grpc-google-iam-v1

import os from google.cloud import resourcemanager_v3 from google.iam.v1 import iam_policy_pb2, policy_pb2 # NOTE: This quickstart demonstrates how to manage IAM policies using the # recommended `google-cloud-resource-manager` library, which is built on top of # the underlying IAM Policy API (v1) that `grpc-google-iam-v1` implements. # Direct usage of `grpc-google-iam-v1` is generally discouraged. # Set your Google Cloud project ID. Ensure you have authenticated # (e.g., `gcloud auth application-default login` or GOOGLE_APPLICATION_CREDENTIALS) project_id = os.environ.get('GOOGLE_CLOUD_PROJECT', 'your-gcp-project-id') if project_id == 'your-gcp-project-id': raise ValueError("Please set the 'GOOGLE_CLOUD_PROJECT' environment variable or replace 'your-gcp-project-id'.") project_resource = f'projects/{project_id}' try: # Initialize the Resource Manager client client = resourcemanager_v3.ProjectsClient() # 1. Get the current IAM policy for the project get_request = iam_policy_pb2.GetIamPolicyRequest(resource=project_resource) current_policy = client.get_iam_policy(request=get_request) print(f"Current policy for {project_resource}:") print(current_policy) # 2. Modify the policy (e.g., add a new member with a role) # IMPORTANT: Always read the existing policy, modify it, then write it back # to avoid overwriting changes made by others. Use etag for concurrency control. new_policy = policy_pb2.Policy(version=current_policy.version, etag=current_policy.etag) new_policy.bindings.extend(current_policy.bindings) # Example: Add a new member (e.g., a user or service account) with the Viewer role # Replace 'user:example@example.com' with a valid member ID new_member = "user:example@example.com" new_role = "roles/viewer" found_binding = False for binding in new_policy.bindings: if binding.role == new_role: if new_member not in binding.members: binding.members.append(new_member) print(f"Added {new_member} to role {new_role}.") else: print(f"{new_member} already in role {new_role}.") found_binding = True break if not found_binding: new_binding = policy_pb2.Binding(role=new_role, members=[new_member]) new_policy.bindings.append(new_binding) print(f"Created new binding for role {new_role} and added {new_member}.") # 3. Set the modified IAM policy set_request = iam_policy_pb2.SetIamPolicyRequest( resource=project_resource, policy=new_policy, update_mask=iam_policy_pb2.FieldMask(paths=["bindings", "etag"]) ) updated_policy = client.set_iam_policy(request=set_request) print(f"\nUpdated policy for {project_resource}:") print(updated_policy) # 4. Clean up: Remove the added member (optional) cleanup_policy = policy_pb2.Policy(version=updated_policy.version, etag=updated_policy.etag) cleanup_policy.bindings.extend(updated_policy.bindings) for binding in cleanup_policy.bindings: if binding.role == new_role and new_member in binding.members: binding.members.remove(new_member) print(f"\nRemoved {new_member} from role {new_role}.") break cleanup_request = iam_policy_pb2.SetIamPolicyRequest( resource=project_resource, policy=cleanup_policy, update_mask=iam_policy_pb2.FieldMask(paths=["bindings", "etag"]) ) client.set_iam_policy(request=cleanup_request) print("Cleanup complete.") except Exception as e: print(f"An error occurred: {e}") print("Ensure 'GOOGLE_CLOUD_PROJECT' is set and you have 'roles/resourcemanager.projectIamAdmin' or equivalent permissions.")