feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/__init__.py

@@ -0,0 +1,155 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The command group for the PAM Grants CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA)
+@base.UniverseCompatible
+class AlphaBetaGrants(base.Group):
+  r"""Manage Privileged Access Manager (PAM) grants.
+
+  The `gcloud pam grants` command group lets you manage Privileged Access
+  Manager (PAM) grants.
+
+  ## EXAMPLES
+
+  To create a new grant against an entitlement with the full name
+  ``ENTITLEMENT_NAME'', a requested duration of `1 hour 30 minutes`, a
+  justification of `some justification`, and two additional email recipients
+  `abc@example.com` and `xyz@example.com`, run:
+
+      $ {command} create --entitlement=ENTITLEMENT_NAME
+      --requested-duration=5400s
+      --justification="some justification"
+      --additional-email-recipients=abc@example.com,xyz@example.com
+
+  To describe a grant with the full name ``GRANT_NAME'', run:
+
+      $ {command} describe GRANT_NAME
+
+  To list all grants associated with an entitlement with the full name
+  ``ENTITLEMENT_NAME'', run:
+
+      $ {command} list --entitlement=ENTITLEMENT_NAME
+
+  To deny a grant with the full name ``GRANT_NAME'' and a reason
+  `denial reason`, run:
+
+      $ {command} deny GRANT_NAME --reason="denial reason"
+
+  To approve a grant with the full name ``GRANT_NAME'' and a reason
+  `approval reason`, run:
+
+      $ {command} approve GRANT_NAME --reason="approval reason"
+
+  To revoke a grant with the full name ``GRANT_NAME'' and a reason
+  `revoke reason`, run:
+
+      $ {command} revoke GRANT_NAME --reason="revoke reason"
+
+  To search for and list all grants that you have created that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-created
+
+  To search for and list all grants that you have approved or denied, that are
+  associated with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-approved
+
+  To search for and list all grants that you can approve that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=can-approve
+
+  To withdraw a grant with the full name ``GRANT_NAME'', run:
+
+      $ {command} withdraw GRANT_NAME
+  """
+
+
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.UniverseCompatible
+class GAGrants(AlphaBetaGrants):
+  r"""Manage Privileged Access Manager (PAM) grants.
+
+  The `gcloud pam grants` command group lets you manage Privileged Access
+  Manager (PAM) grants.
+
+  ## EXAMPLES
+
+  To create a new grant against an entitlement with the full name
+  ``ENTITLEMENT_NAME'', a requested duration of `1 hour 30 minutes`, a
+  justification of `some justification`, and two additional email recipients
+  `abc@example.com` and `xyz@example.com`, run:
+
+      $ {command} create --entitlement=ENTITLEMENT_NAME
+      --requested-duration=5400s
+      --justification="some justification"
+      --additional-email-recipients=abc@example.com,xyz@example.com
+
+  To describe a grant with the full name ``GRANT_NAME'', run:
+
+      $ {command} describe GRANT_NAME
+
+  To list all grants associated with an entitlement with the full name
+  ``ENTITLEMENT_NAME'', run:
+
+      $ {command} list --entitlement=ENTITLEMENT_NAME
+
+  To deny a grant with the full name ``GRANT_NAME'' and a reason
+  `denial reason`, run:
+
+      $ {command} deny GRANT_NAME --reason="denial reason"
+
+  To approve a grant with the full name ``GRANT_NAME'' and a reason
+  `approval reason`, run:
+
+      $ {command} approve GRANT_NAME --reason="approval reason"
+
+  To revoke a grant with the full name ``GRANT_NAME'' and a reason
+  `revoke reason`, run:
+
+      $ {command} revoke GRANT_NAME --reason="revoke reason"
+
+  To search for and list all grants that you have created that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-created
+
+  To search for and list all grants that you have approved or denied, that are
+  associated with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=had-approved
+
+  To search for and list all grants that you can approve that are associated
+  with an entitlement with the full name ``ENTITLEMENT_NAME'', run:
+
+      $ {command} search --entitlement=ENTITLEMENT_NAME
+      --caller-relationship=can-approve
+
+  """

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/approve.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Approve a Privileged Access Manager (PAM) grant.
+    description: Approve a Privileged Access Manager (PAM) grant with a reason.
+    examples: |
+      The following command approves a grant with the full name ``GRANT_NAME'' and a reason
+      of `approval reason`:
+
+      $ {command} GRANT_NAME --reason="approval reason"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: approve
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to approve.
+    params:
+    - api_field: approveGrantRequest.reason
+      arg_name: reason
+      help_text: |
+        Reason for approving the grant.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/create.yaml

