FilesExpand file tree

 master

/

quickstart.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

124 lines (93 loc) · 3.68 KB

 master

/

quickstart.py

Copy path

Top

File metadata and controls

• Code
• Blame

124 lines (93 loc) · 3.68 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

#!/usr/bin/env python

#

# Copyright 2020 Google Inc. All Rights Reserved.

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

# [START iam_quickstart]

import os

from google.oauth2 import service_account

import googleapiclient.discovery

def quickstart(project_id, member):

"""Gets a policy, adds a member, prints their permissions, and removes the member."""

# Role to be granted.

role = "roles/logging.logWriter"

# Initializes service.

crm_service = initialize_service()

# Grants your member the 'Log Writer' role for the project.

modify_policy_add_role(crm_service, project_id, role, member)

# Gets the project's policy and prints all members with the 'Log Writer' role.

policy = get_policy(crm_service, project_id)

binding = next(b for b in policy["bindings"] if b["role"] == role)

print(f'Role: {(binding["role"])}')

print("Members: ")

for m in binding["members"]:

print(f'[{m}]')

# Removes the member from the 'Log Writer' role.

modify_policy_remove_member(crm_service, project_id, role, member)

def initialize_service():

"""Initializes a Cloud Resource Manager service."""

credentials = service_account.Credentials.from_service_account_file(

filename=os.environ["GOOGLE_APPLICATION_CREDENTIALS"],

scopes=["https://www.googleapis.com/auth/cloud-platform"],

)

crm_service = googleapiclient.discovery.build(

"cloudresourcemanager", "v1", credentials=credentials

)

return crm_service

def modify_policy_add_role(crm_service, project_id, role, member):

"""Adds a new role binding to a policy."""

policy = get_policy(crm_service, project_id)

binding = None

for b in policy["bindings"]:

if b["role"] == role:

binding = b

break

if binding is not None:

binding["members"].append(member)

else:

binding = {"role": role, "members": [member]}

policy["bindings"].append(binding)

set_policy(crm_service, project_id, policy)

def modify_policy_remove_member(crm_service, project_id, role, member):

"""Removes a member from a role binding."""

policy = get_policy(crm_service, project_id)

binding = next(b for b in policy["bindings"] if b["role"] == role)

if "members" in binding and member in binding["members"]:

binding["members"].remove(member)

set_policy(crm_service, project_id, policy)

def get_policy(crm_service, project_id, version=3):

"""Gets IAM policy for a project."""

policy = (

crm_service.projects()

.getIamPolicy(

resource=project_id,

body={"options": {"requestedPolicyVersion": version}},

)

.execute()

)

return policy

def set_policy(crm_service, project_id, policy):

"""Sets IAM policy for a project."""

policy = (

crm_service.projects()

.setIamPolicy(resource=project_id, body={"policy": policy})

.execute()

)

return policy

if __name__ == '__main__':

# TODO: replace with your project ID

project_id = "your-project-id"

# TODO: Replace with the ID of your member in the form 'user:member@example.com'.

member = "your-member"

quickstart(project_id, member)

# [END iam_quickstart]