdraw a grant with the full name ``GRANT_NAME'', run:
+
+      $ {command} withdraw GRANT_NAME
+  """
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class GAGrants(AlphaBetaGrants):
+  r"""Manage Privileged Access Manager (PAM) grants.
+
+  The `gcloud pam grants` command group lets you manage Privileged Access
+  Manager (PAM) grants.
+
+  ## EXAMPLES
+
+  To create a new grant against an entitlement with the full name
+  ``ENTITLEMENT_NAME'', a requested duration of `1 hour 30 minutes`, a
+  justification of `some justification`, and two additional email recipients
+  `abc@example.com` and `xyz@example.com`, run:
+
+      $ {command} create --entitlement=ENTITLEMENT_NAME
+      --requested-duration=5400s
+      --justification="some justification"
+      --additional-email-recipients=abc@example.com,xyz@example.com
+
+  To describe a grant with the full name ``GRANT_NAME'', run:
+
+      $ {command} describe GRANT_NAME
+
+  To list all grants associated with an entitlement with the full name
+  ``ENTITLEMENT_NAME'', run:
+
+      $ {command} list --entitlement=ENTITLEMENT_NAME
+
+  To deny a grant with the full name ``GRANT_NAME'' and a reason
+  `denial reason`, run:
+
+      $ {command} deny GRANT_NAME --reason="denial reason"
+
+  To approve a grant with the full name ``GRANT_NAME'' and a reason
+  `approval reason`, run:
+
+      $ {command} approve GRANT_NAME --reason="approval reason"
+
+  To revoke a grant with the full name ``GRANT_NAME'' and a reason
+  `revoke reason`, run:
+
+      $ {command} revoke GRANT_NAME --reason="revoke reason"
+
+  To search for and list all grants that you have created that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-created
+
+  To search for and list all grants that you have approved or denied, that are
+  associated with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-approved
+
+  To search for and list all grants that you can approve that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=can-approve
+
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/approve.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Approve a Privileged Access Manager (PAM) grant.
+    description: Approve a Privileged Access Manager (PAM) grant with a reason.
+    examples: |
+      The following command approves a grant with the full name ``GRANT_NAME'' and a reason
+      of `approval reason`:
+
+      $ {command} GRANT_NAME --reason="approval reason"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: approve
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to approve.
+    params:
+    - api_field: approveGrantRequest.reason
+      arg_name: reason
+      help_text: |
+        Reason for approving the grant.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/create.yaml

@@ -0,0 +1,78 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Create a new Privileged Access Manager (PAM) grant.
+    description: Create a new Privileged Access Manager (PAM) grant under an entitlement.
+    examples: |
+      The following command creates a new grant against the entitlement with the full name
+      ``ENTITLEMENT_NAME'', a requested duration of 1 hour 30 minutes, a justification of
+      `some justification` and two additional email recipients `abc@example.com` and
+      `xyz@example.com`:
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --requested-duration=5400s --justification="some justification" --additional-email-recipients=abc@example.com,xyz@example.com
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.pam.util:SetRequestedPrivilegedAccessInCreateGrantRequest
+    BETA:
+      api_version: v1beta
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.pam.util:SetRequestedPrivilegedAccessInCreateGrantRequest
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    params:
+    - arg_name: entitlement
+      resource_spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      is_parent_resource: true
+      is_primary_resource: true
+      is_positional: false
+      required: true
+      help_text: |
+        Entitlement the grant is to be created against.
+    - arg_name: requested-duration
+      api_field: grant.requestedDuration
+      required: true
+      help_text: |
+        Duration of the grant being created.
+    - arg_name: justification
+      api_field: grant.justification.unstructuredJustification
+      help_text: |
+        Justification for the grant.
+    - arg_name: additional-email-recipients
+      api_field: grant.additionalEmailRecipients
+      repeated: true
+      help_text: |
+        Additional email addresses that are notified for all actions performed on the grant.
+    # Group for grant scope selection.
+    - group:
+        release_tracks: [ALPHA, BETA]
+        mutex: true
+        help_text: |
+          Specify the grant's scope using either high-level resource or a fine-grained scope
+          configuration.
+        params:
+        - arg_name: requested-resources
+          type: 'googlecloudsdk.calliope.arg_parsers:ArgList:'
+          help_text: |
+            The Google Cloud resources to be granted access to.
+            Format: `{resource-type}/{resource_id}`.
+            Example: `projects/{project_id}` or `folders/{folder_id}` or
+            `organizations/{organization_id}`.
+            This command currently accepts only one resource.
+        - arg_name: requested-access-from-file
+          api_field: grant.requestedPrivilegedAccess
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+          processor: googlecloudsdk.command_lib.pam.util:LoadGrantScopeFromYaml
+          help_text: |
+            Path to a YAML file defining the fine-grained scope for the grant.
+
+  output:
+    format: yaml

