Struct google_api_proto::google::cloud::policytroubleshooter::iam::v3::AllowBindingExplanation

pub struct AllowBindingExplanation {
    pub allow_access_state: i32,
    pub role: String,
    pub role_permission: i32,
    pub role_permission_relevance: i32,
    pub combined_membership: Option<AnnotatedAllowMembership>,
    pub memberships: BTreeMap<String, AnnotatedAllowMembership>,
    pub relevance: i32,
    pub condition: Option<Expr>,
    pub condition_explanation: Option<ConditionExplanation>,
}

Details about how a role binding in an allow policy affects a principal’s ability to use a permission.

Fields

allow_access_state: i32

Required. Indicates whether this role binding gives the specified permission to the specified principal on the specified resource.

This field does not indicate whether the principal actually has the permission on the resource. There might be another role binding that overrides this role binding. To determine whether the principal actually has the permission, use the overall_access_state field in the [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].

role: String

The role that this role binding grants. For example, roles/compute.admin.

For a complete list of predefined IAM roles, as well as the permissions in each role, see https://cloud.google.com/iam/help/roles/reference.

role_permission: i32

Indicates whether the role granted by this role binding contains the specified permission.

role_permission_relevance: i32

The relevance of the permission’s existence, or nonexistence, in the role to the overall determination for the entire policy.

combined_membership: Option<AnnotatedAllowMembership>

The combined result of all memberships. Indicates if the principal is included in any role binding, either directly or indirectly.

memberships: BTreeMap<String, AnnotatedAllowMembership>

Indicates whether each role binding includes the principal specified in the request, either directly or indirectly. Each key identifies a principal in the role binding, and each value indicates whether the principal in the role binding includes the principal in the request.

For example, suppose that a role binding includes the following principals:

• user:alice@example.com
• group:product-eng@example.com

You want to troubleshoot access for user:bob@example.com. This user is a member of the group group:product-eng@example.com.

For the first principal in the role binding, the key is user:alice@example.com, and the membership field in the value is set to NOT_INCLUDED.

For the second principal in the role binding, the key is group:product-eng@example.com, and the membership field in the value is set to INCLUDED.

relevance: i32

The relevance of this role binding to the overall determination for the entire policy.

condition: Option<Expr>

A condition expression that specifies when the role binding grants access.

To learn about IAM Conditions, see https://cloud.google.com/iam/help/conditions/overview.

condition_explanation: Option<ConditionExplanation>

Condition evaluation state for this role binding.

Implementations

impl AllowBindingExplanation

pub fn allow_access_state(&self) -> AllowAccessState

Returns the enum value of allow_access_state, or the default if the field is set to an invalid enum value.

pub fn set_allow_access_state(&mut self, value: AllowAccessState)

Sets allow_access_state to the provided enum value.

pub fn role_permission(&self) -> RolePermissionInclusionState

Returns the enum value of role_permission, or the default if the field is set to an invalid enum value.

pub fn set_role_permission(&mut self, value: RolePermissionInclusionState)

Sets role_permission to the provided enum value.

pub fn role_permission_relevance(&self) -> HeuristicRelevance

Returns the enum value of role_permission_relevance, or the default if the field is set to an invalid enum value.

pub fn set_role_permission_relevance(&mut self, value: HeuristicRelevance)

Sets role_permission_relevance to the provided enum value.

pub fn relevance(&self) -> HeuristicRelevance

Returns the enum value of relevance, or the default if the field is set to an invalid enum value.

pub fn set_relevance(&mut self, value: HeuristicRelevance)

Sets relevance to the provided enum value.

Trait Implementations

impl Clone for AllowBindingExplanation

fn clone(&self) -> AllowBindingExplanation

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AllowBindingExplanation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AllowBindingExplanation

fn default() -> Self

Returns the “default value” for a type.

impl Message for AllowBindingExplanation

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl PartialEq for AllowBindingExplanation

fn eq(&self, other: &AllowBindingExplanation) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AllowBindingExplanation