# Compute Engine API . hosts

## Instance Methods

Gets the access control policy for a resource. May be empty if no such policy or resource exists.

Sets the access control policy on the specified resource. Replaces any existing policy.

Returns permissions that a caller has on the specified resource.

### Method Details

`getIamPolicy(project, zone, resource)`

    Gets the access control policy for a resource. May be empty if no such policy or resource exists.

    Args:
      project: string, Project ID for this request. (required)
      zone: string, The name of the zone for this request. (required)
      resource: string, Name of the resource for this request. (required)

    Returns:
      An object of the form:

        { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
          #
          #
          #
          # A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM.
          #
          # **Example**
          #
          # { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] }
          #
          # For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam).
        "auditConfigs": [ # Specifies audit logging configs for "data access". "data access": generally refers to data reads/writes and admin reads. "admin activity": generally refers to admin writes.
            #
            # Note: `AuditConfig` doesn't apply to "admin activity", which always enables audit logging.
          { # Enables "data access" audit logging for a service and specifies a list of members that are log-exempted.
            "exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members.
              "A String",
            ],
            "service": "A String", # Specifies a service that will be enabled for "data access" audit logging. For example, `resourcemanager`, `storage`, `compute`. `allServices` is a special value that covers all services.
          },
        ],
        "rules": [ # If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied.
          { # A rule to be applied in a Policy.
            "logConfigs": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
              { # Specifies what kind of log the caller must write
                "counter": { # Options for counters # Counter options.
                  "field": "A String", # The field value to attribute.
                  "metric": "A String", # The metric to update.
                },
              },
            ],
            "notIns": [ # If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.
              "A String",
            ],
            "ins": [ # If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
              "A String",
            ],
            "action": "A String", # Required
            "permissions": [ # A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
              "A String",
            ],
            "conditions": [ # Additional restrictions that must be met
              { # A condition to be met.
                "iam": "A String", # Trusted attributes supplied by the IAM system.
                "svc": "A String", # Trusted attributes discharged by the service.
                "value": "A String", # DEPRECATED. Use 'values' instead.
                "sys": "A String", # Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
                "values": [ # The objects of the condition. This is mutually exclusive with 'value'.
                  "A String",
                ],
                "op": "A String", # An operator to apply the subject with.
              },
            ],
            "description": "A String", # Human-readable description of the rule.
          },
        ],
        "version": 42, # Version of the `Policy`. The default version is 0.
        "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy.
            #
            # If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.
        "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
          { # Associates `members` with a `role`.
            "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
            "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values:
                #
                # * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account.
                #
                # * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account.
                #
                # * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`.
                #
                # * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`.
                #
                # * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`.
                #
                # * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.
              "A String",
            ],
          },
        ],
        "iamOwned": True or False,
      }

`setIamPolicy(project, zone, resource, body)`

    Sets the access control policy on the specified resource. Replaces any existing policy.

    Args:
      project: string, Project ID for this request. (required)
      zone: string, The name of the zone for this request. (required)
      resource: string, Name of the resource for this request. (required)
      body: object, The request body. (required)
        The object takes the form of:

    { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
        #
        #
        #
        # A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM.
        #
        # **Example**
        #
        # { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] }
        #
        # For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam).
      "auditConfigs": [ # Specifies audit logging configs for "data access". "data access": generally refers to data reads/writes and admin reads. "admin activity": generally refers to admin writes.
          #
          # Note: `AuditConfig` doesn't apply to "admin activity", which always enables audit logging.
        { # Enables "data access" audit logging for a service and specifies a list of members that are log-exempted.
          "exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members.
            "A String",
          ],
          "service": "A String", # Specifies a service that will be enabled for "data access" audit logging. For example, `resourcemanager`, `storage`, `compute`. `allServices` is a special value that covers all services.
        },
      ],
      "rules": [ # If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied.
        { # A rule to be applied in a Policy.
          "logConfigs": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
            { # Specifies what kind of log the caller must write
              "counter": { # Options for counters # Counter options.
                "field": "A String", # The field value to attribute.
                "metric": "A String", # The metric to update.
              },
            },
          ],
          "notIns": [ # If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.
            "A String",
          ],
          "ins": [ # If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
            "A String",
          ],
          "action": "A String", # Required
          "permissions": [ # A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
            "A String",
          ],
          "conditions": [ # Additional restrictions that must be met
            { # A condition to be met.
              "iam": "A String", # Trusted attributes supplied by the IAM system.
              "svc": "A String", # Trusted attributes discharged by the service.
              "value": "A String", # DEPRECATED. Use 'values' instead.
              "sys": "A String", # Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
              "values": [ # The objects of the condition. This is mutually exclusive with 'value'.
                "A String",
              ],
              "op": "A String", # An operator to apply the subject with.
            },
          ],
          "description": "A String", # Human-readable description of the rule.
        },
      ],
      "version": 42, # Version of the `Policy`. The default version is 0.
      "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy.
          #
          # If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.
      "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
        { # Associates `members` with a `role`.
          "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
          "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values:
              #
              # * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account.
              #
              # * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account.
              #
              # * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`.
              #
              # * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`.
              #
              # * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`.
              #
              # * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.
            "A String",
          ],
        },
      ],
      "iamOwned": True or False,
    }