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/deny.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Deny a Privileged Access Manager (PAM) grant.
+    description: Deny a Privileged Access Manager (PAM) grant with a reason.
+    examples: |
+      The following command denies a grant with the full name ``GRANT_NAME'' and a reason
+      of `denial reason`:
+
+      $ {command} GRANT_NAME --reason="denial reason"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: deny
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to deny.
+    params:
+    - api_field: denyGrantRequest.reason
+      arg_name: reason
+      help_text: |
+        Reason for denying the grant.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Show details of a Privileged Access Manager (PAM) grant.
+    description: Show details of a Privileged Access Manager (PAM) grant.
+    examples: |
+      The following command describes a grant with the full name ``GRANT_NAME'':
+
+      $ {command} GRANT_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/list.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List all Privileged Access Manager (PAM) grants associated with an entitlement.
+    description: List all Privileged Access Manager (PAM) grants associated with an entitlement.
+    examples: |
+      The following command lists all grants associated with an entitlement with the full name
+      ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Entitlement the grants are associated with.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/revoke.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Revoke a Privileged Access Manager (PAM) grant.
+    description: Revoke a Privileged Access Manager (PAM) grant with a reason.
+    examples: |
+      The following command revokes a grant with the full name ``GRANT_NAME'' and a reason of
+      `revoke reason`:
+
+      $ {command} GRANT_NAME --reason="revoke reason"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: revoke
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to revoke.
+    params:
+    - api_field: revokeGrantRequest.reason
+      arg_name: reason
+      help_text: |
+        Reason for revoking the grant.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/search.yaml

@@ -0,0 +1,58 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  command_type: LIST
+
+  help_text:
+    brief: Search for and list all Privileged Access Manager (PAM) grants you have created, have approved, or can approve.
+    description: Search for and list all Privileged Access Manager (PAM) grants you have created, have approved, or can approve.
+    examples: |
+      The following command searches for and lists all grants you have created which are associated
+      with an entitlement with the full name ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --caller-relationship=had-created
+
+      The following command searches for and lists all grants you have approved or denied which are
+      associated with an entitlement with the full name ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --caller-relationship=had-approved
+
+      The following command searches for and lists all grants you can approve which are associated
+      with an entitlement with the full name ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --caller-relationship=can-approve
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: search
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    params:
+    - arg_name: entitlement
+      resource_spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      is_parent_resource: true
+      is_primary_resource: true
+      is_positional: false
+      required: true
+      help_text: |
+        Entitlement the grants are associated with.
+    - api_field: callerRelationship
+      arg_name: caller-relationship
+      required: true
+      choices:
+      - arg_value: had-created
+        enum_value: HAD_CREATED
+      - arg_value: had-approved
+        enum_value: HAD_APPROVED
+      - arg_value: can-approve
+        enum_value: CAN_APPROVE
+      help_text: |
+        Whether to return grants you have created, have approved, or can approve.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/withdraw.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Withdraw a Privileged Access Manager (PAM) grant.
+    description: Withdraw a Privileged Access Manager (PAM) grant.
+    examples: |
+      The following command withdraws a grant with the full name ``GRANT_NAME'':
+
+      $ {command} GRANT_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    method: withdraw
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to withdraw.
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.pam.util:FormatWithdrawResponse

