8000 IAM: re-add testing permissions by melaniedejong · Pull Request #2494 · GoogleCloudPlatform/python-docs-samples · GitHub
[go: up one dir, main page]
Skip to content

IAM: re-add testing permissions #2494

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 23, 2019
Merged

IAM: re-add testing permissions #2494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8d99830
Added test_permissions function and tests for this doc: https://cloud…
melaniedejong Oct 1, 2019
b52f455
Adding access tests
melaniedejong Oct 2, 2019
a36a245
Lint
melaniedejong Oct 2, 2019
8baca11
Lint
melaniedejong Oct 2, 2019
de6433d
Lint
melaniedejong Oct 2, 2019
7056e09
Lint
melaniedejong Oct 2, 2019
9c2709e
Merge pull request #1 from GoogleCloudPlatform/master
melaniedejong Oct 23, 2019
4cf6a02
Fix spacing
melaniedejong Oct 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 32 additions & 4 deletions iam/api-client/access.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
# !/usr/bin/env python
#
# Copyright 2018 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
Expand Down Expand Up @@ -31,7 +29,6 @@
def get_policy(project_id):
"""Gets IAM policy for a project."""

# pylint: disable=no-member
credentials = service_account.Credentials.from_service_account_file(
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
scopes=['https://www.googleapis.com/auth/cloud-platform'])
Expand Down Expand Up @@ -84,7 +81,6 @@ def modify_policy_remove_member(policy, role, member):
def set_policy(project_id, policy):
"""Sets IAM policy for a project."""

# pylint: disable=no-member
credentials = service_account.Credentials.from_service_account_file(
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
scopes=['https://www.googleapis.com/auth/cloud-platform'])
Expand All @@ -100,6 +96,31 @@ def set_policy(project_id, policy):
# [END iam_set_policy]


# [START iam_test_permissions]
def test_permissions(project_id):
"""Tests IAM permissions of the caller"""

credentials = service_account.Credentials.from_service_account_file(
filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
scopes=['https://www.googleapis.com/auth/cloud-platform'])
service = googleapiclient.discovery.build(
'cloudresourcemanager', 'v1', credentials=credentials)

permissions = {
"permissions": [
"resourcemanager.projects.get",
"resourcemanager.projects.delete"
]
}

request = service.projects().testIamPermissions(
resource=project_id, body=permissions)
returnedPermissions = request.execute()
print(returnedPermissions)
return returnedPermissions
# [END iam_test_permissions]


def main():
parser = argparse.ArgumentParser(
description=__doc__,
Expand Down Expand Up @@ -140,6 +161,11 @@ def main():
set_parser.add_argument('project_id')
set_parser.add_argument('policy')

# Test permissions
test_permissions_parser = subparsers.add_parser(
'test_permissions', help=get_policy.__doc__)
test_permissions_parser.add_argument('project_id')

args = parser.parse_args()

if args.command == 'get':
Expand All @@ -152,6 +178,8 @@ def main():
modify_policy_remove_member(args.policy, args.role, args.member)
elif args.command == 'add_binding':
modify_policy_add_role(args.policy, args.role, args.member)
elif args.command == 'test_permissions':
test_permissions(args.project_id)


if __name__ == '__main__':
Expand Down
4 changes: 4 additions & 0 deletions iam/api-client/access_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,10 @@ def test_access(capsys):
out, _ = capsys.readouterr()
assert u'etag' in out

access.test_permissions(project_id)
out, _ = capsys.readouterr()
assert u'permissions' in out

# deleting the service account created above
service_accounts.delete_service_account(
email)
0