Examples with TestIamPermissionsRequest com.google.api.services.cloudresourcemanager.v3.model.TestIamPermissionsRequest used on opensource projects

Example 1 with TestIamPermissionsRequest

use of com.google.api.services.cloudresourcemanager.v3.model.TestIamPermissionsRequest in project java-docs-samples by GoogleCloudPlatform.

the class TestPermissions method testPermissions.

// Tests if the caller has the listed permissions.
public static void testPermissions(String projectId) {
    // projectId = "my-project-id"
    CloudResourceManager service = null;
    try {
        service = createCloudResourceManagerService();
    } catch (IOException | GeneralSecurityException e) {
        System.out.println("Unable to initialize service: \n" + e.toString());
        return;
    }
    List<String> permissionsList = Arrays.asList("resourcemanager.projects.get", "resourcemanager.projects.delete");
    TestIamPermissionsRequest requestBody = new TestIamPermissionsRequest().setPermissions(permissionsList);
    try {
        TestIamPermissionsResponse testIamPermissionsResponse = service.projects().testIamPermissions(projectId, requestBody).execute();
        System.out.println("Of the permissions listed in the request, the caller has the following: " + testIamPermissionsResponse.getPermissions().toString());
    } catch (IOException e) {
        System.out.println("Unable to test permissions: \n" + e.toString());
    }
}

Example 2 with TestIamPermissionsRequest

use of com.google.api.services.cloudresourcemanager.v3.model.TestIamPermissionsRequest in project terra-workspace-manager by DataBiosphere.

the class ControlledResourceServiceTest method canImpersonateSa.

/**
 * Checks whether the provided IamCow (with credentials) has permission to impersonate a provided
 * service account (via iam.serviceAccounts.actAs permission).
 */
private static boolean canImpersonateSa(ServiceAccountName serviceAccountName, IamCow iam) throws IOException {
    TestIamPermissionsRequest actAsRequest = new TestIamPermissionsRequest().setPermissions(Collections.singletonList("iam.serviceAccounts.actAs"));
    TestIamPermissionsResponse actAsResponse = iam.projects().serviceAccounts().testIamPermissions(serviceAccountName, actAsRequest).execute();
    // response is null instead of an empty list. This is a quirk of GCP.
    return actAsResponse.getPermissions() != null;
}

Example 3 with TestIamPermissionsRequest

use of com.google.api.services.cloudresourcemanager.v3.model.TestIamPermissionsRequest in project terra-workspace-manager by DataBiosphere.

the class EnablePet method canImpersonateSa.

private boolean canImpersonateSa(Iam iamClient, String petSaEmail) throws Exception {
    String fullyQualifiedSaName = String.format("projects/%s/serviceAccounts/%s", projectId, petSaEmail);
    TestIamPermissionsRequest testIamRequest = new TestIamPermissionsRequest().setPermissions(Collections.singletonList("iam.serviceAccounts.actAs"));
    TestIamPermissionsResponse response = iamClient.projects().serviceAccounts().testIamPermissions(fullyQualifiedSaName, testIamRequest).execute();
    // empty list. This is a quirk of the GCP client library.
    return response.getPermissions() != null && response.getPermissions().contains("iam.serviceAccounts.actAs");
}

Example 4 with TestIamPermissionsRequest

use of com.google.api.services.cloudresourcemanager.v3.model.TestIamPermissionsRequest in project terra-cloud-resource-lib by DataBiosphere.

the class IamCowTest method getAndSetAndTestIamOnServiceAccount.

@Test
public void getAndSetAndTestIamOnServiceAccount() throws Exception {
    IamCow.Projects.ServiceAccounts serviceAccounts = defaultIam().projects().serviceAccounts();
    String projectName = "projects/" + reusableProject.getProjectId();
    ServiceAccount serviceAccount = serviceAccounts.create(projectName, new CreateServiceAccountRequest().setAccountId(randomServiceAccountId())).execute();
    ServiceAccountName serviceAccountName = ServiceAccountName.builder().projectId(serviceAccount.getProjectId()).email(serviceAccount.getEmail()).build();
    Policy policy = serviceAccounts.getIamPolicy(serviceAccountName).execute();
    assertNotNull(policy);
    List<Binding> bindingList = new ArrayList<>();
    String member = String.format("serviceAccount:%s", IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail());
    Binding newBinding = new Binding().setRole("roles/iam.serviceAccountUser").setMembers(Collections.singletonList(member));
    bindingList.add(newBinding);
    policy.setBindings(bindingList);
    Policy updatedPolicy = serviceAccounts.setIamPolicy(serviceAccountName, new SetIamPolicyRequest().setPolicy(policy)).execute();
    assertThat(updatedPolicy.getBindings(), hasItem(newBinding));
    assertEquals(updatedPolicy, serviceAccounts.getIamPolicy(serviceAccountName).execute());
    // Test the permissions of the user for which the IAM policy was set.
    IamCow.Projects.ServiceAccounts userIamServiceAccounts = IamCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie()).projects().serviceAccounts();
    // The "actAs" permission associated with "roles/iam.serviceAccountUser".
    String actAsPermission = "iam.serviceAccounts.actAs";
    TestIamPermissionsResponse iamResponse = userIamServiceAccounts.testIamPermissions(serviceAccountName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(actAsPermission))).execute();
    assertThat(iamResponse.getPermissions(), Matchers.contains(actAsPermission));
}

Example 5 with TestIamPermissionsRequest

use of com.google.api.services.cloudresourcemanager.v3.model.TestIamPermissionsRequest in project terra-cloud-resource-lib by DataBiosphere.

the class AIPlatformNotebooksCowTest method setGetTestIamPolicyNotebookInstance.

@Test
public void setGetTestIamPolicyNotebookInstance() throws Exception {
    InstanceName instanceName = defaultInstanceName().instanceId("set-get-iam").build();
    createInstance(instanceName);
    String userEmail = IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail();
    Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("serviceAccount:" + userEmail));
    Policy policy = notebooks.instances().getIamPolicy(instanceName).execute();
    policy.setBindings(ImmutableList.of(binding));
    Policy updatedPolicy = notebooks.instances().setIamPolicy(instanceName, new SetIamPolicyRequest().setPolicy(policy)).execute();
    assertThat(updatedPolicy.getBindings(), Matchers.hasItem(binding));
    Policy secondRetrieval = notebooks.instances().getIamPolicy(instanceName).execute();
    assertThat(secondRetrieval.getBindings(), Matchers.hasItem(binding));
    // Test the permissions of the user for which the IAM policy was set.
    AIPlatformNotebooksCow userNotebooks = AIPlatformNotebooksCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie());
    // Notebook get permission from "roles/notebooks.viewer".
    String getNotebookPermission = "notebooks.instances.get";
    TestIamPermissionsResponse iamResponse = userNotebooks.instances().testIamPermissions(instanceName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(getNotebookPermission))).execute();
    assertThat(iamResponse.getPermissions(), Matchers.contains(getNotebookPermission));
    notebooks.instances().delete(instanceName).execute();
}