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/operations/__init__.py

@@ -0,0 +1,64 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The command group for the PAM Operations CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA,
+                    base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class Operations(base.Group):
+  r"""Manage Privileged Access Manager (PAM) Long Running Operations.
+
+  The `gcloud pam operations` command group lets you manage Privileged
+  Access Manager (PAM) operations.
+
+  ## EXAMPLES
+
+  To describe an operation with the full name ``OPERATION_NAME'', run:
+
+      $ {command} describe OPERATION_NAME
+
+  To list all operations in a project named `sample-project` and in location
+  `global`, run:
+
+      $ {command} list --project=sample-project --location=global
+
+  To list all operations in a folder with ID ``FOLDER_ID'' and in location
+  `global`, run:
+
+      $ {command} list --folder=FOLDER_ID --location=global
+
+  To list all operations in an organization with ID ``ORGANIZATION_ID'' and in
+  location `global`, run:
+
+      $ {command} list --organization=ORGANIZATION_ID --location=global
+
+  To delete an operation with the full name ``OPERATION_NAME'', run:
+
+      $ {command} delete OPERATION_NAME
+
+  To poll an operation with the full name ``OPERATION_NAME'', run:
+
+      $ {command} wait OPERATION_NAME
+
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/operations/delete.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Delete a Privileged Access Manager (PAM) long running operation.
+    description: Delete a Privileged Access Manager (PAM) long running operation.
+    examples: |
+      The following command deletes an operation with the full name ``OPERATION_NAME'':
+
+      $ {command} OPERATION_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:operation
+      help_text: |
+        Name of the operation to delete.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/operations/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Show details of a Privileged Access Manager (PAM) long running operation.
+    description: Show details of a Privileged Access Manager (PAM) long running operation.
+    examples: |
+      The following command describes an operation with the full name ``OPERATION_NAME'':
+
+      $ {command} OPERATION_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:operation
+      help_text: |
+        Name of the operation to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/operations/list.yaml

@@ -0,0 +1,38 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List all Privileged Access Manager (PAM) long running operations under a location.
+    description: List all Privileged Access Manager (PAM) long running operations under a project/folder/organization location.
+    examples: |
+      The following command lists all operations in a project named `sample-project` and in
+      location `global`:
+
+      $ {command} --project=sample-project --location=global
+
+      The following command lists all operations in a folder with ID ``FOLDER_ID'' and in location
+      `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global
+
+      The following command lists all operations in an organization with ID ``ORGANIZATION_ID'' and
+      in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      help_text: |
+        Location of the operations.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/operations/wait.yaml

@@ -0,0 +1,37 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Poll a Privileged Access Manager (PAM) long running operation.
+    description: Poll a Privileged Access Manager (PAM) long running operation until it completes and then display its result.
+    examples: |
+      The following command polls an operation with the full name ``OPERATION_NAME'':
+
+      $ {command} OPERATION_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:operation
+      help_text: |
+        Name of the operation to poll.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/settings/__init__.py

