# Compute Engine API . licenseCodes

## Instance Methods

Close httplib2 connections.

Return a specified license code. License codes are mirrored across

Gets the access control policy for a resource. May be empty if no such

Sets the access control policy on the specified resource.

Returns permissions that a caller has on the specified resource.

### Method Details

`close()`

    Close httplib2 connections.

`get(project, licenseCode, x__xgafv=None)`

    Return a specified license code. License codes are mirrored across
    all projects that have permissions to read the License Code.
     *Caution* This resource is intended
    for use only by third-party partners who are creatingCloud Marketplace
    images.

    Args:
      project: string, Project ID for this request. (required)
      licenseCode: string, Number corresponding to the License code resource to return. (required)
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Represents a License Code resource.
        #
        # A License Code is a unique identifier used to represent alicense
        # resource.
        #  *Caution* This resource is intended for
        # use only by third-party partners who are creatingCloud Marketplace
        # images.
      "allowedReplacementLicenses": [ # Specifies licenseCodes of licenses that can replace this license. Note:
          # such replacements are allowed even if removable_from_disk is false.
        "A String",
      ],
      "appendableToDisk": True or False, # If true, this license can be appended to an existing disk's set of
          # licenses.
      "creationTimestamp": "A String", # Output only. [Output Only] Creation timestamp inRFC3339
          # text format.
      "description": "A String", # Output only. [Output Only] Description of this License Code.
      "id": "A String", # Output only. [Output Only] The unique identifier for the resource. This identifier is
          # defined by the server.
      "incompatibleLicenses": [ # Specifies licenseCodes of licenses that are incompatible with this license.
          # If a license is incompatible with this license, it cannot be attached to
          # the same disk or image.
        "A String",
      ],
      "kind": "compute#licenseCode", # Output only. [Output Only] Type of resource. Always compute#licenseCode for
          # licenses.
      "licenseAlias": [ # [Output Only] URL and description aliases of Licenses with the same
          # License Code.
        {
          "description": "A String", # Output only. [Output Only] Description of this License Code.
          "selfLink": "A String", # Output only. [Output Only] URL of license corresponding to this License Code.
        },
      ],
      "minimumRetention": { # A Duration represents a fixed-length span of time represented # If set, this license will be unable to be removed or replaced once attached
          # to a disk until the minimum_retention period has passed.
          # as a count of seconds and fractions of seconds at nanosecond
          # resolution. It is independent of any calendar and concepts like "day"
          # or "month". Range is approximately 10,000 years.
        "nanos": 42, # Span of time that's a fraction of a second at nanosecond resolution.
            # Durations less than one second are represented with a 0
            # `seconds` field and a positive `nanos` field. Must be from 0
            # to 999,999,999 inclusive.
        "seconds": "A String", # Span of time at a resolution of a second. Must be from 0
            # to 315,576,000,000 inclusive. Note: these bounds are computed from:
            # 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
      },
      "multiTenantOnly": True or False, # If true, this license can only be used on VMs on multi tenant nodes.
      "name": "A String", # Output only. [Output Only] Name of the resource. The name is 1-20 characters long and
          # must be a valid 64 bit integer.
      "osLicense": True or False, # If true, indicates this is an OS license. Only one OS license can be
          # attached to a disk or image at a time.
      "removableFromDisk": True or False, # If true, this license can be removed from a disk's set of licenses, with no
          # replacement license needed.
      "requiredCoattachedLicenses": [ # Specifies the set of permissible coattached licenseCodes of licenses that
          # satisfy the coattachment requirement of this license. At least one license
          # from the set must be attached to the same disk or image as this license.
        "A String",
      ],
      "selfLink": "A String", # Output only. [Output Only] Server-defined URL for the resource.
      "soleTenantOnly": True or False, # If true, this license can only be used on VMs on sole tenant nodes.
      "state": "A String", # Output only. [Output Only] Current state of this License Code.
      "transferable": True or False, # Output only. [Output Only] If true, the license will remain attached when creating
          # images or snapshots from disks. Otherwise, the license is not transferred.
      "updateTimestamp": "A String", # Output only. [Output Only] Last update timestamp inRFC3339
          # text format.
    }

`getIamPolicy(project, resource, optionsRequestedPolicyVersion=None, x__xgafv=None)`

    Gets the access control policy for a resource. May be empty if no such
    policy or resource exists.
     *Caution* This resource is intended
    for use only by third-party partners who are creatingCloud Marketplace
    images.

