Expand description
An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.
A Policy is a collection of bindings. A binding binds one or more
members, or principals, to a single role. Principals can be user
accounts, service accounts, Google groups, and domains (such as G Suite). A
role is a named list of permissions; each role can be an IAM predefined
role or a user-created custom role.
For some types of Google Cloud resources, a binding can also specify a
condition, which is a logical expression that allows access to a resource
only if the expression evaluates to true. A condition can add constraints
based on attributes of the request, the resource, or both. To learn which
resources support conditions in their IAM policies, see the
IAM documentation.
For a description of IAM and its features, see the IAM documentation.
Fields
version: i32Specifies the format of the policy.
Valid values are 0, 1, and 3. Requests that specify an invalid value
are rejected.
Any operation that affects conditional role bindings must specify version
3. This requirement applies to the following operations:
- Getting a policy that includes a conditional role binding
- Adding a conditional role binding to a policy
- Changing a conditional role binding in a policy
- Removing any role binding, with or without a condition, from a policy that includes conditions
Important: If you use IAM Conditions, you must include the etag field
whenever you call setIamPolicy. If you omit this field, then IAM allows
you to overwrite a version 3 policy with a version 1 policy, and all of
the conditions in the version 3 policy are lost.
If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset.
To learn which resources support conditions in their IAM policies, see the IAM documentation.
bindings: Vec<Binding>Associates a list of members, or principals, with a role. Optionally,
may specify a condition that determines how and when the bindings are
applied. Each of the bindings must contain at least one principal.
The bindings in a Policy can refer to up to 1,500 principals; up to 250
of these principals can be Google groups. Each occurrence of a principal
counts towards these limits. For example, if the bindings grant 50
different roles to user:alice@example.com, and not to any other
principal, then you can add another 1,450 principals to the bindings in
the Policy.
etag: StringTrait Implementations
sourceimpl<'de> Deserialize<'de> for Policy
impl<'de> Deserialize<'de> for Policy
sourcefn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
__D: Deserializer<'de>,
fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
__D: Deserializer<'de>,
Deserialize this value from the given Serde deserializer. Read more
sourceimpl PartialEq<Policy> for Policy
impl PartialEq<Policy> for Policy
impl Eq for Policy
impl StructuralEq for Policy
impl StructuralPartialEq for Policy
Auto Trait Implementations
impl RefUnwindSafe for Policy
impl Send for Policy
impl Sync for Policy
impl Unpin for Policy
impl UnwindSafe for Policy
Blanket Implementations
sourceimpl<T> BorrowMut<T> for T where
T: ?Sized,
impl<T> BorrowMut<T> for T where
T: ?Sized,
const: unstable · sourcefn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more
sourceimpl<Q, K> Equivalent<K> for Q where
Q: Eq + ?Sized,
K: Borrow<Q> + ?Sized,
impl<Q, K> Equivalent<K> for Q where
Q: Eq + ?Sized,
K: Borrow<Q> + ?Sized,
sourcefn equivalent(&self, key: &K) -> bool
fn equivalent(&self, key: &K) -> bool
Compare self to key and return true if they are equal.
sourceimpl<T> Instrument for T
impl<T> Instrument for T
sourcefn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
sourcefn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
impl<V, T> VZip<V> for T where
V: MultiLane<T>,
impl<V, T> VZip<V> for T where
V: MultiLane<T>,
fn vzip(self) -> V
sourceimpl<T> WithSubscriber for T
impl<T> WithSubscriber for T
sourcefn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self> where
S: Into<Dispatch>,
fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self> where
S: Into<Dispatch>,
Attaches the provided Subscriber to this type, returning a
WithDispatch wrapper. Read more
sourcefn with_current_subscriber(self) -> WithDispatch<Self>
fn with_current_subscriber(self) -> WithDispatch<Self>
Attaches the current default Subscriber to this type, returning a
WithDispatch wrapper. Read more