@@ -0,0 +1,107 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The command group for the PAM Settings CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+class Settings(base.Group):
+  r"""Manage Privileged Access Manager (PAM) Settings.
+
+  The `gcloud pam settings` command group lets you manage Privileged
+  Access Manager (PAM) settings.
+
+  ## EXAMPLES
+
+  To describe the PAM Settings on a project named `sample-project` and
+  in location `global`, run:
+
+      $ {command} describe --project=sample-project --location=global
+
+  To describe the PAM Settings on a folder with ID ``FOLDER_ID'' and in
+  location `global`, run:
+
+      $ {command} describe --folder=FOLDER_ID --location=global
+
+  To describe the PAM Settings on an organization with ID ``ORGANIZATION_ID''
+  and in location `global`, run:
+
+      $ {command} describe --organization=ORGANIZATION_ID --location=global
+
+  To describe the effective PAM Settings on a project named `sample-project` and
+  in location `global`, run:
+
+      $ {command} describe-effective --project=sample-project --location=global
+
+  To describe the effective PAM Settings on a folder with ID ``FOLDER_ID'' and
+  in location `global`, run:
+
+      $ {command} describe-effective --folder=FOLDER_ID --location=global
+
+  To describe the effective PAM Settings on an organization with ID
+  ``ORGANIZATION_ID'' and in location `global`, run:
+
+      $ {command} describe-effective --organization=ORGANIZATION_ID
+      --location=global
+
+  To export the PAM Settings configured on a project named `sample-project`,
+  and in location `global` to a local YAML file named
+  `pam-settings.yaml`, run:
+
+      $ {command} export --project=sample-project --location=global
+      --destination=pam-settings.yaml
+
+  To export the PAM Settings configured on a folder with ID ``FOLDER_ID'', and
+  in location `global` to a local YAML file named
+  `pam-settings.yaml`, run:
+
+      $ {command} export --folder=FOLDER_ID --location=global
+      --destination=pam-settings.yaml
+
+  To export the PAM settings configured for an organization with ID
+  `ORGANIZATION_ID` in location `global` to a local YAML file named
+  `pam-settings.yaml`, run:
+
+      $ {command} export --organization=ORGANIZATION_ID --location=global
+        --destination=pam-settings.yaml
+
+  To update the PAM Settings on a project named `sample-project` and in
+  location `global`, and the new updated settings configuration stored in a file
+  named `pam-settings.yaml`, run:
+
+      $ {command} update --project=sample-project --location=global
+      --settings-file=pam-settings.yaml
+
+  To update the PAM Settings on a folder with ID ``FOLDER_ID'' and in location
+  `global`, and the new updated settings configuration stored in a file named
+  `pam-settings.yaml`, run:
+
+      $ {command} update --folder=FOLDER_ID --location=global
+      --settings-file=pam-settings.yaml
+
+  To update the PAM Settings on an organization with ID ``ORGANIZATION_ID'' and
+  in location `global`, and the new updated settings configuration stored in a
+  file named `pam-settings.yaml`, run:
+
+      $ {command} update --organization=ORGANIZATION_ID --location=global
+      --settings-file=pam-settings.yaml
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/settings/describe.yaml