    Args:
      project: string, Project ID for this request. (required)
      resource: string, Name or id of the resource for this request. (required)
      optionsRequestedPolicyVersion: integer, Requested IAM Policy version.
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # An Identity and Access Management (IAM) policy, which specifies access
        # controls for Google Cloud resources.
        #
        #
        # A `Policy` is a collection of `bindings`. A `binding` binds one or more
        # `members`, or principals, to a single `role`. Principals can be user
        # accounts, service accounts, Google groups, and domains (such as G Suite). A
        # `role` is a named list of permissions; each `role` can be an IAM predefined
        # role or a user-created custom role.
        #
        # For some types of Google Cloud resources, a `binding` can also specify a
        # `condition`, which is a logical expression that allows access to a resource
        # only if the expression evaluates to `true`. A condition can add constraints
        # based on attributes of the request, the resource, or both. To learn which
        # resources support conditions in their IAM policies, see the
        # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
        #
        # **JSON example:**
        #
        # ```
        #     {
        #       "bindings": [
        #         {
        #           "role": "roles/resourcemanager.organizationAdmin",
        #           "members": [
        #             "user:mike@example.com",
        #             "group:admins@example.com",
        #             "domain:google.com",
        #             "serviceAccount:my-project-id@appspot.gserviceaccount.com"
        #           ]
        #         },
        #         {
        #           "role": "roles/resourcemanager.organizationViewer",
        #           "members": [
        #             "user:eve@example.com"
        #           ],
        #           "condition": {
        #             "title": "expirable access",
        #             "description": "Does not grant access after Sep 2020",
        #             "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
        #           }
        #         }
        #       ],
        #       "etag": "BwWWja0YfJA=",
        #       "version": 3
        #     }
        # ```
        #
        # **YAML example:**
        #
        # ```
        #     bindings:
        #     - members:
        #       - user:mike@example.com
        #       - group:admins@example.com
        #       - domain:google.com
        #       - serviceAccount:my-project-id@appspot.gserviceaccount.com
        #       role: roles/resourcemanager.organizationAdmin
        #     - members:
        #       - user:eve@example.com
        #       role: roles/resourcemanager.organizationViewer
        #       condition:
        #         title: expirable access
        #         description: Does not grant access after Sep 2020
        #         expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
        #     etag: BwWWja0YfJA=
        #     version: 3
        # ```
        #
        # For a description of IAM and its features, see the
        # [IAM documentation](https://cloud.google.com/iam/docs/).
      "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
        { # Specifies the audit configuration for a service.
            # The configuration determines which permission types are logged, and what
            # identities, if any, are exempted from logging.
            # An AuditConfig must have one or more AuditLogConfigs.
            #
            # If there are AuditConfigs for both `allServices` and a specific service,
            # the union of the two AuditConfigs is used for that service: the log_types
            # specified in each AuditConfig are enabled, and the exempted_members in each
            # AuditLogConfig are exempted.
            #
            # Example Policy with multiple AuditConfigs:
            #
            #     {
            #       "audit_configs": [
            #         {
            #           "service": "allServices",
            #           "audit_log_configs": [
            #             {
            #               "log_type": "DATA_READ",
            #               "exempted_members": [
            #                 "user:jose@example.com"
            #               ]
            #             },
            #             {
            #               "log_type": "DATA_WRITE"
            #             },
            #             {
            #               "log_type": "ADMIN_READ"
            #             }
            #           ]
            #         },
            #         {
            #           "service": "sampleservice.googleapis.com",
            #           "audit_log_configs": [
            #             {
            #               "log_type": "DATA_READ"
            #             },
            #             {
            #               "log_type": "DATA_WRITE",
            #               "exempted_members": [
            #                 "user:aliya@example.com"
            #               ]
            #             }
            #           ]
            #         }
            #       ]
            #     }
            #
            # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
            # logging. It also exempts `jose@example.com` from DATA_READ logging, and
            # `aliya@example.com` from DATA_WRITE logging.
          "auditLogConfigs": [ # The configuration for logging of each type of permission.
            { # Provides the configuration for logging a type of permissions.
                # Example:
                #
                #     {
                #       "audit_log_configs": [
                #         {
                #           "log_type": "DATA_READ",
                #           "exempted_members": [
                #             "user:jose@example.com"
                #           ]
                #         },
                #         {
                #           "log_type": "DATA_WRITE"
                #         }
                #       ]
                #     }
                #
                # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
                # jose@example.com from DATA_READ logging.
              "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of
                  # permission.
                  # Follows the same format of Binding.members.
                "A String",
              ],
              "logType": "A String", # The log type that this config enables.
            },
          ],
          "service": "A String", # Specifies a service that will be enabled for audit logging.
              # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
              # `allServices` is a special value that covers all services.
        },
      ],
      "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally,
          # may specify a `condition` that determines how and when the `bindings` are
          # applied. Each of the `bindings` must contain at least one principal.
          #
          # The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
          # of these principals can be Google groups. Each occurrence of a principal
          # counts towards these limits. For example, if the `bindings` grant 50
          # different roles to `user:alice@example.com`, and not to any other
          # principal, then you can add another 1,450 principals to the `bindings` in
          # the `Policy`.
        { # Associates `members`, or principals, with a `role`.
          "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
              #
              # If the condition evaluates to `true`, then this binding applies to the
              # current request.
              #
              # If the condition evaluates to `false`, then this binding does not apply to
              # the current request. However, a different role binding might grant the same
              # role to one or more of the principals in this binding.
              #
              # To learn which resources support conditions in their IAM policies, see the
              # [IAM
              # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
              # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
              # are documented at https://github.com/google/cel-spec.
              #
              # Example (Comparison):
              #
              #     title: "Summary size limit"
              #     description: "Determines if a summary is less than 100 chars"
              #     expression: "document.summary.size() < 100"
              #
              # Example (Equality):
