diff --git a/iam/cloud-client/__init__.py b/iam/cloud-client/__init__.py new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/iam/cloud-client/snippets/conftest.py b/iam/cloud-client/snippets/conftest.py index 8dd062568612..4fa0dea07064 100644 --- a/iam/cloud-client/snippets/conftest.py +++ b/iam/cloud-client/snippets/conftest.py @@ -16,19 +16,22 @@ import re import uuid -from _pytest.capture import CaptureFixture +from google.cloud import iam_v2 +from google.cloud.iam_v2 import types import pytest - -from create_deny_policy import create_deny_policy -from delete_deny_policy import delete_deny_policy +from samples.snippets.create_deny_policy import create_deny_policy +from samples.snippets.delete_deny_policy import delete_deny_policy PROJECT_ID = os.environ["GOOGLE_CLOUD_PROJECT"] GOOGLE_APPLICATION_CREDENTIALS = os.environ["GOOGLE_APPLICATION_CREDENTIALS"] @pytest.fixture -def deny_policy(capsys: CaptureFixture) -> None: - policy_id = f"limit-project-deletion-{uuid.uuid4()}" +def deny_policy(capsys: "pytest.CaptureFixture[str]") -> None: + policy_id = f"test-deny-policy-{uuid.uuid4()}" + + # Delete any existing policies. Otherwise it might throw quota issue. + delete_existing_deny_policies(PROJECT_ID, "test-deny-policy") # Create the Deny policy. create_deny_policy(PROJECT_ID, policy_id) @@ -39,3 +42,15 @@ def deny_policy(capsys: CaptureFixture) -> None: delete_deny_policy(PROJECT_ID, policy_id) out, _ = capsys.readouterr() assert re.search(f"Deleted the deny policy: {policy_id}", out) + + +def delete_existing_deny_policies(project_id: str, delete_name_prefix: str) -> None: + policies_client = iam_v2.PoliciesClient() + + attachment_point = f"cloudresourcemanager.googleapis.com%2Fprojects%2F{project_id}" + + request = types.ListPoliciesRequest() + request.parent = f"policies/{attachment_point}/denypolicies" + for policy in policies_client.list_policies(request=request): + if delete_name_prefix in policy.name: + delete_deny_policy(PROJECT_ID, str(policy.name).rsplit("/", 1)[-1]) diff --git a/iam/cloud-client/snippets/create_deny_policy.py b/iam/cloud-client/snippets/create_deny_policy.py index 1cc5e5b89c62..569e55e77a75 100644 --- a/iam/cloud-client/snippets/create_deny_policy.py +++ b/iam/cloud-client/snippets/create_deny_policy.py @@ -18,9 +18,8 @@ def create_deny_policy(project_id: str, policy_id: str) -> None: - from google.cloud import iam_v2beta - from google.cloud.iam_v2beta import types - from google.type import expr_pb2 + from google.cloud import iam_v2 + from google.cloud.iam_v2 import types """ Create a deny policy. @@ -36,7 +35,7 @@ def create_deny_policy(project_id: str, policy_id: str) -> None: project_id: ID or number of the Google Cloud project you want to use. policy_id: Specify the ID of the deny policy you want to create. """ - policies_client = iam_v2beta.PoliciesClient() + policies_client = iam_v2.PoliciesClient() # Each deny policy is attached to an organization, folder, or project. # To work with deny policies, specify the attachment point. @@ -100,9 +99,9 @@ def create_deny_policy(project_id: str, policy_id: str) -> None: request.policy = policy request.policy_id = policy_id - # Build the create policy request. - policies_client.create_policy(request=request) - print(f"Created the deny policy: {policy_id}") + # Build the create policy request and wait for the operation to complete. + result = policies_client.create_policy(request=request).result() + print(f"Created the deny policy: {result.name.rsplit('/')[-1]}") if __name__ == "__main__": diff --git a/iam/cloud-client/snippets/delete_deny_policy.py b/iam/cloud-client/snippets/delete_deny_policy.py index 769d8d2d0487..e7128dc6e325 100644 --- a/iam/cloud-client/snippets/delete_deny_policy.py +++ b/iam/cloud-client/snippets/delete_deny_policy.py @@ -16,8 +16,8 @@ # [START iam_delete_deny_policy] def delete_deny_policy(project_id: str, policy_id: str) -> None: - from google.cloud import iam_v2beta - from google.cloud.iam_v2beta import types + from google.cloud import iam_v2 + from google.cloud.iam_v2 import types """ Delete the policy if you no longer want to enforce the rules in a deny policy. @@ -25,7 +25,7 @@ def delete_deny_policy(project_id: str, policy_id: str) -> None: project_id: ID or number of the Google Cloud project you want to use. policy_id: The ID of the deny policy you want to retrieve. """ - policies_client = iam_v2beta.PoliciesClient() + policies_client = iam_v2.PoliciesClient() # Each deny policy is attached to an organization, folder, or project. # To work with deny policies, specify the attachment point. @@ -45,8 +45,8 @@ def delete_deny_policy(project_id: str, policy_id: str) -> None: request.name = f"policies/{attachment_point}/denypolicies/{policy_id}" # Create the DeletePolicy request. - policies_client.delete_policy(request=request) - print(f"Deleted the deny policy: {policy_id}") + result = policies_client.delete_policy(request=request).result() + print(f"Deleted the deny policy: {result.name.rsplit('/')[-1]}") if __name__ == "__main__": diff --git a/iam/cloud-client/snippets/get_deny_policy.py b/iam/cloud-client/snippets/get_deny_policy.py index 05183cf9f99d..9f451fb65f9c 100644 --- a/iam/cloud-client/snippets/get_deny_policy.py +++ b/iam/cloud-client/snippets/get_deny_policy.py @@ -15,17 +15,18 @@ # This file contains code samples that demonstrate how to get IAM deny policies. # [START iam_get_deny_policy] -def get_deny_policy(project_id: str, policy_id: str): - from google.cloud import iam_v2beta - from google.cloud.iam_v2beta import Policy, types +from google.cloud import iam_v2 +from google.cloud.iam_v2 import Policy, types + +def get_deny_policy(project_id: str, policy_id: str) -> Policy: """ Retrieve the deny policy given the project ID and policy ID. project_id: ID or number of the Google Cloud project you want to use. policy_id: The ID of the deny policy you want to retrieve. """ - policies_client = iam_v2beta.PoliciesClient() + policies_client = iam_v2.PoliciesClient() # Each deny policy is attached to an organization, folder, or project. # To work with deny policies, specify the attachment point. diff --git a/iam/cloud-client/snippets/list_deny_policies.py b/iam/cloud-client/snippets/list_deny_policies.py index c83eac9b5e69..106794f52beb 100644 --- a/iam/cloud-client/snippets/list_deny_policies.py +++ b/iam/cloud-client/snippets/list_deny_policies.py @@ -16,8 +16,8 @@ # [START iam_list_deny_policy] def list_deny_policy(project_id: str) -> None: - from google.cloud import iam_v2beta - from google.cloud.iam_v2beta import types + from google.cloud import iam_v2 + from google.cloud.iam_v2 import types """ List all the deny policies that are attached to a resource. @@ -25,7 +25,7 @@ def list_deny_policy(project_id: str) -> None: project_id: ID or number of the Google Cloud project you want to use. """ - policies_client = iam_v2beta.PoliciesClient() + policies_client = iam_v2.PoliciesClient() # Each deny policy is attached to an organization, folder, or project. # To work with deny policies, specify the attachment point. diff --git a/iam/cloud-client/snippets/noxfile_config.py b/iam/cloud-client/snippets/noxfile_config.py index 4fdb52def2ff..e892b338fcea 100644 --- a/iam/cloud-client/snippets/noxfile_config.py +++ b/iam/cloud-client/snippets/noxfile_config.py @@ -31,7 +31,7 @@ # build specific Cloud project. You can also use your own string # to use your own Cloud project. # "gcloud_project_env": "GOOGLE_CLOUD_PROJECT", - "gcloud_project_env": "BUILD_SPECIFIC_GCLOUD_PROJECT", + "gcloud_project_env": "GOOGLE_CLOUD_PROJECT", # A