def Run(self, args):
condition = iam_util.ValidateAndExtractCondition(args)
messages = self.OrganizationsMessages()
get_policy_request = (
messages.CloudresourcemanagerOrganizationsGetIamPolicyRequest(
organizationsId=args.id,
getIamPolicyRequest=messages.GetIamPolicyRequest()))
policy = self.OrganizationsClient().GetIamPolicy(get_policy_request)
iam_util.RemoveBindingFromIamPolicyWithCondition(
policy, args.member, args.role, condition, args.all)
set_policy_request = (
messages.CloudresourcemanagerOrganizationsSetIamPolicyRequest(
organizationsId=args.id,
setIamPolicyRequest=messages.SetIamPolicyRequest(policy=policy)))
return self.OrganizationsClient().SetIamPolicy(set_policy_request)
def _GetModifiedIamPolicyRemoveIamBinding(self, args, add_condition=False):
"""Get the IAM policy and remove the specified binding to it.
Args:
args: an argparse namespace.
add_condition: True if support condition.
Returns:
IAM policy.
"""
if add_condition:
condition = iam_util.ValidateAndExtractCondition(args)
policy = self._GetIamPolicy(args)
iam_util.RemoveBindingFromIamPolicyWithCondition(
policy,
args.member,
args.role,
condition,
all_conditions=args.all)
else:
policy = self._GetIamPolicy(args)
iam_util.RemoveBindingFromIamPolicy(policy, args.member, args.role)
return policy
def Run(self, args):
service = tags.TagKeysService()
messages = tags.TagMessages()
if args.RESOURCE_NAME.find('tagKeys/') == 0:
tag_key = args.RESOURCE_NAME
else:
tag_key = tag_utils.GetTagKeyFromNamespacedName(
args.RESOURCE_NAME).name
get_iam_policy_req = (
messages.CloudresourcemanagerTagKeysGetIamPolicyRequest(
resource=tag_key))
policy = service.GetIamPolicy(get_iam_policy_req)
condition = iam_util.ValidateAndExtractConditionMutexRole(args)
iam_util.RemoveBindingFromIamPolicyWithCondition(
policy, args.member, args.role, condition, args.all)
set_iam_policy_request = messages.SetIamPolicyRequest(policy=policy)
request = messages.CloudresourcemanagerTagKeysSetIamPolicyRequest(
resource=tag_key, setIamPolicyRequest=set_iam_policy_request)
result = service.SetIamPolicy(request)
iam_util.LogSetIamPolicy(tag_key, 'TagKey')
return result
def RemoveIamPolicyBinding(self, service_ref, member, role, condition):
"""Services remove iam policy binding request."""
policy = self.GetIamPolicy(service_ref)
iam_util.RemoveBindingFromIamPolicyWithCondition(policy, member, role,
condition)
return self.SetIamPolicy(service_ref, policy)