              #
              #     title: "Requestor is owner"
              #     description: "Determines if requestor is the document owner"
              #     expression: "document.owner == request.auth.claims.email"
              #
              # Example (Logic):
              #
              #     title: "Public documents"
              #     description: "Determine whether the document should be publicly visible"
              #     expression: "document.type != 'private' && document.type != 'internal'"
              #
              # Example (Data Manipulation):
              #
              #     title: "Notification string"
              #     description: "Create a notification string with a timestamp."
              #     expression: "'New message received at ' + string(document.create_time)"
              #
              # The exact variables and functions that may be referenced within an expression
              # are determined by the service that evaluates it. See the service
              # documentation for additional information.
            "description": "A String", # Optional. Description of the expression. This is a longer text which
                # describes the expression, e.g. when hovered over it in a UI.
            "expression": "A String", # Textual representation of an expression in Common Expression Language
                # syntax.
            "location": "A String", # Optional. String indicating the location of the expression for error
                # reporting, e.g. a file name and a position in the file.
            "title": "A String", # Optional. Title for the expression, i.e. a short string describing
                # its purpose. This can be used e.g. in UIs which allow to enter the
                # expression.
          },
          "members": [ # Specifies the principals requesting access for a Google Cloud resource.
              # `members` can have the following values:
              #
              # * `allUsers`: A special identifier that represents anyone who is
              #    on the internet; with or without a Google account.
              #
              # * `allAuthenticatedUsers`: A special identifier that represents anyone
              #    who is authenticated with a Google account or a service account.
              #    Does not include identities that come from external identity providers
              #    (IdPs) through identity federation.
              #
              # * `user:{emailid}`: An email address that represents a specific Google
              #    account. For example, `alice@example.com` .
              #
              #
              # * `serviceAccount:{emailid}`: An email address that represents a Google
              #    service account. For example,
              #    `my-other-app@appspot.gserviceaccount.com`.
              #
              # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An
              #    identifier for a
              #    [Kubernetes service
              #    account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts).
              #    For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`.
              #
              # * `group:{emailid}`: An email address that represents a Google group.
              #    For example, `admins@example.com`.
              #
              #
              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
              #    users of that domain. For example, `google.com` or `example.com`.
              #
              #
              #
              #
              # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
              #   A single identity in a workforce identity pool.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`:
              #   All workforce identities in a group.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
              #   All workforce identities with a specific attribute value.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`:
              #   All identities in a workforce identity pool.
              #
              # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`:
              #   A single identity in a workload identity pool.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`:
              #   A workload identity pool group.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
              #   All identities in a workload identity pool with a certain attribute.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`:
              #   All identities in a workload identity pool.
              #
              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
              #    identifier) representing a user that has been recently deleted. For
              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
              #    recovered, this value reverts to `user:{emailid}` and the recovered user
              #    retains the role in the binding.
              #
              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
              #    unique identifier) representing a service account that has been recently
              #    deleted. For example,
              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
              #    If the service account is undeleted, this value reverts to
              #    `serviceAccount:{emailid}` and the undeleted service account retains the
              #    role in the binding.
              #
              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
              #    identifier) representing a Google group that has been recently
              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
              #    the group is recovered, this value reverts to `group:{emailid}` and the
              #    recovered group retains the role in the binding.
              #
              # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
              #   Deleted single identity in a workforce identity pool. For example,
              #   `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
            "A String",
          ],
          "role": "A String", # Role that is assigned to the list of `members`, or principals.
              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
              #
              # For an overview of the IAM roles and permissions, see the
              # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For
              # a list of the available pre-defined roles, see
              # [here](https://cloud.google.com/iam/docs/understanding-roles).
        },
      ],
      "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
          # prevent simultaneous updates of a policy from overwriting each other.
          # It is strongly suggested that systems make use of the `etag` in the
          # read-modify-write cycle to perform policy updates in order to avoid race
          # conditions: An `etag` is returned in the response to `getIamPolicy`, and
          # systems are expected to put that etag in the request to `setIamPolicy` to
          # ensure that their change will be applied to the same version of the policy.
          #
          # **Important:** If you use IAM Conditions, you must include the `etag` field
          # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
          # you to overwrite a version `3` policy with a version `1` policy, and all of
          # the conditions in the version `3` policy are lost.
      "version": 42, # Specifies the format of the policy.
          #
          # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
          # are rejected.
          #
          # Any operation that affects conditional role bindings must specify version
          # `3`. This requirement applies to the following operations:
          #
          # * Getting a policy that includes a conditional role binding
          # * Adding a conditional role binding to a policy
          # * Changing a conditional role binding in a policy
          # * Removing any role binding, with or without a condition, from a policy
          #   that includes conditions
          #
          # **Important:** If you use IAM Conditions, you must include the `etag` field
          # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
          # you to overwrite a version `3` policy with a version `1` policy, and all of
          # the conditions in the version `3` policy are lost.
          #
          # If a policy does not include any conditions, operations on that policy may
          # specify any valid version or leave the field unset.
          #
          # To learn which resources support conditions in their IAM policies, see the
          # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
    }