dictionary you want to inject into your test. Don't put any # secrets here. These values will override predefined values. "envs": {}, diff --git a/iam/cloud-client/snippets/requirements-test.txt b/iam/cloud-client/snippets/requirements-test.txt new file mode 100644 index 000000000000..d00689e0623a --- /dev/null +++ b/iam/cloud-client/snippets/requirements-test.txt @@ -0,0 +1 @@ +pytest==7.1.2 diff --git a/iam/cloud-client/snippets/test_deny_policies.py b/iam/cloud-client/snippets/test_deny_policies.py index 3a5bb573dc8d..f6f50cb55318 100644 --- a/iam/cloud-client/snippets/test_deny_policies.py +++ b/iam/cloud-client/snippets/test_deny_policies.py @@ -15,23 +15,25 @@ import os import re -from _pytest.capture import CaptureFixture +import pytest from samples.snippets.get_deny_policy import get_deny_policy from samples.snippets.list_deny_policies import list_deny_policy from samples.snippets.update_deny_policy import update_deny_policy -PROJECT_ID = os.environ["PROJECT_ID"] +PROJECT_ID = os.environ["GOOGLE_CLOUD_PROJECT"] GOOGLE_APPLICATION_CREDENTIALS = os.environ["GOOGLE_APPLICATION_CREDENTIALS"] -def test_retrieve_policy(capsys: CaptureFixture, deny_policy) -> None: +def test_retrieve_policy( + capsys: "pytest.CaptureFixture[str]", deny_policy: str +) -> None: # Test policy retrieval, given the policy id. get_deny_policy(PROJECT_ID, deny_policy) out, _ = capsys.readouterr() assert re.search(f"Retrieved the deny policy: {deny_policy}", out) -def test_list_policies(capsys: CaptureFixture, deny_policy) -> None: +def test_list_policies(capsys: "pytest.CaptureFixture[str]", deny_policy: str) -> None: # Check if the created policy is listed. list_deny_policy(PROJECT_ID) out, _ = capsys.readouterr() @@ -39,7 +41,9 @@ def test_list_policies(capsys: CaptureFixture, deny_policy) -> None: assert re.search("Listed all deny policies", out) -def test_update_deny_policy(capsys: CaptureFixture, deny_policy) -> None: +def test_update_deny_policy( + capsys: "pytest.CaptureFixture[str]", deny_policy: str +) -> None: # Check if the policy rule is updated. policy = get_deny_policy(PROJECT_ID, deny_policy) update_deny_policy(PROJECT_ID, deny_policy, policy.etag) diff --git a/iam/cloud-client/snippets/update_deny_policy.py b/iam/cloud-client/snippets/update_deny_policy.py index d3b8477182c3..3756c0bdecb6 100644 --- a/iam/cloud-client/snippets/update_deny_policy.py +++ b/iam/cloud-client/snippets/update_deny_policy.py @@ -16,9 +16,8 @@ # [START iam_update_deny_policy] def update_deny_policy(project_id: str, policy_id: str, etag: str) -> None: - from google.cloud import iam_v2beta - from google.cloud.iam_v2beta import types - from google.type import expr_pb2 + from google.cloud import iam_v2 + from google.cloud.iam_v2 import types """ Update the deny rules and/ or its display name after policy creation. @@ -30,7 +29,7 @@ def update_deny_policy(project_id: str, policy_id: str, etag: str) -> None: etag: Etag field that identifies the policy version. The etag changes each time you update the policy. Get the etag of an existing policy by performing a GetPolicy request. """ - policies_client = iam_v2beta.PoliciesClient() + policies_client = iam_v2.PoliciesClient() # Each deny policy is attached to an organization, folder, or project. # To work with deny policies, specify the attachment point. @@ -94,8 +93,8 @@ def update_deny_policy(project_id: str, policy_id: str, etag: str) -> None: request = types.UpdatePolicyRequest() request.policy = policy - policies_client.update_policy(request=request) - print(f"Updated the deny policy: {policy_id}") + result = policies_client.update_policy(request=request).result() + print(f"Updated the deny policy: {result.name.rsplit('/')[-1]}") if __name__ == "__main__":