Skip to content

Commit 9473909

Browse files
awkorentswast
awkoren
authored and
tswast
committed
Add IAM custom roles and access snippets (GoogleCloudPlatform#1692)
* Add IAM custom roles and access snippets * Formatting and license tweaks * Remove trailing whitespace
1 parent ae838c1 commit 9473909

File tree

4 files changed

+464
-0
lines changed

4 files changed

+464
-0
lines changed

‎iam/api-client/access.py

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# !/usr/bin/env python
2+
#
3+
# Copyright 2018 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
"""Demonstrates how to perform basic access management with Google Cloud IAM.
18+
19+
For more information, see the documentation at
20+
https://cloud.google.com/iam/docs/granting-changing-revoking-access.
21+
"""
22+
23+
import argparse
24+
import os
25+
26+
from google.oauth2 import service_account
27+
import googleapiclient.discovery
28+
29+
30+
credentials = service_account.Credentials.from_service_account_file(
31+
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
32+
scopes=['https://www.googleapis.com/auth/cloud-platform'])
33+
service = googleapiclient.discovery.build(
34+
'cloudresourcemanager', 'v1', credentials=credentials)
35+
36+
37+
# [START iam_get_policy]
38+
def get_policy(project_id):
39+
"""Gets IAM policy for a project."""
40+
41+
# pylint: disable=no-member
42+
policy = service.projects().getIamPolicy(
43+
resource=project_id, body={}).execute()
44+
print(policy)
45+
return policy
46+
# [END iam_get_policy]
47+
48+
49+
# [START iam_modify_policy_add_member]
50+
def modify_policy_add_member(policy, role, member):
51+
"""Adds a new member to a role binding."""
52+
binding = next(b for b in policy['bindings'] if b['role'] == role)
53+
binding['members'].append(member)
54+
print(binding)
55+
return policy
56+
# [END iam_modify_policy_add_member]
57+
58+
59+
# [START iam_modify_policy_add_role]
60+
def modify_policy_add_role(policy, role, member):
61+
"""Adds a new role binding to a policy."""
62+
binding = {
63+
'role': role,
64+
'members': [member]
65+
}
66+
policy['bindings'].append(binding)
67+
print(policy)
68+
return policy
69+
# [END iam_modify_policy_add_role]
70+
71+
72+
# [START iam_set_policy]
73+
def set_policy(project_id, policy):
74+
"""Sets IAM policy for a project."""
75+
76+
# pylint: disable=no-member
77+
policy = service.projects().setIamPolicy(
78+
resource=project_id, body={
79+
'policy': policy
80+
}).execute()
81+
print(policy)
82+
return policy
83+
# [END iam_set_policy]
84+
85+
86+
def main():
87+
parser = argparse.ArgumentParser(
88+
description=__doc__,
89+
formatter_class=argparse.RawDescriptionHelpFormatter)
90+
91+
subparsers = parser.add_subparsers(dest='command')
92+
93+
# Get
94+
get_parser = subparsers.add_parser(
95+
'get', help=get_policy.__doc__)
96+
get_parser.add_argument('project_id')
97+
98+
# Modify: add member
99+
modify_member_parser = subparsers.add_parser(
100+
'modify_member', help=get_policy.__doc__)
101+
modify_member_parser.add_argument('project_id')
102+
modify_member_parser.add_argument('role')
103+
modify_member_parser.add_argument('member')
104+
105+
# Modify: add role
106+
modify_role_parser = subparsers.add_parser(
107+
'modify_role', help=get_policy.__doc__)
108+
modify_role_parser.add_argument('project_id')
109+
modify_role_parser.add_argument('project_id')
110+
modify_role_parser.add_argument('role')
111+
modify_role_parser.add_argument('member')
112+
113+
# Set
114+
set_parser = subparsers.add_parser(
115+
'set', help=set_policy.__doc__)
116+
set_parser.add_argument('project_id')
117+
set_parser.add_argument('policy')
118+
119+
args = parser.parse_args()
120+
121+
if args.command == 'get':
122+
get_policy(args.project_id)
123+
elif args.command == 'set':
124+
set_policy(args.project_id, args.policy)
125+
elif args.command == 'add_member':
126+
modify_policy_add_member(args.policy, args.role, args.member)
127+
elif args.command == 'add_binding':
128+
modify_policy_add_role(args.policy, args.role, args.member)
129+
130+
131+
if __name__ == '__main__':
132+
main()

‎iam/api-client/access_test.py

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright 2018 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
import os
16+
17+
import access
18+
19+
20+
def test_access(capsys):
21+
project = os.environ['GCLOUD_PROJECT']
22+
23+
policy = access.get_policy(project)
24+
out, _ = capsys.readouterr()
25+
assert 'etag' in out
26+
27+
policy = access.set_policy(project, policy)
28+
out, _ = capsys.readouterr()
29+
assert 'etag' in out

0 commit comments

Comments
 (0)