`setIamPolicy(project, resource, body=None, x__xgafv=None)`

    Sets the access control policy on the specified resource.
    Replaces any existing policy.
     *Caution* This resource is intended
    for use only by third-party partners who are creatingCloud Marketplace
    images.

    Args:
      project: string, Project ID for this request. (required)
      resource: string, Name or id of the resource for this request. (required)
      body: object, The request body.
        The object takes the form of:

    {
      "bindings": [ # Flatten Policy to create a backward compatible wire-format.
          # Deprecated. Use 'policy' to specify bindings.
        { # Associates `members`, or principals, with a `role`.
          "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
              #
              # If the condition evaluates to `true`, then this binding applies to the
              # current request.
              #
              # If the condition evaluates to `false`, then this binding does not apply to
              # the current request. However, a different role binding might grant the same
              # role to one or more of the principals in this binding.
              #
              # To learn which resources support conditions in their IAM policies, see the
              # [IAM
              # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
              # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
              # are documented at https://github.com/google/cel-spec.
              #
              # Example (Comparison):
              #
              #     title: "Summary size limit"
              #     description: "Determines if a summary is less than 100 chars"
              #     expression: "document.summary.size() < 100"
              #
              # Example (Equality):
              #
              #     title: "Requestor is owner"
              #     description: "Determines if requestor is the document owner"
              #     expression: "document.owner == request.auth.claims.email"
              #
              # Example (Logic):
              #
              #     title: "Public documents"
              #     description: "Determine whether the document should be publicly visible"
              #     expression: "document.type != 'private' && document.type != 'internal'"
              #
              # Example (Data Manipulation):
              #
              #     title: "Notification string"
              #     description: "Create a notification string with a timestamp."
              #     expression: "'New message received at ' + string(document.create_time)"
              #
              # The exact variables and functions that may be referenced within an expression
              # are determined by the service that evaluates it. See the service
              # documentation for additional information.
            "description": "A String", # Optional. Description of the expression. This is a longer text which
                # describes the expression, e.g. when hovered over it in a UI.
            "expression": "A String", # Textual representation of an expression in Common Expression Language
                # syntax.
            "location": "A String", # Optional. String indicating the location of the expression for error
                # reporting, e.g. a file name and a position in the file.
            "title": "A String", # Optional. Title for the expression, i.e. a short string describing
                # its purpose. This can be used e.g. in UIs which allow to enter the
                # expression.
          },
          "members": [ # Specifies the principals requesting access for a Google Cloud resource.
              # `members` can have the following values:
              #
              # * `allUsers`: A special identifier that represents anyone who is
              #    on the internet; with or without a Google account.
              #
              # * `allAuthenticatedUsers`: A special identifier that represents anyone
              #    who is authenticated with a Google account or a service account.
              #    Does not include identities that come from external identity providers
              #    (IdPs) through identity federation.
              #
              # * `user:{emailid}`: An email address that represents a specific Google
              #    account. For example, `alice@example.com` .
              #
              #
              # * `serviceAccount:{emailid}`: An email address that represents a Google
              #    service account. For example,
              #    `my-other-app@appspot.gserviceaccount.com`.
              #
              # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An
              #    identifier for a
              #    [Kubernetes service
              #    account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts).
              #    For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`.
              #
              # * `group:{emailid}`: An email address that represents a Google group.
              #    For example, `admins@example.com`.
              #
              #
              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
              #    users of that domain. For example, `google.com` or `example.com`.
              #
              #
              #
              #
              # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
              #   A single identity in a workforce identity pool.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`:
              #   All workforce identities in a group.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
              #   All workforce identities with a specific attribute value.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`:
              #   All identities in a workforce identity pool.
              #
              # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`:
              #   A single identity in a workload identity pool.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`:
              #   A workload identity pool group.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
              #   All identities in a workload identity pool with a certain attribute.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`:
              #   All identities in a workload identity pool.
              #
              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
              #    identifier) representing a user that has been recently deleted. For
              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
              #    recovered, this value reverts to `user:{emailid}` and the recovered user
              #    retains the role in the binding.
              #
              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
              #    unique identifier) representing a service account that has been recently
              #    deleted. For example,
              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
              #    If the service account is undeleted, this value reverts to
              #    `serviceAccount:{emailid}` and the undeleted service account retains the
              #    role in the binding.
              #
              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
              #    identifier) representing a Google group that has been recently
              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
              #    the group is recovered, this value reverts to `group:{emailid}` and the
              #    recovered group retains the role in the binding.
              #
              # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
              #   Deleted single identity in a workforce identity pool. For example,
              #   `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
            "A String",
          ],
          "role": "A String", # Role that is assigned to the list of `members`, or principals.
              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
              #
              # For an overview of the IAM roles and permissions, see the
              # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For
              # a list of the available pre-defined roles, see
              # [here](https://cloud.google.com/iam/docs/understanding-roles).
        },
      ],
      "etag": "A String", # Flatten Policy to create a backward compatible wire-format.
          # Deprecated. Use 'policy' to specify the etag.
      "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the 'resource'. The size of
          # the policy is limited to a few 10s of KB. An empty policy is in general a
          # valid policy but certain services (like Projects) might reject them.
          # controls for Google Cloud resources.
          #
          #
          # A `Policy` is a collection of `bindings`. A `binding` binds one or more