    Returns:
      An object of the form:

        { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources.
          #
          #
          #
          # A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM.
          #
          # **Example**
          #
          # { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] }
          #
          # For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam).
        "auditConfigs": [ # Specifies audit logging configs for "data access". "data access": generally refers to data reads/writes and admin reads. "admin activity": generally refers to admin writes.
            #
            # Note: `AuditConfig` doesn't apply to "admin activity", which always enables audit logging.
          { # Enables "data access" audit logging for a service and specifies a list of members that are log-exempted.
            "exemptedMembers": [ # Specifies the identities that are exempted from "data access" audit logging for the `service` specified above. Follows the same format of Binding.members.
              "A String",
            ],
            "service": "A String", # Specifies a service that will be enabled for "data access" audit logging. For example, `resourcemanager`, `storage`, `compute`. `allServices` is a special value that covers all services.
          },
        ],
        "rules": [ # If more than one rule is specified, the rules are applied in the following manner: - All matching LOG rules are always applied. - If any DENY/DENY_WITH_LOG rule matches, permission is denied. Logging will be applied if one or more matching rule requires logging. - Otherwise, if any ALLOW/ALLOW_WITH_LOG rule matches, permission is granted. Logging will be applied if one or more matching rule requires logging. - Otherwise, if no rule applies, permission is denied.
          { # A rule to be applied in a Policy.
            "logConfigs": [ # The config returned to callers of tech.iam.IAM.CheckPolicy for any entries that match the LOG action.
              { # Specifies what kind of log the caller must write
                "counter": { # Options for counters # Counter options.
                  "field": "A String", # The field value to attribute.
                  "metric": "A String", # The metric to update.
                },
              },
            ],
            "notIns": [ # If one or more 'not_in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in none of the entries.
              "A String",
            ],
            "ins": [ # If one or more 'in' clauses are specified, the rule matches if the PRINCIPAL/AUTHORITY_SELECTOR is in at least one of these entries.
              "A String",
            ],
            "action": "A String", # Required
            "permissions": [ # A permission is a string of form '..' (e.g., 'storage.buckets.list'). A value of '*' matches all permissions, and a verb part of '*' (e.g., 'storage.buckets.*') matches all verbs.
              "A String",
            ],
            "conditions": [ # Additional restrictions that must be met
              { # A condition to be met.
                "iam": "A String", # Trusted attributes supplied by the IAM system.
                "svc": "A String", # Trusted attributes discharged by the service.
                "value": "A String", # DEPRECATED. Use 'values' instead.
                "sys": "A String", # Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
                "values": [ # The objects of the condition. This is mutually exclusive with 'value'.
                  "A String",
                ],
                "op": "A String", # An operator to apply the subject with.
              },
            ],
            "description": "A String", # Human-readable description of the rule.
          },
        ],
        "version": 42, # Version of the `Policy`. The default version is 0.
        "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy.
            #
            # If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.
        "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
          { # Associates `members` with a `role`.
            "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
            "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values:
                #
                # * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account.
                #
                # * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account.
                #
                # * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`.
                #
                # * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`.
                #
                # * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`.
                #
                # * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.
              "A String",
            ],
          },
        ],
        "iamOwned": True or False,
      }

`testIamPermissions(project, zone, resource, body)`

    Returns permissions that a caller has on the specified resource.

    Args:
      project: string, Project ID for this request. (required)
      zone: string, The name of the zone for this request. (required)
      resource: string, Name of the resource for this request. (required)
      body: object, The request body. (required)
        The object takes the form of:

    {
        "permissions": [ # The set of permissions to check for the 'resource'. Permissions with wildcards (such as '*' or 'storage.*') are not allowed.
          "A String",
        ],
      }

    Returns:
      An object of the form:

        {
        "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
          "A String",
        ],
      }