Skip to content
This repository was archived by the owner on Feb 28, 2024. It is now read-only.

Commit 0a14f25

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
fix: disable always_use_jwt_access (#217)
fix: disable always_use_jwt_access Committer: @busunkim96 PiperOrigin-RevId: 382142900 Source-Link: googleapis/googleapis@513440f Source-Link: https://github.com/googleapis/googleapis-gen/commit/7b1e2c31233f79a704ec21ca410bf661d6bc68d0 feat: add new searchable fields (memberTypes, roles, project, folders and organization) in SearchAllIamPolicies feat: new request fields (assetTypes and orderBy) in SearchAllIamPolicies feat: new response fields (assetType, folders and organization) in SearchAllIamPolicies feat: add always_use_jwt_access
1 parent e193289 commit 0a14f25

28 files changed

Lines changed: 405 additions & 641 deletions

File tree

‎.coveragerc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
branch = True
33

44
[report]
5-
fail_under = 100
65
show_missing = True
76
omit =
87
google/cloud/asset/__init__.py

‎google/cloud/asset_v1/services/asset_service/async_client.py‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -955,12 +955,11 @@ async def search_all_resources(
955955
maximum=60.0,
956956
multiplier=1.3,
957957
predicate=retries.if_exception_type(
958-
core_exceptions.DeadlineExceeded,
959958
core_exceptions.ServiceUnavailable,
960959
),
961-
deadline=15.0,
960+
deadline=30.0,
962961
),
963-
default_timeout=15.0,
962+
default_timeout=30.0,
964963
client_info=DEFAULT_CLIENT_INFO,
965964
)
966965

@@ -1067,6 +1066,10 @@ async def search_all_iam_policies(
10671066
find IAM policy bindings that are set on resources
10681067
"instance1" or "instance2" and also specify user
10691068
"amy".
1069+
- ``roles:roles/compute.admin`` to find IAM policy
1070+
bindings that specify the Compute Admin role.
1071+
- ``memberTypes:user`` to find IAM policy bindings that
1072+
contain the "user" member type.
10701073
10711074
This corresponds to the ``query`` field
10721075
on the ``request`` instance; if ``request`` is provided, this
@@ -1113,12 +1116,11 @@ async def search_all_iam_policies(
11131116
maximum=60.0,
11141117
multiplier=1.3,
11151118
predicate=retries.if_exception_type(
1116-
core_exceptions.DeadlineExceeded,
11171119
core_exceptions.ServiceUnavailable,
11181120
),
1119-
deadline=15.0,
1121+
deadline=30.0,
11201122
),
1121-
default_timeout=15.0,
1123+
default_timeout=30.0,
11221124
client_info=DEFAULT_CLIENT_INFO,
11231125
)
11241126

‎google/cloud/asset_v1/services/asset_service/client.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1194,6 +1194,10 @@ def search_all_iam_policies(
11941194
find IAM policy bindings that are set on resources
11951195
"instance1" or "instance2" and also specify user
11961196
"amy".
1197+
- ``roles:roles/compute.admin`` to find IAM policy
1198+
bindings that specify the Compute Admin role.
1199+
- ``memberTypes:user`` to find IAM policy bindings that
1200+
contain the "user" member type.
11971201
11981202
This corresponds to the ``query`` field
11991203
on the ``request`` instance; if ``request`` is provided, this

‎google/cloud/asset_v1/services/asset_service/transports/base.py‎

Lines changed: 19 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
from google.api_core import retry as retries # type: ignore
2626
from google.api_core import operations_v1 # type: ignore
2727
from google.auth import credentials as ga_credentials # type: ignore
28+
from google.oauth2 import service_account # type: ignore
2829

2930
from google.cloud.asset_v1.types import asset_service
3031
from google.longrunning import operations_pb2 # type: ignore
@@ -46,8 +47,6 @@
4647
except pkg_resources.DistributionNotFound: # pragma: NO COVER
4748
_GOOGLE_AUTH_VERSION = None
4849