          # `members`, or principals, to a single `role`. Principals can be user
          # accounts, service accounts, Google groups, and domains (such as G Suite). A
          # `role` is a named list of permissions; each `role` can be an IAM predefined
          # role or a user-created custom role.
          #
          # For some types of Google Cloud resources, a `binding` can also specify a
          # `condition`, which is a logical expression that allows access to a resource
          # only if the expression evaluates to `true`. A condition can add constraints
          # based on attributes of the request, the resource, or both. To learn which
          # resources support conditions in their IAM policies, see the
          # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
          #
          # **JSON example:**
          #
          # ```
          #     {
          #       "bindings": [
          #         {
          #           "role": "roles/resourcemanager.organizationAdmin",
          #           "members": [
          #             "user:mike@example.com",
          #             "group:admins@example.com",
          #             "domain:google.com",
          #             "serviceAccount:my-project-id@appspot.gserviceaccount.com"
          #           ]
          #         },
          #         {
          #           "role": "roles/resourcemanager.organizationViewer",
          #           "members": [
          #             "user:eve@example.com"
          #           ],
          #           "condition": {
          #             "title": "expirable access",
          #             "description": "Does not grant access after Sep 2020",
          #             "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
          #           }
          #         }
          #       ],
          #       "etag": "BwWWja0YfJA=",
          #       "version": 3
          #     }
          # ```
          #
          # **YAML example:**
          #
          # ```
          #     bindings:
          #     - members:
          #       - user:mike@example.com
          #       - group:admins@example.com
          #       - domain:google.com
          #       - serviceAccount:my-project-id@appspot.gserviceaccount.com
          #       role: roles/resourcemanager.organizationAdmin
          #     - members:
          #       - user:eve@example.com
          #       role: roles/resourcemanager.organizationViewer
          #       condition:
          #         title: expirable access
          #         description: Does not grant access after Sep 2020
          #         expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
          #     etag: BwWWja0YfJA=
          #     version: 3
          # ```
          #
          # For a description of IAM and its features, see the
          # [IAM documentation](https://cloud.google.com/iam/docs/).
        "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
          { # Specifies the audit configuration for a service.
              # The configuration determines which permission types are logged, and what
              # identities, if any, are exempted from logging.
              # An AuditConfig must have one or more AuditLogConfigs.
              #
              # If there are AuditConfigs for both `allServices` and a specific service,
              # the union of the two AuditConfigs is used for that service: the log_types
              # specified in each AuditConfig are enabled, and the exempted_members in each
              # AuditLogConfig are exempted.
              #
              # Example Policy with multiple AuditConfigs:
              #
              #     {
              #       "audit_configs": [
              #         {
              #           "service": "allServices",
              #           "audit_log_configs": [
              #             {
              #               "log_type": "DATA_READ",
              #               "exempted_members": [
              #                 "user:jose@example.com"
              #               ]
              #             },
              #             {
              #               "log_type": "DATA_WRITE"
              #             },
              #             {
              #               "log_type": "ADMIN_READ"
              #             }
              #           ]
              #         },
              #         {
              #           "service": "sampleservice.googleapis.com",
              #           "audit_log_configs": [
              #             {
              #               "log_type": "DATA_READ"
              #             },
              #             {
              #               "log_type": "DATA_WRITE",
              #               "exempted_members": [
              #                 "user:aliya@example.com"
              #               ]
              #             }
              #           ]
              #         }
              #       ]
              #     }
              #
              # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
              # logging. It also exempts `jose@example.com` from DATA_READ logging, and
              # `aliya@example.com` from DATA_WRITE logging.
            "auditLogConfigs": [ # The configuration for logging of each type of permission.
              { # Provides the configuration for logging a type of permissions.
                  # Example:
                  #
                  #     {
                  #       "audit_log_configs": [
                  #         {
                  #           "log_type": "DATA_READ",
                  #           "exempted_members": [
                  #             "user:jose@example.com"
                  #           ]
                  #         },
                  #         {
                  #           "log_type": "DATA_WRITE"
                  #         }
                  #       ]
                  #     }
                  #
                  # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
                  # jose@example.com from DATA_READ logging.
                "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of
                    # permission.
                    # Follows the same format of Binding.members.
                  "A String",
                ],
                "logType": "A String", # The log type that this config enables.
              },
            ],
            "service": "A String", # Specifies a service that will be enabled for audit logging.
                # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
                # `allServices` is a special value that covers all services.
          },
        ],
        "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally,
            # may specify a `condition` that determines how and when the `bindings` are
            # applied. Each of the `bindings` must contain at least one principal.
            #
            # The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
            # of these principals can be Google groups. Each occurrence of a principal
            # counts towards these limits. For example, if the `bindings` grant 50
            # different roles to `user:alice@example.com`, and not to any other
            # principal, then you can add another 1,450 principals to the `bindings` in
            # the `Policy`.
          { # Associates `members`, or principals, with a `role`.
            "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
                #
                # If the condition evaluates to `true`, then this binding applies to the
                # current request.
                #
                # If the condition evaluates to `false`, then this binding does not apply to
                # the current request. However, a different role binding might grant the same
                # role to one or more of the principals in this binding.
                #
                # To learn which resources support conditions in their IAM policies, see the
                # [IAM
                # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
                # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
                # are documented at https://github.com/google/cel-spec.
                #
                # Example (Comparison):
                #
                #     title: "Summary size limit"
                #     description: "Determines if a summary is less than 100 chars"
                #     expression: "document.summary.size() < 100"
                #
                # Example (Equality):
                #
                #     title: "Requestor is owner"
                #     description: "Determines if requestor is the document owner"
                #     expression: "document.owner == request.auth.claims.email"
                #
                # Example (Logic):
                #
                #     title: "Public documents"
