Examples with SetIamPolicyRequest com.google.api.services.iam.v1.model.SetIamPolicyRequest used on opensource projects

Example 21 with SetIamPolicyRequest

use of com.google.api.services.iam.v1.model.SetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.

the class GcpCloudSyncStep method doStep.

@Override
public StepResult doStep(FlightContext flightContext) throws InterruptedException, RetryException {
    String gcpProjectId = flightContext.getWorkingMap().get(GCP_PROJECT_ID, String.class);
    FlightMap workingMap = flightContext.getWorkingMap();
    // Read Sam groups for each workspace role.
    Map<WsmIamRole, String> workspaceRoleGroupsMap = workingMap.get(WorkspaceFlightMapKeys.IAM_GROUP_EMAIL_MAP, new TypeReference<>() {
    });
    try {
        Policy currentPolicy = resourceManagerCow.projects().getIamPolicy(gcpProjectId, new GetIamPolicyRequest()).execute();
        List<Binding> newBindings = new ArrayList<>();
        // Add all existing bindings to ensure we don't accidentally clobber existing permissions.
        newBindings.addAll(currentPolicy.getBindings());
        // Add appropriate project-level roles for each WSM IAM role.
        workspaceRoleGroupsMap.forEach((role, email) -> newBindings.add(bindingForRole(role, email, gcpProjectId)));
        Policy newPolicy = new Policy().setVersion(currentPolicy.getVersion()).setBindings(newBindings).setEtag(currentPolicy.getEtag());
        SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(newPolicy);
        logger.info("Setting new Cloud Context IAM policy: " + iamPolicyRequest.toPrettyString());
        resourceManagerCow.projects().setIamPolicy(gcpProjectId, iamPolicyRequest).execute();
    } catch (IOException e) {
        throw new RetryableCrlException("Error setting IAM permissions", e);
    }
    return StepResult.getStepResultSuccess();
}

Example 22 with SetIamPolicyRequest

use of com.google.api.services.iam.v1.model.SetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.

the class GrantWsmRoleAdminStep method doStep.

@Override
public StepResult doStep(FlightContext context) throws InterruptedException, RetryException {
    String wsmSaEmail = GcpUtils.getWsmSaEmail(crlService.getApplicationCredentials());
    String projectId = context.getWorkingMap().get(WorkspaceFlightMapKeys.GCP_PROJECT_ID, String.class);
    try {
        Policy policy = crlService.getCloudResourceManagerCow().projects().getIamPolicy(projectId, new GetIamPolicyRequest()).execute();
        Binding bindingToAdd = new Binding().setMembers(Collections.singletonList("serviceAccount:" + wsmSaEmail)).setRole("roles/iam.roleAdmin");
        List<Binding> bindingList = policy.getBindings();
        bindingList.add(bindingToAdd);
        policy.setBindings(bindingList);
        SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(policy);
        crlService.getCloudResourceManagerCow().projects().setIamPolicy(projectId, iamPolicyRequest).execute();
    } catch (IOException e) {
        throw new InternalServerErrorException("Error while granting WSM SA the Role Admin role", e);
    }
    return StepResult.getStepResultSuccess();
}

Example 23 with SetIamPolicyRequest

use of com.google.api.services.iam.v1.model.SetIamPolicyRequest in project terra-cloud-resource-lib by DataBiosphere.

the class IamCowTest method setIamPolicyServiceAccountSerialize.

@Test
public void setIamPolicyServiceAccountSerialize() throws Exception {
    IamCow.Projects.ServiceAccounts.SetIamPolicy setIamPolicy = defaultIam().projects().serviceAccounts().setIamPolicy(ServiceAccountName.builder().projectId("projectId").email("saEmail").build(), new SetIamPolicyRequest().setPolicy(new Policy().setEtag("myEtag")));
    assertEquals("{\"resource\":\"projects/projectId/serviceAccounts/saEmail\"," + "\"content\":{\"policy\":{\"etag\":\"myEtag\"}}}", setIamPolicy.serialize().toString());
}

Example 24 with SetIamPolicyRequest

use of com.google.api.services.iam.v1.model.SetIamPolicyRequest in project terra-cloud-resource-lib by DataBiosphere.

the class AIPlatformNotebooksCowTest method setGetTestIamPolicyNotebookInstance.

@Test
public void setGetTestIamPolicyNotebookInstance() throws Exception {
    InstanceName instanceName = defaultInstanceName().instanceId("set-get-iam").build();
    createInstance(instanceName);
    String userEmail = IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail();
    Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("serviceAccount:" + userEmail));
    Policy policy = notebooks.instances().getIamPolicy(instanceName).execute();
    policy.setBindings(ImmutableList.of(binding));
    Policy updatedPolicy = notebooks.instances().setIamPolicy(instanceName, new SetIamPolicyRequest().setPolicy(policy)).execute();
    assertThat(updatedPolicy.getBindings(), Matchers.hasItem(binding));
    Policy secondRetrieval = notebooks.instances().getIamPolicy(instanceName).execute();
    assertThat(secondRetrieval.getBindings(), Matchers.hasItem(binding));
    // Test the permissions of the user for which the IAM policy was set.
    AIPlatformNotebooksCow userNotebooks = AIPlatformNotebooksCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie());
    // Notebook get permission from "roles/notebooks.viewer".
    String getNotebookPermission = "notebooks.instances.get";
    TestIamPermissionsResponse iamResponse = userNotebooks.instances().testIamPermissions(instanceName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(getNotebookPermission))).execute();
    assertThat(iamResponse.getPermissions(), Matchers.contains(getNotebookPermission));
    notebooks.instances().delete(instanceName).execute();
}

Example 25 with SetIamPolicyRequest

use of com.google.api.services.iam.v1.model.SetIamPolicyRequest in project terra-cloud-resource-lib by DataBiosphere.

the class AIPlatformNotebooksCowTest method instanceSetIamPolicySerialize.

@Test
public void instanceSetIamPolicySerialize() throws Exception {
    Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("userEmail:foo@gmail.com"));
    SetIamPolicyRequest request = new SetIamPolicyRequest().setPolicy(new Policy().setBindings(ImmutableList.of(binding)));
    assertEquals("{\"projectId\":\"my-project\",\"locations\":\"us-east1-b\"," + "\"instanceId\":\"my-id\",\"content\":{\"policy\":{" + "\"bindings\":[{\"members\":[\"userEmail:foo@gmail.com\"]," + "\"role\":\"roles/notebooks.viewer\"}]}}}", notebooks.instances().setIamPolicy(InstanceName.builder().projectId("my-project").location("us-east1-b").instanceId("my-id").build(), request).serialize().toString());
}