@@ -0,0 +1,39 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Show details of Privileged Access Manager (PAM) settings on a resource.
+    description: Show details of Privileged Access Manager (PAM) settings on a resource.
+    examples: |
+      The following command describes settings on a project named `sample-project`, and in location
+      `global`:
+
+      $ {command} --project=sample-project --location=global
+
+      The following command describes settings on a folder with ID ``FOLDER_ID'', and in location
+      `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global
+
+      The following command describes settings on an organization with ID ``ORGANIZATION_ID'', and
+      in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    method: getSettings
+    collection:
+    - privilegedaccessmanager.projects.locations
+    - privilegedaccessmanager.folders.locations
+    - privilegedaccessmanager.organizations.locations
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.pam.util:UpdateSettingsResource
+  arguments:
+    resource:
+      arg_name: location
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      is_positional: false
+      help_text: |
+        The project/organization/folder location for which the settings are to be described.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/settings/describe_effective.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Show effective Privileged Access Manager (PAM) settings on a resource.
+    description: |
+      Show effective Privileged Access Manager (PAM) settings on a resource. The "effective value"
+      of a setting on a given resource refers to the final or active value of a setting
+      configuration that is applied to a resource.  For each configuration type field in settings
+      resource, a hierarchy evaluation will happen to calculate effective value on the resource
+      node.
+    examples: |
+      The following command describes effective settings on a project named `sample-project`, and
+      in location `global`:
+
+      $ {command} --project=sample-project --location=global
+
+      The following command describes effective settings on a folder with ID ``FOLDER_ID'', and in
+      location `global`:
+
+      $ {command} --folder=FOLDER_ID --location=global
+
+      The following command describes effective settings on an organization with ID
+      ``ORGANIZATION_ID'', and in location `global`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    method: fetchEffectiveSettings
+    collection:
+    - privilegedaccessmanager.projects.locations
+    - privilegedaccessmanager.folders.locations
+    - privilegedaccessmanager.organizations.locations
+
+  arguments:
+    resource:
+      arg_name: location
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      is_positional: false
+      help_text: |
+        The project/organization/folder location for which the effective settings are to be
+        described.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/settings/export.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: |
+      Export Privileged Access Manager (PAM) settings configured on a project, folder, or
+      organization to a local YAML file.
+    description: |
+      Export the Privileged Access Manager (PAM) settings configured for a specified project,
+      folder, or organization to a local YAML file.
+    examples: |
+      The following command exports PAM settings for the project named `sample-project` in location
+      `global` to a local YAML file named `pam-settings.yaml`:
+
+      $ {command} --project=sample-project --location=global --destination=pam-settings.yaml
+
+      The following command exports PAM settings for the folder with ID `FOLDER_ID` in location
+      `global` to a local YAML file named `pam-settings.yaml`:
+
+      $ {command} --folder=FOLDER_ID --location=global --destination=pam-settings.yaml
+
+      The following command exports PAM settings for the organization with ID `ORGANIZATION_ID` in
+      location `global` to a local YAML file named `pam-settings.yaml`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global --destination=pam-settings.yaml
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    method: getSettings
+    collection:
+    - privilegedaccessmanager.projects.locations
+    - privilegedaccessmanager.folders.locations
+    - privilegedaccessmanager.organizations.locations
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.pam.util:UpdateSettingsResource
+
+  arguments:
+    resource:
+      arg_name: location
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      is_positional: false
+      help_text: |
+        The project/organization/folder location for which the settings needs to be exported.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/settings/update.yaml

@@ -0,0 +1,65 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Update Privileged Access Manager (PAM) settings configured on a project, folder, or organization.
+    description: |
+      Update the Privileged Access Manager (PAM) settings configured for a specified project,
+      folder, or organization. This command allows you to modify the settings using a YAML file.
+    examples: |
+      The following command updates PAM settings for the project named `sample-project` in location
+      `global`, using the settings defined in a file named `pam_settings.yaml`:
+
+      $ {command} --project=sample-project --location=global --settings-file=pam_settings.yaml
+
+      The following command updates PAM settings for the folder with ID `FOLDER_ID` in location
+      `global`, using the settings defined in a file named `pam_settings.yaml`:
+
+      $ {command} --folder=FOLDER_ID --location=global --settings-file=pam_settings.yaml
+
+      The following command updates PAM settings for the organization with ID `ORGANIZATION_ID`
+      in location `global`, using the settings defined in a file named `pam_settings.yaml`:
+
+      $ {command} --organization=ORGANIZATION_ID --location=global --settings-file=pam_settings.yaml
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    method: updateSettings
+    collection:
+    - privilegedaccessmanager.projects.locations
+    - privilegedaccessmanager.folders.locations
+    - privilegedaccessmanager.organizations.locations
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.pam.util:SetUpdateMaskInUpdateSettingsRequest
+    - googlecloudsdk.command_lib.pam.util:UpdateSettingsResource
+
+  arguments:
+    resource:
+      arg_name: location
+      is_positional: false
+      spec: !REF googlecloudsdk.command_lib.pam.resources:location
+      help_text: |
+        The project/organization/folder location for which the settings are to be updated.
+
+    params:
+    - arg_name: settings-file
+      api_field: settings
+      required: true
+      type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+      processor: googlecloudsdk.core.yaml:load
+      help_text: |
+        YAML file containing the new configuration of the PAM settings.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations
+    extract_resource_result: false
+    result_attribute: response
+
+  output:
+    format: yaml