                #     description: "Determine whether the document should be publicly visible"
                #     expression: "document.type != 'private' && document.type != 'internal'"
                #
                # Example (Data Manipulation):
                #
                #     title: "Notification string"
                #     description: "Create a notification string with a timestamp."
                #     expression: "'New message received at ' + string(document.create_time)"
                #
                # The exact variables and functions that may be referenced within an expression
                # are determined by the service that evaluates it. See the service
                # documentation for additional information.
              "description": "A String", # Optional. Description of the expression. This is a longer text which
                  # describes the expression, e.g. when hovered over it in a UI.
              "expression": "A String", # Textual representation of an expression in Common Expression Language
                  # syntax.
              "location": "A String", # Optional. String indicating the location of the expression for error
                  # reporting, e.g. a file name and a position in the file.
              "title": "A String", # Optional. Title for the expression, i.e. a short string describing
                  # its purpose. This can be used e.g. in UIs which allow to enter the
                  # expression.
            },
            "members": [ # Specifies the principals requesting access for a Google Cloud resource.
                # `members` can have the following values:
                #
                # * `allUsers`: A special identifier that represents anyone who is
                #    on the internet; with or without a Google account.
                #
                # * `allAuthenticatedUsers`: A special identifier that represents anyone
                #    who is authenticated with a Google account or a service account.
                #    Does not include identities that come from external identity providers
                #    (IdPs) through identity federation.
                #
                # * `user:{emailid}`: An email address that represents a specific Google
                #    account. For example, `alice@example.com` .
                #
                #
                # * `serviceAccount:{emailid}`: An email address that represents a Google
                #    service account. For example,
                #    `my-other-app@appspot.gserviceaccount.com`.
                #
                # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An
                #    identifier for a
                #    [Kubernetes service
                #    account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts).
                #    For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`.
                #
                # * `group:{emailid}`: An email address that represents a Google group.
                #    For example, `admins@example.com`.
                #
                #
                # * `domain:{domain}`: The G Suite domain (primary) that represents all the
                #    users of that domain. For example, `google.com` or `example.com`.
                #
                #
                #
                #
                # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
                #   A single identity in a workforce identity pool.
                #
                # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`:
                #   All workforce identities in a group.
                #
                # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
                #   All workforce identities with a specific attribute value.
                #
                # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`:
                #   All identities in a workforce identity pool.
                #
                # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`:
                #   A single identity in a workload identity pool.
                #
                # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`:
                #   A workload identity pool group.
                #
                # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
                #   All identities in a workload identity pool with a certain attribute.
                #
                # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`:
                #   All identities in a workload identity pool.
                #
                # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
                #    identifier) representing a user that has been recently deleted. For
                #    example, `alice@example.com?uid=123456789012345678901`. If the user is
                #    recovered, this value reverts to `user:{emailid}` and the recovered user
                #    retains the role in the binding.
                #
                # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
                #    unique identifier) representing a service account that has been recently
                #    deleted. For example,
                #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
                #    If the service account is undeleted, this value reverts to
                #    `serviceAccount:{emailid}` and the undeleted service account retains the
                #    role in the binding.
                #
                # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
                #    identifier) representing a Google group that has been recently
                #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
                #    the group is recovered, this value reverts to `group:{emailid}` and the
                #    recovered group retains the role in the binding.
                #
                # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
                #   Deleted single identity in a workforce identity pool. For example,
                #   `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
              "A String",
            ],
            "role": "A String", # Role that is assigned to the list of `members`, or principals.
                # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
                #
                # For an overview of the IAM roles and permissions, see the
                # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For
                # a list of the available pre-defined roles, see
                # [here](https://cloud.google.com/iam/docs/understanding-roles).
          },
        ],
        "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
            # prevent simultaneous updates of a policy from overwriting each other.
            # It is strongly suggested that systems make use of the `etag` in the
            # read-modify-write cycle to perform policy updates in order to avoid race
            # conditions: An `etag` is returned in the response to `getIamPolicy`, and
            # systems are expected to put that etag in the request to `setIamPolicy` to
            # ensure that their change will be applied to the same version of the policy.
            #
            # **Important:** If you use IAM Conditions, you must include the `etag` field
            # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
            # you to overwrite a version `3` policy with a version `1` policy, and all of
            # the conditions in the version `3` policy are lost.
        "version": 42, # Specifies the format of the policy.
            #
            # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
            # are rejected.
            #
            # Any operation that affects conditional role bindings must specify version
            # `3`. This requirement applies to the following operations:
            #
            # * Getting a policy that includes a conditional role binding
            # * Adding a conditional role binding to a policy
            # * Changing a conditional role binding in a policy
            # * Removing any role binding, with or without a condition, from a policy
            #   that includes conditions
            #
            # **Important:** If you use IAM Conditions, you must include the `etag` field
            # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
            # you to overwrite a version `3` policy with a version `1` policy, and all of
            # the conditions in the version `3` policy are lost.
            #
            # If a policy does not include any conditions, operations on that policy may
            # specify any valid version or leave the field unset.
            #
            # To learn which resources support conditions in their IAM policies, see the
            # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
      },
    }

