com.google.cloud.asset.v1p4beta1

Interface AnalyzeIamPolicyRequest.OptionsOrBuilder

All Superinterfaces:

com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder

All Known Implementing Classes:

AnalyzeIamPolicyRequest.Options, AnalyzeIamPolicyRequest.Options.Builder

Enclosing class:

AnalyzeIamPolicyRequest

public static interface AnalyzeIamPolicyRequest.OptionsOrBuilder
extends com.google.protobuf.MessageOrBuilder

Method Summary

Modifier and Type	Method and Description
boolean	getAnalyzeServiceAccountImpersonation() Optional.
com.google.protobuf.Duration	getExecutionTimeout() Optional.
com.google.protobuf.DurationOrBuilder	getExecutionTimeoutOrBuilder() Optional.
boolean	getExpandGroups() Optional.
boolean	getExpandResources() Optional.
boolean	getExpandRoles() Optional.
boolean	getOutputGroupEdges() Optional.
boolean	getOutputResourceEdges() Optional.
boolean	hasExecutionTimeout() Optional.

Methods inherited from interface com.google.protobuf.MessageOrBuilder

findInitializationErrors, getAllFields, getDefaultInstanceForType, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof

Methods inherited from interface com.google.protobuf.MessageLiteOrBuilder

isInitialized

Method Detail

getExpandGroups

boolean getExpandGroups()

 Optional. If true, the identities section of the result will expand any
 Google groups appearing in an IAM policy binding.
 If [identity_selector][] is specified, the identity in the result will
 be determined by the selector, and this flag will have no effect.
 Default is false.
 

bool expand_groups = 1 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The expandGroups.

getExpandRoles

boolean getExpandRoles()

 Optional. If true, the access section of result will expand any roles
 appearing in IAM policy bindings to include their permissions.
 If [access_selector][] is specified, the access section of the result
 will be determined by the selector, and this flag will have no effect.
 Default is false.
 

bool expand_roles = 2 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The expandRoles.

getExpandResources

boolean getExpandResources()

 Optional. If true, the resource section of the result will expand any
 resource attached to an IAM policy to include resources lower in the
 resource hierarchy.
 For example, if the request analyzes for which resources user A has
 permission P, and the results include an IAM policy with P on a GCP
 folder, the results will also include resources in that folder with
 permission P.
 If [resource_selector][] is specified, the resource section of the result
 will be determined by the selector, and this flag will have no effect.
 Default is false.
 

bool expand_resources = 3 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The expandResources.

getOutputResourceEdges

boolean getOutputResourceEdges()

 Optional. If true, the result will output resource edges, starting
 from the policy attached resource, to any expanded resources.
 Default is false.
 

bool output_resource_edges = 4 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The outputResourceEdges.

getOutputGroupEdges

boolean getOutputGroupEdges()

 Optional. If true, the result will output group identity edges, starting
 from the binding's group members, to any expanded identities.
 Default is false.
 

bool output_group_edges = 5 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The outputGroupEdges.

getAnalyzeServiceAccountImpersonation

boolean getAnalyzeServiceAccountImpersonation()

 Optional. If true, the response will include access analysis from identities to
 resources via service account impersonation. This is a very expensive
 operation, because many derived queries will be executed. We highly
 recommend you use ExportIamPolicyAnalysis rpc instead.
 For example, if the request analyzes for which resources user A has
 permission P, and there's an IAM policy states user A has
 iam.serviceAccounts.getAccessToken permission to a service account SA,
 and there's another IAM policy states service account SA has permission P
 to a GCP folder F, then user A potentially has access to the GCP folder
 F. And those advanced analysis results will be included in
 [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
 Another example, if the request analyzes for who has
 permission P to a GCP folder F, and there's an IAM policy states user A
 has iam.serviceAccounts.actAs permission to a service account SA, and
 there's another IAM policy states service account SA has permission P to
 the GCP folder F, then user A potentially has access to the GCP folder
 F. And those advanced analysis results will be included in
 [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
 Default is false.
 

bool analyze_service_account_impersonation = 6 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The analyzeServiceAccountImpersonation.

hasExecutionTimeout

boolean hasExecutionTimeout()

 Optional. Amount of time executable has to complete.  See JSON representation of
 [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json).
 If this field is set with a value less than the RPC deadline, and the
 execution of your query hasn't finished in the specified
 execution timeout,  you will get a response with partial result.
 Otherwise, your query's execution will continue until the RPC deadline.
 If it's not finished until then, you will get a  DEADLINE_EXCEEDED error.
 Default is empty.
 

.google.protobuf.Duration execution_timeout = 7 [(.google.api.field_behavior) = OPTIONAL];

Returns:

Whether the executionTimeout field is set.

getExecutionTimeout

com.google.protobuf.Duration getExecutionTimeout()

 Optional. Amount of time executable has to complete.  See JSON representation of
 [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json).
 If this field is set with a value less than the RPC deadline, and the
 execution of your query hasn't finished in the specified
 execution timeout,  you will get a response with partial result.
 Otherwise, your query's execution will continue until the RPC deadline.
 If it's not finished until then, you will get a  DEADLINE_EXCEEDED error.
 Default is empty.
 

.google.protobuf.Duration execution_timeout = 7 [(.google.api.field_behavior) = OPTIONAL];

Returns:

The executionTimeout.

getExecutionTimeoutOrBuilder

com.google.protobuf.DurationOrBuilder getExecutionTimeoutOrBuilder()

 Optional. Amount of time executable has to complete.  See JSON representation of
 [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json).
 If this field is set with a value less than the RPC deadline, and the
 execution of your query hasn't finished in the specified
 execution timeout,  you will get a response with partial result.
 Otherwise, your query's execution will continue until the RPC deadline.
 If it's not finished until then, you will get a  DEADLINE_EXCEEDED error.
 Default is empty.
 

.google.protobuf.Duration execution_timeout = 7 [(.google.api.field_behavior) = OPTIONAL];