use of com.google.api.services.healthcare.v1.model.Binding in project terra-workspace-manager by DataBiosphere.
the class GrantWsmRoleAdminStep method doStep.
@Override
public StepResult doStep(FlightContext context) throws InterruptedException, RetryException {
String wsmSaEmail = GcpUtils.getWsmSaEmail(crlService.getApplicationCredentials());
String projectId = context.getWorkingMap().get(WorkspaceFlightMapKeys.GCP_PROJECT_ID, String.class);
try {
Policy policy = crlService.getCloudResourceManagerCow().projects().getIamPolicy(projectId, new GetIamPolicyRequest()).execute();
Binding bindingToAdd = new Binding().setMembers(Collections.singletonList("serviceAccount:" + wsmSaEmail)).setRole("roles/iam.roleAdmin");
List<Binding> bindingList = policy.getBindings();
bindingList.add(bindingToAdd);
policy.setBindings(bindingList);
SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(policy);
crlService.getCloudResourceManagerCow().projects().setIamPolicy(projectId, iamPolicyRequest).execute();
} catch (IOException e) {
throw new InternalServerErrorException("Error while granting WSM SA the Role Admin role", e);
}
return StepResult.getStepResultSuccess();
}
use of com.google.api.services.healthcare.v1.model.Binding in project terra-cloud-resource-lib by DataBiosphere.
the class AIPlatformNotebooksCowTest method setGetTestIamPolicyNotebookInstance.
@Test
public void setGetTestIamPolicyNotebookInstance() throws Exception {
InstanceName instanceName = defaultInstanceName().instanceId("set-get-iam").build();
createInstance(instanceName);
String userEmail = IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail();
Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("serviceAccount:" + userEmail));
Policy policy = notebooks.instances().getIamPolicy(instanceName).execute();
policy.setBindings(ImmutableList.of(binding));
Policy updatedPolicy = notebooks.instances().setIamPolicy(instanceName, new SetIamPolicyRequest().setPolicy(policy)).execute();
assertThat(updatedPolicy.getBindings(), Matchers.hasItem(binding));
Policy secondRetrieval = notebooks.instances().getIamPolicy(instanceName).execute();
assertThat(secondRetrieval.getBindings(), Matchers.hasItem(binding));
// Test the permissions of the user for which the IAM policy was set.
AIPlatformNotebooksCow userNotebooks = AIPlatformNotebooksCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie());
// Notebook get permission from "roles/notebooks.viewer".
String getNotebookPermission = "notebooks.instances.get";
TestIamPermissionsResponse iamResponse = userNotebooks.instances().testIamPermissions(instanceName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(getNotebookPermission))).execute();
assertThat(iamResponse.getPermissions(), Matchers.contains(getNotebookPermission));
notebooks.instances().delete(instanceName).execute();
}
use of com.google.api.services.healthcare.v1.model.Binding in project terra-cloud-resource-lib by DataBiosphere.
the class AIPlatformNotebooksCowTest method instanceSetIamPolicySerialize.
@Test
public void instanceSetIamPolicySerialize() throws Exception {
Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("userEmail:foo@gmail.com"));
SetIamPolicyRequest request = new SetIamPolicyRequest().setPolicy(new Policy().setBindings(ImmutableList.of(binding)));
assertEquals("{\"projectId\":\"my-project\",\"locations\":\"us-east1-b\"," + "\"instanceId\":\"my-id\",\"content\":{\"policy\":{" + "\"bindings\":[{\"members\":[\"userEmail:foo@gmail.com\"]," + "\"role\":\"roles/notebooks.viewer\"}]}}}", notebooks.instances().setIamPolicy(InstanceName.builder().projectId("my-project").location("us-east1-b").instanceId("my-id").build(), request).serialize().toString());
}
use of com.google.api.services.healthcare.v1.model.Binding in project terra-cli by DataBiosphere.
the class Workspace method grantBreakGlass.
/**
* Grant break-glass access to a user of this workspace. The Editor and Project IAM Admin roles
* are granted to the user's proxy group.
*
* @param granteeEmail email of the workspace user requesting break-glass access
* @param userProjectsAdminCredentials credentials for a SA that has permission to set IAM policy
* on workspace projects in this WSM deployment (e.g. WSM application SA)
* @return the proxy group email of the workspace user that was granted break-glass access
*/
public String grantBreakGlass(String granteeEmail, ServiceAccountCredentials userProjectsAdminCredentials) {
// fetch the user's proxy group email from SAM
String granteeProxyGroupEmail = SamService.fromContext().getProxyGroupEmail(granteeEmail);
logger.debug("granteeProxyGroupEmail: {}", granteeProxyGroupEmail);
// grant the Editor role to the user's proxy group email on the workspace project
CloudResourceManagerCow resourceManagerCow = CrlUtils.createCloudResourceManagerCow(userProjectsAdminCredentials);
try {
Policy policy = resourceManagerCow.projects().getIamPolicy(googleProjectId, new GetIamPolicyRequest()).execute();
List<Binding> updatedBindings = Optional.ofNullable(policy.getBindings()).orElse(new ArrayList<>());
updatedBindings.add(new Binding().setRole("roles/editor").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
updatedBindings.add(new Binding().setRole("roles/resourcemanager.projectIamAdmin").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
policy.setBindings(updatedBindings);
resourceManagerCow.projects().setIamPolicy(googleProjectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
} catch (IOException ioEx) {
throw new SystemException("Error granting the Editor and Project IAM Admin roles to the user's proxy group.", ioEx);
}
return granteeProxyGroupEmail;
}
Aggregations