      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # An Identity and Access Management (IAM) policy, which specifies access
        # controls for Google Cloud resources.
        #
        #
        # A `Policy` is a collection of `bindings`. A `binding` binds one or more
        # `members`, or principals, to a single `role`. Principals can be user
        # accounts, service accounts, Google groups, and domains (such as G Suite). A
        # `role` is a named list of permissions; each `role` can be an IAM predefined
        # role or a user-created custom role.
        #
        # For some types of Google Cloud resources, a `binding` can also specify a
        # `condition`, which is a logical expression that allows access to a resource
        # only if the expression evaluates to `true`. A condition can add constraints
        # based on attributes of the request, the resource, or both. To learn which
        # resources support conditions in their IAM policies, see the
        # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
        #
        # **JSON example:**
        #
        # ```
        #     {
        #       "bindings": [
        #         {
        #           "role": "roles/resourcemanager.organizationAdmin",
        #           "members": [
        #             "user:mike@example.com",
        #             "group:admins@example.com",
        #             "domain:google.com",
        #             "serviceAccount:my-project-id@appspot.gserviceaccount.com"
        #           ]
        #         },
        #         {
        #           "role": "roles/resourcemanager.organizationViewer",
        #           "members": [
        #             "user:eve@example.com"
        #           ],
        #           "condition": {
        #             "title": "expirable access",
        #             "description": "Does not grant access after Sep 2020",
        #             "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
        #           }
        #         }
        #       ],
        #       "etag": "BwWWja0YfJA=",
        #       "version": 3
        #     }
        # ```
        #
        # **YAML example:**
        #
        # ```
        #     bindings:
        #     - members:
        #       - user:mike@example.com
        #       - group:admins@example.com
        #       - domain:google.com
        #       - serviceAccount:my-project-id@appspot.gserviceaccount.com
        #       role: roles/resourcemanager.organizationAdmin
        #     - members:
        #       - user:eve@example.com
        #       role: roles/resourcemanager.organizationViewer
        #       condition:
        #         title: expirable access
        #         description: Does not grant access after Sep 2020
        #         expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
        #     etag: BwWWja0YfJA=
        #     version: 3
        # ```
        #
        # For a description of IAM and its features, see the
        # [IAM documentation](https://cloud.google.com/iam/docs/).
      "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
        { # Specifies the audit configuration for a service.
            # The configuration determines which permission types are logged, and what
            # identities, if any, are exempted from logging.
            # An AuditConfig must have one or more AuditLogConfigs.
            #
            # If there are AuditConfigs for both `allServices` and a specific service,
            # the union of the two AuditConfigs is used for that service: the log_types
            # specified in each AuditConfig are enabled, and the exempted_members in each
            # AuditLogConfig are exempted.
            #
            # Example Policy with multiple AuditConfigs:
            #
            #     {
            #       "audit_configs": [
            #         {
            #           "service": "allServices",
            #           "audit_log_configs": [
            #             {
            #               "log_type": "DATA_READ",
            #               "exempted_members": [
            #                 "user:jose@example.com"
            #               ]
            #             },
            #             {
            #               "log_type": "DATA_WRITE"
            #             },
            #             {
            #               "log_type": "ADMIN_READ"
            #             }
            #           ]
            #         },
            #         {
            #           "service": "sampleservice.googleapis.com",
            #           "audit_log_configs": [
            #             {
            #               "log_type": "DATA_READ"
            #             },
            #             {
            #               "log_type": "DATA_WRITE",
            #               "exempted_members": [
            #                 "user:aliya@example.com"
            #               ]
            #             }
            #           ]
            #         }
            #       ]
            #     }
            #
            # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
            # logging. It also exempts `jose@example.com` from DATA_READ logging, and
            # `aliya@example.com` from DATA_WRITE logging.
          "auditLogConfigs": [ # The configuration for logging of each type of permission.
            { # Provides the configuration for logging a type of permissions.
                # Example:
                #
                #     {
                #       "audit_log_configs": [
                #         {
                #           "log_type": "DATA_READ",
                #           "exempted_members": [
                #             "user:jose@example.com"
                #           ]
                #         },
                #         {
                #           "log_type": "DATA_WRITE"
                #         }
                #       ]
                #     }
                #
                # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
                # jose@example.com from DATA_READ logging.
              "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of
                  # permission.
                  # Follows the same format of Binding.members.
                "A String",
              ],
              "logType": "A String", # The log type that this config enables.
            },
          ],
          "service": "A String", # Specifies a service that will be enabled for audit logging.
              # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
              # `allServices` is a special value that covers all services.
        },
      ],
      "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally,
          # may specify a `condition` that determines how and when the `bindings` are
          # applied. Each of the `bindings` must contain at least one principal.
          #
          # The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
          # of these principals can be Google groups. Each occurrence of a principal
          # counts towards these limits. For example, if the `bindings` grant 50
          # different roles to `user:alice@example.com`, and not to any other
          # principal, then you can add another 1,450 principals to the `bindings` in
          # the `Policy`.
        { # Associates `members`, or principals, with a `role`.
          "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
              #
              # If the condition evaluates to `true`, then this binding applies to the
              # current request.
              #
              # If the condition evaluates to `false`, then this binding does not apply to
              # the current request. However, a different role binding might grant the same
              # role to one or more of the principals in this binding.
              #
              # To learn which resources support conditions in their IAM policies, see the
              # [IAM
              # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
              # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
              # are documented at https://github.com/google/cel-spec.
              #
              # Example (Comparison):
              #
              #     title: "Summary size limit"
              #     description: "Determines if a summary is less than 100 chars"
              #     expression: "document.summary.size() < 100"
              #
              # Example (Equality):
              #
              #     title: "Requestor is owner"
              #     description: "Determines if requestor is the document owner"
              #     expression: "document.owner == request.auth.claims.email"
              #
              # Example (Logic):
              #
              #     title: "Public documents"
              #     description: "Determine whether the document should be publicly visible"
              #     expression: "document.type != 'private' && document.type != 'internal'"
              #
              # Example (Data Manipulation):
              #
              #     title: "Notification string"
