use of com.google.api.services.iam.v1.model.TestIamPermissionsRequest in project java-docs-samples by GoogleCloudPlatform.
the class TestPermissions method testPermissions.
// Tests if the caller has the listed permissions.
public static void testPermissions(String projectId) {
// projectId = "my-project-id"
CloudResourceManager service = null;
try {
service = createCloudResourceManagerService();
} catch (IOException | GeneralSecurityException e) {
System.out.println("Unable to initialize service: \n" + e.toString());
return;
}
List<String> permissionsList = Arrays.asList("resourcemanager.projects.get", "resourcemanager.projects.delete");
TestIamPermissionsRequest requestBody = new TestIamPermissionsRequest().setPermissions(permissionsList);
try {
TestIamPermissionsResponse testIamPermissionsResponse = service.projects().testIamPermissions(projectId, requestBody).execute();
System.out.println("Of the permissions listed in the request, the caller has the following: " + testIamPermissionsResponse.getPermissions().toString());
} catch (IOException e) {
System.out.println("Unable to test permissions: \n" + e.toString());
}
}
use of com.google.api.services.iam.v1.model.TestIamPermissionsRequest in project terra-workspace-manager by DataBiosphere.
the class ControlledResourceServiceTest method canImpersonateSa.
/**
* Checks whether the provided IamCow (with credentials) has permission to impersonate a provided
* service account (via iam.serviceAccounts.actAs permission).
*/
private static boolean canImpersonateSa(ServiceAccountName serviceAccountName, IamCow iam) throws IOException {
TestIamPermissionsRequest actAsRequest = new TestIamPermissionsRequest().setPermissions(Collections.singletonList("iam.serviceAccounts.actAs"));
TestIamPermissionsResponse actAsResponse = iam.projects().serviceAccounts().testIamPermissions(serviceAccountName, actAsRequest).execute();
// response is null instead of an empty list. This is a quirk of GCP.
return actAsResponse.getPermissions() != null;
}
use of com.google.api.services.iam.v1.model.TestIamPermissionsRequest in project terra-workspace-manager by DataBiosphere.
the class EnablePet method canImpersonateSa.
private boolean canImpersonateSa(Iam iamClient, String petSaEmail) throws Exception {
String fullyQualifiedSaName = String.format("projects/%s/serviceAccounts/%s", projectId, petSaEmail);
TestIamPermissionsRequest testIamRequest = new TestIamPermissionsRequest().setPermissions(Collections.singletonList("iam.serviceAccounts.actAs"));
TestIamPermissionsResponse response = iamClient.projects().serviceAccounts().testIamPermissions(fullyQualifiedSaName, testIamRequest).execute();
// empty list. This is a quirk of the GCP client library.
return response.getPermissions() != null && response.getPermissions().contains("iam.serviceAccounts.actAs");
}
use of com.google.api.services.iam.v1.model.TestIamPermissionsRequest in project terra-cloud-resource-lib by DataBiosphere.
the class IamCowTest method getAndSetAndTestIamOnServiceAccount.
@Test
public void getAndSetAndTestIamOnServiceAccount() throws Exception {
IamCow.Projects.ServiceAccounts serviceAccounts = defaultIam().projects().serviceAccounts();
String projectName = "projects/" + reusableProject.getProjectId();
ServiceAccount serviceAccount = serviceAccounts.create(projectName, new CreateServiceAccountRequest().setAccountId(randomServiceAccountId())).execute();
ServiceAccountName serviceAccountName = ServiceAccountName.builder().projectId(serviceAccount.getProjectId()).email(serviceAccount.getEmail()).build();
Policy policy = serviceAccounts.getIamPolicy(serviceAccountName).execute();
assertNotNull(policy);
List<Binding> bindingList = new ArrayList<>();
String member = String.format("serviceAccount:%s", IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail());
Binding newBinding = new Binding().setRole("roles/iam.serviceAccountUser").setMembers(Collections.singletonList(member));
bindingList.add(newBinding);
policy.setBindings(bindingList);
Policy updatedPolicy = serviceAccounts.setIamPolicy(serviceAccountName, new SetIamPolicyRequest().setPolicy(policy)).execute();
assertThat(updatedPolicy.getBindings(), hasItem(newBinding));
assertEquals(updatedPolicy, serviceAccounts.getIamPolicy(serviceAccountName).execute());
// Test the permissions of the user for which the IAM policy was set.
IamCow.Projects.ServiceAccounts userIamServiceAccounts = IamCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie()).projects().serviceAccounts();
// The "actAs" permission associated with "roles/iam.serviceAccountUser".
String actAsPermission = "iam.serviceAccounts.actAs";
TestIamPermissionsResponse iamResponse = userIamServiceAccounts.testIamPermissions(serviceAccountName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(actAsPermission))).execute();
assertThat(iamResponse.getPermissions(), Matchers.contains(actAsPermission));
}
use of com.google.api.services.iam.v1.model.TestIamPermissionsRequest in project terra-cloud-resource-lib by DataBiosphere.
the class AIPlatformNotebooksCowTest method setGetTestIamPolicyNotebookInstance.
@Test
public void setGetTestIamPolicyNotebookInstance() throws Exception {
InstanceName instanceName = defaultInstanceName().instanceId("set-get-iam").build();
createInstance(instanceName);
String userEmail = IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail();
Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("serviceAccount:" + userEmail));
Policy policy = notebooks.instances().getIamPolicy(instanceName).execute();
policy.setBindings(ImmutableList.of(binding));
Policy updatedPolicy = notebooks.instances().setIamPolicy(instanceName, new SetIamPolicyRequest().setPolicy(policy)).execute();
assertThat(updatedPolicy.getBindings(), Matchers.hasItem(binding));
Policy secondRetrieval = notebooks.instances().getIamPolicy(instanceName).execute();
assertThat(secondRetrieval.getBindings(), Matchers.hasItem(binding));
// Test the permissions of the user for which the IAM policy was set.
AIPlatformNotebooksCow userNotebooks = AIPlatformNotebooksCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie());
// Notebook get permission from "roles/notebooks.viewer".
String getNotebookPermission = "notebooks.instances.get";
TestIamPermissionsResponse iamResponse = userNotebooks.instances().testIamPermissions(instanceName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(getNotebookPermission))).execute();
assertThat(iamResponse.getPermissions(), Matchers.contains(getNotebookPermission));
notebooks.instances().delete(instanceName).execute();
}
Aggregations