Struct google_api_proto::google::cloud::policytroubleshooter::iam::v3::DenyRuleExplanation

pub struct DenyRuleExplanation {
    pub deny_access_state: i32,
    pub combined_denied_permission: Option<AnnotatedPermissionMatching>,
    pub denied_permissions: BTreeMap<String, AnnotatedPermissionMatching>,
    pub combined_exception_permission: Option<AnnotatedPermissionMatching>,
    pub exception_permissions: BTreeMap<String, AnnotatedPermissionMatching>,
    pub combined_denied_principal: Option<AnnotatedDenyPrincipalMatching>,
    pub denied_principals: BTreeMap<String, AnnotatedDenyPrincipalMatching>,
    pub combined_exception_principal: Option<AnnotatedDenyPrincipalMatching>,
    pub exception_principals: BTreeMap<String, AnnotatedDenyPrincipalMatching>,
    pub relevance: i32,
    pub condition: Option<Expr>,
    pub condition_explanation: Option<ConditionExplanation>,
}

Details about how a deny rule in a deny policy affects a principal’s ability to use a permission.

Fields

deny_access_state: i32

Required. Indicates whether this rule denies the specified permission to the specified principal for the specified resource.

This field does not indicate whether the principal is actually denied on the permission for the resource. There might be another rule that overrides this rule. To determine whether the principal actually has the permission, use the overall_access_state field in the [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].

combined_denied_permission: Option<AnnotatedPermissionMatching>

Indicates whether the permission in the request is listed as a denied permission in the deny rule.

denied_permissions: BTreeMap<String, AnnotatedPermissionMatching>

Lists all denied permissions in the deny rule and indicates whether each permission matches the permission in the request.

Each key identifies a denied permission in the rule, and each value indicates whether the denied permission matches the permission in the request.

combined_exception_permission: Option<AnnotatedPermissionMatching>

Indicates whether the permission in the request is listed as an exception permission in the deny rule.

exception_permissions: BTreeMap<String, AnnotatedPermissionMatching>

Lists all exception permissions in the deny rule and indicates whether each permission matches the permission in the request.

Each key identifies a exception permission in the rule, and each value indicates whether the exception permission matches the permission in the request.

combined_denied_principal: Option<AnnotatedDenyPrincipalMatching>

Indicates whether the principal is listed as a denied principal in the deny rule, either directly or through membership in a principal set.

denied_principals: BTreeMap<String, AnnotatedDenyPrincipalMatching>

Lists all denied principals in the deny rule and indicates whether each principal matches the principal in the request, either directly or through membership in a principal set.

Each key identifies a denied principal in the rule, and each value indicates whether the denied principal matches the principal in the request.

combined_exception_principal: Option<AnnotatedDenyPrincipalMatching>

Indicates whether the principal is listed as an exception principal in the deny rule, either directly or through membership in a principal set.

exception_principals: BTreeMap<String, AnnotatedDenyPrincipalMatching>

Lists all exception principals in the deny rule and indicates whether each principal matches the principal in the request, either directly or through membership in a principal set.

Each key identifies a exception principal in the rule, and each value indicates whether the exception principal matches the principal in the request.

relevance: i32

The relevance of this role binding to the overall determination for the entire policy.

condition: Option<Expr>

A condition expression that specifies when the deny rule denies the principal access.

To learn about IAM Conditions, see https://cloud.google.com/iam/help/conditions/overview.

condition_explanation: Option<ConditionExplanation>

Condition evaluation state for this role binding.

Implementations

impl DenyRuleExplanation

pub fn deny_access_state(&self) -> DenyAccessState

Returns the enum value of deny_access_state, or the default if the field is set to an invalid enum value.

pub fn set_deny_access_state(&mut self, value: DenyAccessState)

Sets deny_access_state to the provided enum value.

pub fn relevance(&self) -> HeuristicRelevance

Returns the enum value of relevance, or the default if the field is set to an invalid enum value.

pub fn set_relevance(&mut self, value: HeuristicRelevance)

Sets relevance to the provided enum value.

Trait Implementations

impl Clone for DenyRuleExplanation

fn clone(&self) -> DenyRuleExplanation

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DenyRuleExplanation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DenyRuleExplanation

fn default() -> Self

Returns the “default value” for a type.

impl Message for DenyRuleExplanation

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl PartialEq for DenyRuleExplanation

fn eq(&self, other: &DenyRuleExplanation) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for DenyRuleExplanation