              #     description: "Create a notification string with a timestamp."
              #     expression: "'New message received at ' + string(document.create_time)"
              #
              # The exact variables and functions that may be referenced within an expression
              # are determined by the service that evaluates it. See the service
              # documentation for additional information.
            "description": "A String", # Optional. Description of the expression. This is a longer text which
                # describes the expression, e.g. when hovered over it in a UI.
            "expression": "A String", # Textual representation of an expression in Common Expression Language
                # syntax.
            "location": "A String", # Optional. String indicating the location of the expression for error
                # reporting, e.g. a file name and a position in the file.
            "title": "A String", # Optional. Title for the expression, i.e. a short string describing
                # its purpose. This can be used e.g. in UIs which allow to enter the
                # expression.
          },
          "members": [ # Specifies the principals requesting access for a Google Cloud resource.
              # `members` can have the following values:
              #
              # * `allUsers`: A special identifier that represents anyone who is
              #    on the internet; with or without a Google account.
              #
              # * `allAuthenticatedUsers`: A special identifier that represents anyone
              #    who is authenticated with a Google account or a service account.
              #    Does not include identities that come from external identity providers
              #    (IdPs) through identity federation.
              #
              # * `user:{emailid}`: An email address that represents a specific Google
              #    account. For example, `alice@example.com` .
              #
              #
              # * `serviceAccount:{emailid}`: An email address that represents a Google
              #    service account. For example,
              #    `my-other-app@appspot.gserviceaccount.com`.
              #
              # * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An
              #    identifier for a
              #    [Kubernetes service
              #    account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts).
              #    For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`.
              #
              # * `group:{emailid}`: An email address that represents a Google group.
              #    For example, `admins@example.com`.
              #
              #
              # * `domain:{domain}`: The G Suite domain (primary) that represents all the
              #    users of that domain. For example, `google.com` or `example.com`.
              #
              #
              #
              #
              # * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
              #   A single identity in a workforce identity pool.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`:
              #   All workforce identities in a group.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
              #   All workforce identities with a specific attribute value.
              #
              # * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`:
              #   All identities in a workforce identity pool.
              #
              # * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`:
              #   A single identity in a workload identity pool.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`:
              #   A workload identity pool group.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`:
              #   All identities in a workload identity pool with a certain attribute.
              #
              # * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`:
              #   All identities in a workload identity pool.
              #
              # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
              #    identifier) representing a user that has been recently deleted. For
              #    example, `alice@example.com?uid=123456789012345678901`. If the user is
              #    recovered, this value reverts to `user:{emailid}` and the recovered user
              #    retains the role in the binding.
              #
              # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
              #    unique identifier) representing a service account that has been recently
              #    deleted. For example,
              #    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
              #    If the service account is undeleted, this value reverts to
              #    `serviceAccount:{emailid}` and the undeleted service account retains the
              #    role in the binding.
              #
              # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
              #    identifier) representing a Google group that has been recently
              #    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
              #    the group is recovered, this value reverts to `group:{emailid}` and the
              #    recovered group retains the role in the binding.
              #
              # * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`:
              #   Deleted single identity in a workforce identity pool. For example,
              #   `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
            "A String",
          ],
          "role": "A String", # Role that is assigned to the list of `members`, or principals.
              # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
              #
              # For an overview of the IAM roles and permissions, see the
              # [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For
              # a list of the available pre-defined roles, see
              # [here](https://cloud.google.com/iam/docs/understanding-roles).
        },
      ],
      "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
          # prevent simultaneous updates of a policy from overwriting each other.
          # It is strongly suggested that systems make use of the `etag` in the
          # read-modify-write cycle to perform policy updates in order to avoid race
          # conditions: An `etag` is returned in the response to `getIamPolicy`, and
          # systems are expected to put that etag in the request to `setIamPolicy` to
          # ensure that their change will be applied to the same version of the policy.
          #
          # **Important:** If you use IAM Conditions, you must include the `etag` field
          # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
          # you to overwrite a version `3` policy with a version `1` policy, and all of
          # the conditions in the version `3` policy are lost.
      "version": 42, # Specifies the format of the policy.
          #
          # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
          # are rejected.
          #
          # Any operation that affects conditional role bindings must specify version
          # `3`. This requirement applies to the following operations:
          #
          # * Getting a policy that includes a conditional role binding
          # * Adding a conditional role binding to a policy
          # * Changing a conditional role binding in a policy
          # * Removing any role binding, with or without a condition, from a policy
          #   that includes conditions
          #
          # **Important:** If you use IAM Conditions, you must include the `etag` field
          # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
          # you to overwrite a version `3` policy with a version `1` policy, and all of
          # the conditions in the version `3` policy are lost.
          #
          # If a policy does not include any conditions, operations on that policy may
          # specify any valid version or leave the field unset.
          #
          # To learn which resources support conditions in their IAM policies, see the
          # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
    }

`testIamPermissions(project, resource, body=None, x__xgafv=None)`

    Returns permissions that a caller has on the specified resource.
     *Caution* This resource is intended
    for use only by third-party partners who are creatingCloud Marketplace
    images.

    Args:
      project: string, Project ID for this request. (required)
      resource: string, Name or id of the resource for this request. (required)
      body: object, The request body.
        The object takes the form of:

    {
      "permissions": [ # The set of permissions to check for the 'resource'. Permissions with
          # wildcards (such as '*' or 'storage.*') are not allowed.
        "A String",
      ],
    }

      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        {
      "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is
          # allowed.
        "A String",
      ],
    }