Skip to content

Commit 6ecb359

Browse files
awkorenandrewsg
awkoren
authored and
andrewsg
committed
Add IAM doc snippets (#1609)
* Add env/ and .vscode/ to .gitignore * Add IAM requirements.txt * Python Service account keys (jleetutorial#5) Add IAM service account keys snippets * Python Quickstart (jleetutorial#3) Add IAM quickstart * Python Service accounts (jleetutorial#4) Add IAM service account snippets * Add query grantable roles and tests (jleetutorial#2) * Add whitespace and correct string formatting * Add extra CR * Lint
1 parent cc88e66 commit 6ecb359

9 files changed

Lines changed: 433 additions & 1 deletion

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@ credentials.dat
2222
.nox
2323
.vscode/
2424
*sponge_log.xml
25-
.DS_store
25+
.DS_store

‎iam/api-client/grantable_roles.py‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#!/usr/bin/env python
2+
3+
# Copyright 2018 Google Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
import argparse
18+
import os
19+
20+
from google.oauth2 import service_account
21+
import googleapiclient.discovery
22+
23+
credentials = service_account.Credentials.from_service_account_file(
24+
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
25+
scopes=['https://www.googleapis.com/auth/cloud-platform'])
26+
service = googleapiclient.discovery.build(
27+
'iam', 'v1', credentials=credentials)
28+
29+
30+
# [START iam_view_grantable_roles]
31+
def view_grantable_roles(full_resource_name):
32+
roles = service.roles().queryGrantableRoles(body={
33+
'fullResourceName': full_resource_name
34+
}).execute()
35+
36+
for role in roles['roles']:
37+
print('Title: ' + role['title'])
38+
print('Name: ' + role['name'])
39+
print('Description: ' + role['description'])
40+
print(' ')
41+
# [END iam_view_grantable_roles]
42+
43+
44+
if __name__ == '__main__':
45+
parser = argparse.ArgumentParser()
46+
parser.add_argument(
47+
'full_resource_name',
48+
help='The full name of the resource to query grantable roles for.')
49+
50+
args = parser.parse_args()
51+
view_grantable_roles(args.full_resource_name)

‎iam/api-client/grantable_roles_test.py‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Copyright 2016 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
import os
16+
17+
import grantable_roles
18+
19+
20+
def test_service_accounts(capsys):
21+
project = os.environ['GCLOUD_PROJECT']
22+
resource = '//cloudresourcemanager.googleapis.com/projects/' + project
23+
grantable_roles.view_grantable_roles(resource)
24+
out, _ = capsys.readouterr()
25+
assert 'Title:' in out

‎iam/api-client/quickstart.py‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/usr/bin/env python
2+
3+
# Copyright 2018 Google Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
18+
def quickstart():
19+
# [START iam_quickstart]
20+
import os
21+
22+
from google.oauth2 import service_account
23+
import googleapiclient.discovery
24+
25+
# Get credentials
26+
credentials = service_account.Credentials.from_service_account_file(
27+
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
28+
scopes=['https://www.googleapis.com/auth/cloud-platform'])
29+
30+
# Create the Cloud IAM service object
31+
service = googleapiclient.discovery.build(
32+
'iam', 'v1', credentials=credentials)
33+
34+
# Call the Cloud IAM Roles API
35+
# If using pylint, disable weak-typing warnings
36+
# pylint: disable=no-member
37+
response = service.roles().list().execute()
38+
roles = response['roles']
39+
40+
# Process the response
41+
for role in roles:
42+
print('Title: ' + role['title'])
43+
print('Name: ' + role['name'])
44+
print('Description: ' + role['description'])
45+
print('')
46+
# [END iam_quickstart]
47+
48+
49+
if __name__ == '__main__':
50+
quickstart()

‎iam/api-client/quickstart_test.py‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright 2018 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
import quickstart
16+
17+
18+
def test_quickstart(capsys):
19+
quickstart.quickstart()
20+
out, _ = capsys.readouterr()
21+
assert 'Title' in out

‎iam/api-client/requirements.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
google-api-python-client==1.7.3
2+
google-auth==1.5.0
3+
google-auth-httplib2==0.0.3

‎iam/api-client/service_account_keys.py‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/usr/bin/env python
2+
3+
# Copyright 2018 Google Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
"""Demonstrates how to perform basic operations with Google Cloud IAM
18+
service account keys.
19+
20+
For more information, see the documentation at
21+
https://cloud.google.com/iam/docs/creating-managing-service-account-keys.
22+
"""
23+
24+
import argparse
25+
import os
26+
27+
from google.oauth2 import service_account
28+
import googleapiclient.discovery
29+
30+
credentials = service_account.Credentials.from_service_account_file(
31+
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
32+
scopes=['https://www.googleapis.com/auth/cloud-platform'])
33+
service = googleapiclient.discovery.build(
34+
'iam', 'v1', credentials=credentials)
35+
36+
37+
# [START iam_create_key]
38+
def create_key(service_account_email):
39+
"""Creates a key for a service account."""
40+
41+
# pylint: disable=no-member
42+
key = service.projects().serviceAccounts().keys().create(
43+
name='projects/-/serviceAccounts/' + service_account_email, body={}
44+
).execute()
45+
46+
print('Created key: ' + key['name'])
47+
# [END iam_create_key]
48+
49+
50+
# [START iam_list_keys]
51+
def list_keys(service_account_email):
52+
"""Lists all keys for a service account."""
53+
54+
# pylint: disable=no-member
55+
keys = service.projects().serviceAccounts().keys().list(
56+
name='projects/-/serviceAccounts/' + service_account_email).execute()
57+
58+
for key in keys['keys']:
59+
print('Key: ' + key['name'])
60+
# [END iam_list_keys]
61+
62+
63+
# [START iam_delete_key]
64+
def delete_key(full_key_name):
65+
"""Deletes a service account key."""
66+
67+
# pylint: disable=no-member
68+
service.projects().serviceAccounts().keys().delete(
69+
name=full_key_name).execute()
70+
71+
print('Deleted key: ' + full_key_name)
72+
# [END iam_delete_key]
73+
74+
75+
if __name__ == '__main__':
76+
parser = argparse.ArgumentParser(
77+
description=__doc__,
78+
formatter_class=argparse.RawDescriptionHelpFormatter)
79+
80+
subparsers = parser.add_subparsers(dest='command')
81+
82+
create_key_parser = subparsers.add_parser(
83+
'create', help=create_key.__doc__)
84+
create_key_parser.add_argument('service_account_email')
85+
86+
list_keys_parser = subparsers.add_parser(
87+
'list', help=list_keys.__doc__)
88+
list_keys_parser.add_argument('service_account_email')
89+
90+
delete_key_parser = subparsers.add_parser(
91+
'delete', help=delete_key.__doc__)
92+
delete_key_parser.add_argument('full_key_name')
93+
94+
args = parser.parse_args()
95+
96+
if args.command == 'list':
97+
list_keys(args.service_account_email)
98+
elif args.command == 'create':
99+
create_key(args.service_account_email)
100+
elif args.command == 'delete':
101+
delete_key(args.full_key_name)

0 commit comments

Comments
 (0)