Add IAM custom roles and access snippets #1692
Conversation
iam/api-client/access.py
Outdated
| @@ -0,0 +1,131 @@ | |||
| # !/usr/bin/env python | |||
| # | |||
| # Copyright 2018 Google Inc. All Rights Reserved. | |||
There was a problem hiding this comment.
Nit: Google LLC
Drop the "all rights reserved". See go/releasing/preparing#headers
| import googleapiclient.discovery | ||
|
|
||
| credentials = service_account.Credentials.from_service_account_file( | ||
| filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'], |
There was a problem hiding this comment.
Why read from the environment variable directly instead of using google.auth.default(scopes)?
There was a problem hiding this comment.
This is the documented approach: https://developers.google.com/api-client-library/python/auth/service-accounts
google.auth.default() does not seem to work.
There was a problem hiding this comment.
Odd. It should do the same thing if the environment variable is set.
Note that its signature is slightly different: google.auth.default() returns a tuple with the credentials and a default project ID.
| # pylint: disable=no-member | ||
| policy = service.projects().getIamPolicy( | ||
| resource=project_id, body={}).execute() | ||
| print(policy) |
There was a problem hiding this comment.
Please introspect in the objects so that we see the relevant fields in the actual code. e.g.
print(policy['some_relevant_field_name'])
There was a problem hiding this comment.
print(policy) dumps the policy object as JSON. This is good since users need to understand and manipulate this object to edit IAM policy. This is explained in the companion article: https://cloud.google.com/iam/docs/granting-changing-revoking-access#overview_of_cloud_iam_policy
| """Adds a new member to a role binding.""" | ||
| binding = next(b for b in policy['bindings'] if b['role'] == role) | ||
| binding['members'].append(member) | ||
| print(binding) |
There was a problem hiding this comment.
Is this missing an API request to actually update the policy?
There was a problem hiding this comment.
The set_policy() method on line 72 demonstrates that.
There was a problem hiding this comment.
I find that a bit strange to separate them. Most how-to guides that I've seen try to keep each code snippet self-contained, but you're right that this matches the docs.
|
|
||
|
|
||
| # [START iam_create_role] | ||
| def create_role(name, project, title, description, permissions, stage): |
There was a problem hiding this comment.
We'd like to avoid general samples if at all possible. Could you remove the arguments and use specific values?
Otherwise, provide example values as comments if not possible to hardcode values for these.
There was a problem hiding this comment.
This isn't a general sample, it's a series of companion snippets that map to this article: https://cloud.google.com/iam/docs/creating-custom-roles.
Each snippet corresponds to a section in the article that explains its parameters.
Using hardcoded values like "my-project" is generally considered more confusing.
| import googleapiclient.discovery | ||
|
|
||
| credentials = service_account.Credentials.from_service_account_file( | ||
| filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'], |
There was a problem hiding this comment.
Odd. It should do the same thing if the environment variable is set.
Note that its signature is slightly different: google.auth.default() returns a tuple with the credentials and a default project ID.
| """Adds a new member to a role binding.""" | ||
| binding = next(b for b in policy['bindings'] if b['role'] == role) | ||
| binding['members'].append(member) | ||
| print(binding) |
There was a problem hiding this comment.
I find that a bit strange to separate them. Most how-to guides that I've seen try to keep each code snippet self-contained, but you're right that this matches the docs.
|
@awkoren Travis is showing some lint errors. Please fix. |
|
Travis errors fixed. |
No description provided.