49-
_API_CORE_VERSION = google.api_core.__version__
50-
5150

5251
class AssetServiceTransport(abc.ABC):
5352
"""Abstract transport class for AssetService."""
@@ -65,6 +64,7 @@ def __init__(
6564
scopes: Optional[Sequence[str]] = None,
6665
quota_project_id: Optional[str] = None,
6766
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
67+
always_use_jwt_access: Optional[bool] = False,
6868
**kwargs,
6969
) -> None:
7070
"""Instantiate the transport.
@@ -88,6 +88,8 @@ def __init__(
8888
API requests. If ``None``, then default info will be used.
8989
Generally, you only need to set this if you're developing
9090
your own client library.
91+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
92+
be used for service account credentials.
9193
"""
9294
# Save the hostname. Default to port 443 (HTTPS) if none is specified.
9395
if ":" not in host:
@@ -97,7 +99,7 @@ def __init__(
9799
scopes_kwargs = self._get_scopes_kwargs(self._host, scopes)
98100

99101
# Save the scopes.
100-
self._scopes = scopes or self.AUTH_SCOPES
102+
self._scopes = scopes
101103

102104
# If no credentials are provided, then determine the appropriate
103105
# defaults.
@@ -116,13 +118,20 @@ def __init__(
116118
**scopes_kwargs, quota_project_id=quota_project_id
117119
)
118120

121+
# If the credentials is service account credentials, then always try to use self signed JWT.
122+
if (
123+
always_use_jwt_access
124+
and isinstance(credentials, service_account.Credentials)
125+
and hasattr(service_account.Credentials, "with_always_use_jwt_access")
126+
):
127+
credentials = credentials.with_always_use_jwt_access(True)
128+
119129
# Save the credentials.
120130
self._credentials = credentials
121131

122-
# TODO(busunkim): These two class methods are in the base transport
132+
# TODO(busunkim): This method is in the base transport
123133
# to avoid duplicating code across the transport classes. These functions
124-
# should be deleted once the minimum required versions of google-api-core
125-
# and google-auth are increased.
134+
# should be deleted once the minimum required versions of google-auth is increased.
126135

127136
# TODO: Remove this function once google-auth >= 1.25.0 is required
128137
@classmethod
@@ -143,27 +152,6 @@ def _get_scopes_kwargs(
143152

144153
return scopes_kwargs
145154

146-
# TODO: Remove this function once google-api-core >= 1.26.0 is required
147-
@classmethod
148-
def _get_self_signed_jwt_kwargs(
149-
cls, host: str, scopes: Optional[Sequence[str]]
150-
) -> Dict[str, Union[Optional[Sequence[str]], str]]:
151-
"""Returns kwargs to pass to grpc_helpers.create_channel depending on the google-api-core version"""
152-
153-
self_signed_jwt_kwargs: Dict[str, Union[Optional[Sequence[str]], str]] = {}
154-
155-
if _API_CORE_VERSION and (
156-
packaging.version.parse(_API_CORE_VERSION)
157-
>= packaging.version.parse("1.26.0")
158-
):
159-
self_signed_jwt_kwargs["default_scopes"] = cls.AUTH_SCOPES
160-
self_signed_jwt_kwargs["scopes"] = scopes
161-
self_signed_jwt_kwargs["default_host"] = cls.DEFAULT_HOST
162-
else:
163-
self_signed_jwt_kwargs["scopes"] = scopes or cls.AUTH_SCOPES
164-
165-
return self_signed_jwt_kwargs
166-
167155
def _prep_wrapped_messages(self, client_info):
168156
# Precompute the wrapped methods.
169157
self._wrapped_methods = {
@@ -258,12 +246,11 @@ def _prep_wrapped_messages(self, client_info):
258246
maximum=60.0,
259247
multiplier=1.3,
260248
predicate=retries.if_exception_type(
261-
core_exceptions.DeadlineExceeded,
262249
core_exceptions.ServiceUnavailable,
263250
),
264-
deadline=15.0,
251+
deadline=30.0,
265252
),
266-
default_timeout=15.0,
253+
default_timeout=30.0,
267254
client_info=client_info,
268255
),
269256
self.search_all_iam_policies: gapic_v1.method.wrap_method(
@@ -273,12 +260,11 @@ def _prep_wrapped_messages(self, client_info):
273260
maximum=60.0,
274261
multiplier=1.3,
275262
predicate=retries.if_exception_type(
276-
core_exceptions.DeadlineExceeded,
277263
core_exceptions.ServiceUnavailable,
278264
),
279-
deadline=15.0,
265+
deadline=30.0,
280266
),
281-
default_timeout=15.0,
267+
default_timeout=30.0,
282268
client_info=client_info,
283269
),
284270
self.analyze_iam_policy: gapic_v1.method.wrap_method(