@@ -0,0 +1,78 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Create a new Privileged Access Manager (PAM) grant.
+    description: Create a new Privileged Access Manager (PAM) grant under an entitlement.
+    examples: |
+      The following command creates a new grant against the entitlement with the full name
+      ``ENTITLEMENT_NAME'', a requested duration of 1 hour 30 minutes, a justification of
+      `some justification` and two additional email recipients `abc@example.com` and
+      `xyz@example.com`:
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --requested-duration=5400s --justification="some justification" --additional-email-recipients=abc@example.com,xyz@example.com
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.pam.util:SetRequestedPrivilegedAccessInCreateGrantRequest
+    BETA:
+      api_version: v1beta
+      modify_request_hooks:
+      - googlecloudsdk.command_lib.pam.util:SetRequestedPrivilegedAccessInCreateGrantRequest
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    params:
+    - arg_name: entitlement
+      resource_spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      is_parent_resource: true
+      is_primary_resource: true
+      is_positional: false
+      required: true
+      help_text: |
+        Entitlement the grant is to be created against.
+    - arg_name: requested-duration
+      api_field: grant.requestedDuration
+      required: true
+      help_text: |
+        Duration of the grant being created.
+    - arg_name: justification
+      api_field: grant.justification.unstructuredJustification
+      help_text: |
+        Justification for the grant.
+    - arg_name: additional-email-recipients
+      api_field: grant.additionalEmailRecipients
+      repeated: true
+      help_text: |
+        Additional email addresses that are notified for all actions performed on the grant.
+    # Group for grant scope selection.
+    - group:
+        release_tracks: [ALPHA, BETA]
+        mutex: true
+        help_text: |
+          Specify the grant's scope using either high-level resource or a fine-grained scope
+          configuration.
+        params:
+        - arg_name: requested-resources
+          type: 'googlecloudsdk.calliope.arg_parsers:ArgList:'
+          help_text: |
+            The Google Cloud resources to be granted access to.
+            Format: `{resource-type}/{resource_id}`.
+            Example: `projects/{project_id}` or `folders/{folder_id}` or
+            `organizations/{organization_id}`.
+            This command currently accepts only one resource.
+        - arg_name: requested-access-from-file
+          api_field: grant.requestedPrivilegedAccess
+          type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+          processor: googlecloudsdk.command_lib.pam.util:LoadGrantScopeFromYaml
+          help_text: |
+            Path to a YAML file defining the fine-grained scope for the grant.
+
+  output:
+    format: yaml

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/deny.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Deny a Privileged Access Manager (PAM) grant.
+    description: Deny a Privileged Access Manager (PAM) grant with a reason.
+    examples: |
+      The following command denies a grant with the full name ``GRANT_NAME'' and a reason
+      of `denial reason`:
+
+      $ {command} GRANT_NAME --reason="denial reason"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: deny
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to deny.
+    params:
+    - api_field: denyGrantRequest.reason
+      arg_name: reason
+      help_text: |
+        Reason for denying the grant.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Show details of a Privileged Access Manager (PAM) grant.
+    description: Show details of a Privileged Access Manager (PAM) grant.
+    examples: |
+      The following command describes a grant with the full name ``GRANT_NAME'':
+
+      $ {command} GRANT_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to describe.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/list.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List all Privileged Access Manager (PAM) grants associated with an entitlement.
+    description: List all Privileged Access Manager (PAM) grants associated with an entitlement.
+    examples: |
+      The following command lists all grants associated with an entitlement with the full name
+      ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      help_text: |
+        Entitlement the grants are associated with.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/revoke.yaml

@@ -0,0 +1,44 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Revoke a Privileged Access Manager (PAM) grant.
+    description: Revoke a Privileged Access Manager (PAM) grant with a reason.
+    examples: |
+      The following command revokes a grant with the full name ``GRANT_NAME'' and a reason of
+      `revoke reason`:
+
+      $ {command} GRANT_NAME --reason="revoke reason"
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: revoke
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to revoke.
+    params:
+    - api_field: revokeGrantRequest.reason
+      arg_name: reason
+      help_text: |
+        Reason for revoking the grant.
+
+  async:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    collection:
+    - privilegedaccessmanager.projects.locations.operations
+    - privilegedaccessmanager.folders.locations.operations
+    - privilegedaccessmanager.organizations.locations.operations

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/search.yaml

@@ -0,0 +1,58 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  command_type: LIST
+
+  help_text:
+    brief: Search for and list all Privileged Access Manager (PAM) grants you have created, have approved, or can approve.
+    description: Search for and list all Privileged Access Manager (PAM) grants you have created, have approved, or can approve.
+    examples: |
+      The following command searches for and lists all grants you have created which are associated
+      with an entitlement with the full name ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --caller-relationship=had-created
+
+      The following command searches for and lists all grants you have approved or denied which are
+      associated with an entitlement with the full name ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --caller-relationship=had-approved
+
+      The following command searches for and lists all grants you can approve which are associated
+      with an entitlement with the full name ``ENTITLEMENT_NAME'':
+
+      $ {command} --entitlement=ENTITLEMENT_NAME --caller-relationship=can-approve
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    GA:
+      api_version: v1
+    method: search
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    params:
+    - arg_name: entitlement
+      resource_spec: !REF googlecloudsdk.command_lib.pam.resources:entitlement
+      is_parent_resource: true
+      is_primary_resource: true
+      is_positional: false
+      required: true
+      help_text: |
+        Entitlement the grants are associated with.
+    - api_field: callerRelationship
+      arg_name: caller-relationship
+      required: true
+      choices:
+      - arg_value: had-created
+        enum_value: HAD_CREATED
+      - arg_value: had-approved
+        enum_value: HAD_APPROVED
+      - arg_value: can-approve
+        enum_value: CAN_APPROVE
+      help_text: |
+        Whether to return grants you have created, have approved, or can approve.

gcloud auth application-default login/google-cloud-sdk/lib/surface/pam/grants/withdraw.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA]
+  help_text:
+    brief: Withdraw a Privileged Access Manager (PAM) grant.
+    description: Withdraw a Privileged Access Manager (PAM) grant.
+    examples: |
+      The following command withdraws a grant with the full name ``GRANT_NAME'':
+
+      $ {command} GRANT_NAME
+
+  request:
+    ALPHA:
+      api_version: v1alpha
+    BETA:
+      api_version: v1beta
+    method: withdraw
+    collection:
+    - privilegedaccessmanager.projects.locations.entitlements.grants
+    - privilegedaccessmanager.folders.locations.entitlements.grants
+    - privilegedaccessmanager.organizations.locations.entitlements.grants
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.pam.resources:grant
+      help_text: |
+        Name of the grant to withdraw.
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.pam.util:FormatWithdrawResponse