‎google/cloud/asset_v1/services/asset_service/transports/grpc.py‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ def __init__(
6060
client_cert_source_for_mtls: Callable[[], Tuple[bytes, bytes]] = None,
6161
quota_project_id: Optional[str] = None,
6262
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
63+
always_use_jwt_access: Optional[bool] = False,
6364
) -> None:
6465
"""Instantiate the transport.
6566
@@ -100,6 +101,8 @@ def __init__(
100101
API requests. If ``None``, then default info will be used.
101102
Generally, you only need to set this if you're developing
102103
your own client library.
104+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
105+
be used for service account credentials.
103106
104107
Raises:
105108
google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
@@ -153,6 +156,7 @@ def __init__(
153156
scopes=scopes,
154157
quota_project_id=quota_project_id,
155158
client_info=client_info,
159+
always_use_jwt_access=always_use_jwt_access,
156160
)
157161

158162
if not self._grpc_channel:
@@ -208,14 +212,14 @@ def create_channel(
208212
and ``credentials_file`` are passed.
209213
"""
210214

211-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
212-
213215
return grpc_helpers.create_channel(
214216
host,
215217
credentials=credentials,
216218
credentials_file=credentials_file,
217219
quota_project_id=quota_project_id,
218-
**self_signed_jwt_kwargs,
220+
default_scopes=cls.AUTH_SCOPES,
221+
scopes=scopes,
222+
default_host=cls.DEFAULT_HOST,
219223
**kwargs,
220224
)
221225

‎google/cloud/asset_v1/services/asset_service/transports/grpc_asyncio.py‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,14 +81,14 @@ def create_channel(
8181
aio.Channel: A gRPC AsyncIO channel object.
8282
"""
8383

84-
self_signed_jwt_kwargs = cls._get_self_signed_jwt_kwargs(host, scopes)
85-
8684
return grpc_helpers_async.create_channel(
8785
host,
8886
credentials=credentials,
8987
credentials_file=credentials_file,
9088
quota_project_id=quota_project_id,
91-
**self_signed_jwt_kwargs,
89+
default_scopes=cls.AUTH_SCOPES,
90+
scopes=scopes,
91+
default_host=cls.DEFAULT_HOST,
9292
**kwargs,
9393
)
9494

@@ -106,6 +106,7 @@ def __init__(
106106
client_cert_source_for_mtls: Callable[[], Tuple[bytes, bytes]] = None,
107107
quota_project_id=None,
108108
client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
109+
always_use_jwt_access: Optional[bool] = False,
109110
) -> None:
110111
"""Instantiate the transport.
111112
@@ -147,6 +148,8 @@ def __init__(
147148
API requests. If ``None``, then default info will be used.
148149
Generally, you only need to set this if you're developing
149150
your own client library.
151+
always_use_jwt_access (Optional[bool]): Whether self signed JWT should
152+
be used for service account credentials.
150153
151154
Raises:
152155
google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
@@ -199,6 +202,7 @@ def __init__(
199202
scopes=scopes,
200203
quota_project_id=quota_project_id,
201204
client_info=client_info,
205+
always_use_jwt_access=always_use_jwt_access,
202206
)
203207

204208
if not self._grpc_channel:

‎google/cloud/asset_v1/types/asset_service.py‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -879,6 +879,10 @@ class SearchAllIamPoliciesRequest(proto.Message):
879879
- ``resource:(instance1 OR instance2) policy:amy`` to find
880880
IAM policy bindings that are set on resources "instance1"
881881
or "instance2" and also specify user "amy".
882+
- ``roles:roles/compute.admin`` to find IAM policy bindings
883+
that specify the Compute Admin role.
884+
- ``memberTypes:user`` to find IAM policy bindings that
885+
contain the "user" member type.
882886
page_size (int):
883887
Optional. The page size for search result pagination. Page
884888
size is capped at 500 even if a larger value is given. If
@@ -892,12 +896,47 @@ class SearchAllIamPoliciesRequest(proto.Message):
892896
be the value of ``next_page_token`` from the previous
893897
response. The values of all other method parameters must be
894898
identical to those in the previous call.
899+
asset_types (Sequence[str]):
900+
Optional. A list of asset types that the IAM policies are
901+
attached to. If empty, it will search the IAM policies that
902+
are attached to all the `searchable asset
903+
types <https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types>`__.
904+
905+
Regular expressions are also supported. For example:
906+
907+
- "compute.googleapis.com.*" snapshots IAM policies
908+
attached to asset type starts with
909+
"compute.googleapis.com".
910+
- ".*Instance" snapshots IAM policies attached to asset
911+
type ends with "Instance".
912+
- ".*Instance.*" snapshots IAM policies attached to asset
913+
type contains "Instance".
914+
915+
See `RE2 <https://github.com/google/re2/wiki/Syntax>`__ for
916+
all supported regular expression syntax. If the regular
917+
expression does not match any supported asset type, an
918+
INVALID_ARGUMENT error will be returned.
919+
order_by (str):
920+
Optional. A comma-separated list of fields specifying the
921+
sorting order of the results. The default order is
922+
ascending. Add " DESC" after the field name to indicate
923+
descending order. Redundant space characters are ignored.
924+
Example: "assetType DESC, resource". Only singular primitive
925+
fields in the response are sortable:
926+
927+
- resource
928+
- assetType
929+
- project All the other fields such as repeated fields
930+
(e.g., ``folders``) and non-primitive fields (e.g.,
931+
``policy``) are not supported.
895932
"""
896933

897934
scope = proto.Field(proto.STRING, number=1,)
898935
query = proto.Field(proto.STRING, number=2,)
899936
page_size = proto.Field(proto.INT32, number=3,)
900937
page_token = proto.Field(proto.STRING, number=4,)
938+
asset_types = proto.RepeatedField(proto.STRING, number=5,)
939+
order_by = proto.Field(proto.STRING, number=7,)
901940

902941

903942
class SearchAllIamPoliciesResponse(proto.Message):

‎google/cloud/asset_v1/types/assets.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,13 @@ class IamPolicySearchResult(proto.Message):
518518
519519
- use a field query. Example:
520520
``resource:organizations/123``
521+
asset_type (str):
522+
The type of the resource associated with this IAM policy.
523+
Example: ``compute.googleapis.com/Disk``.
524+
525+
To search against the ``asset_type``:
526+
527+
- specify the ``asset_types`` field in your search request.
521528
project (str):
522529
The project that the associated GCP resource belongs to, in
523530
the form of projects/{PROJECT_NUMBER}. If an IAM policy is
@@ -530,6 +537,28 @@ class IamPolicySearchResult(proto.Message):
530537
531538
- specify the ``scope`` field as this project in your
532539
search request.
540+
folders (Sequence[str]):
541+
The folder(s) that the IAM policy belongs to, in the form of
542+
folders/{FOLDER_NUMBER}. This field is available when the
543+
IAM policy belongs to one or more folders.
544+
545+
To search against ``folders``:
546+
547+
- use a field query. Example: ``folders:(123 OR 456)``
548+
- use a free text query. Example: ``123``
549+
- specify the ``scope`` field as this folder in your search
550+
request.
551+
organization (str):
552+
The organization that the IAM policy belongs to, in the form
553+
of organizations/{ORGANIZATION_NUMBER}. This field is
554+
available when the IAM policy belongs to an organization.
555+
556+
To search against ``organization``:
557+
558+
- use a field query. Example: ``organization:123``
559+
- use a free text query. Example: ``123``
560+
- specify the ``scope`` field as this organization in your
561+
search request.
533562
policy (google.iam.v1.policy_pb2.Policy):
534563
The IAM policy directly set on the given resource. Note that
535564
the original IAM policy can contain multiple bindings. This
@@ -588,7 +617,10 @@ class Permissions(proto.Message):
588617
)
589618

590619
resource = proto.Field(proto.STRING, number=1,)
620+
asset_type = proto.Field(proto.STRING, number=5,)
591621
project = proto.Field(proto.STRING, number=2,)
622+
folders = proto.RepeatedField(proto.STRING, number=6,)
623+
organization = proto.Field(proto.STRING, number=7,)
592624
policy = proto.Field(proto.MESSAGE, number=3, message=policy_pb2.Policy,)
593625
explanation = proto.Field(proto.MESSAGE, number=4, message=Explanation,)
594626

0 commit comments

Comments
 (0)