1
1
# coding: utf-8
2
2
3
- # (C) Copyright IBM Corp. 2023 .
3
+ # (C) Copyright IBM Corp. 2024 .
4
4
#
5
5
# Licensed under the Apache License, Version 2.0 (the "License");
6
6
# you may not use this file except in compliance with the License.
14
14
# See the License for the specific language governing permissions and
15
15
# limitations under the License.
16
16
17
- # IBM OpenAPI SDK Code Generator Version: 3.81 .0-c73a091c-20231026-215706
17
+ # IBM OpenAPI SDK Code Generator Version: 3.84 .0-a4533f12-20240103-170852
18
18
19
19
"""
20
20
IAM Policy Management API
@@ -345,8 +345,90 @@ def replace_policy(
345
345
resource attributes supported by the service. To view a service's or the
346
346
platform's supported attributes, check the [documentation](/docs?tab=all-docs).
347
347
The policy resource must include either the **`serviceType`**, **`serviceName`**,
348
- or **`resourceGroupId`** attribute and the **`accountId`** attribute.` If the
348
+ or **`resourceGroupId`** attribute and the **`accountId`** attribute.`
349
+ In the rule field, you can specify a single condition by using **`key`**,
350
+ **`value`**, and condition **`operator`**, or a set of **`conditions`** with a
351
+ combination **`operator`**. The possible combination operators are **`and`** and
352
+ **`or`**.
353
+ Currently, we support two types of patterns:
354
+ 1. `time-based`: Used to specify a time-based restriction
355
+ Combine conditions to specify a time-based restriction (e.g., access only during
356
+ business hours, during the Monday-Friday work week). For example, a policy can
357
+ grant access Monday-Friday, 9:00am-5:00pm using the following rule:
358
+ ```json
359
+ "rule": {
360
+ "operator": "and",
361
+ "conditions": [{
362
+ "key": "{{environment.attributes.day_of_week}}",
363
+ "operator": "dayOfWeekAnyOf",
364
+ "value": ["1+00:00", "2+00:00", "3+00:00", "4+00:00", "5+00:00"]
365
+ },
366
+ "key": "{{environment.attributes.current_time}}",
367
+ "operator": "timeGreaterThanOrEquals",
368
+ "value": "09:00:00+00:00"
369
+ },
370
+ "key": "{{environment.attributes.current_time}}",
371
+ "operator": "timeLessThanOrEquals",
372
+ "value": "17:00:00+00:00"
373
+ }]
374
+ }
375
+ ``` You can use the following operators in the **`key`** and **`value`** pair:
376
+ ```
377
+ 'timeLessThan', 'timeLessThanOrEquals', 'timeGreaterThan',
378
+ 'timeGreaterThanOrEquals',
379
+ 'dateTimeLessThan', 'dateTimeLessThanOrEquals', 'dateTimeGreaterThan',
380
+ 'dateTimeGreaterThanOrEquals',
381
+ 'dayOfWeekEquals', 'dayOfWeekAnyOf',
382
+ ``` The pattern field that matches the rule is required when rule is provided. For
383
+ the business hour rule example above, the **`pattern`** is
384
+ **`"time-based-conditions:weekly"`**. For more information, see [Time-based
385
+ conditions
386
+ operators](/docs/account?topic=account-iam-condition-properties&interface=ui#policy-condition-properties)
387
+ and
388
+ [Limiting access with time-based
389
+ conditions](/docs/account?topic=account-iam-time-based&interface=ui). If the
349
390
subject is a locked service-id, the request will fail.
391
+ 2. `attribute-based`: Used to specify a combination of OR/AND based conditions
392
+ applied on resource attributes.
393
+ Combine conditions to specify an attribute-based condition using AN/OR-based
394
+ operators.
395
+ For example, a policy can grant access based on multiple conditions applied on the
396
+ resource attributes below:
397
+ ```json
398
+ "pattern": "attribute-based-condition:resource:literal-and-wildcard"
399
+ "rule": {
400
+ "operator": "or",
401
+ "conditions": [
402
+ {
403
+ "operator": "and",
404
+ "conditions": [
405
+ {
406
+ "key": "{{resource.attributes.prefix}}",
407
+ "operator": "stringEquals",
408
+ "value": "home/test"
409
+ },
410
+ {
411
+ "key": "{{environment.attributes.delimiter}}",
412
+ "operator": "stringEquals",
413
+ "value": "/"
414
+ }
415
+ ]
416
+ },
417
+ {
418
+ "key": "{{resource.attributes.path}}",
419
+ "operator": "stringMatch",
420
+ "value": "home/David/*"
421
+ }
422
+ ]
423
+ }
424
+ ```
425
+ In addition to satisfying the `resources` section, the policy grants permission
426
+ only if either the `path` begins with `home/David/` **OR** the `prefix` is
427
+ `home/test` and the `delimiter` is `/`. This mechanism helps you consolidate
428
+ multiple policies in to a single policy, making policies easier to administer and
429
+ stay within the policy limit for an account. View the list of operators that can
430
+ be used in the condition
431
+ [here](/docs/account?topic=account-wildcard#string-comparisons).
350
432
### Authorization
351
433
To update an authorization policy, use **`"type": "authorization"`** in the body.
352
434
The subject attributes must match the supported authorization subjects of the
@@ -1528,6 +1610,7 @@ def list_policy_templates(
1528
1610
account_id : str ,
1529
1611
* ,
1530
1612
accept_language : Optional [str ] = None ,
1613
+ state : Optional [str ] = None ,
1531
1614
** kwargs ,
1532
1615
) -> DetailedResponse :
1533
1616
"""
@@ -1554,6 +1637,7 @@ def list_policy_templates(
1554
1637
* `pt-br` - Portuguese (Brazil)
1555
1638
* `zh-cn` - Chinese (Simplified, PRC)
1556
1639
* `zh-tw` - (Chinese, Taiwan).
1640
+ :param str state: (optional) The policy template state.
1557
1641
:param dict headers: A `dict` containing the request headers
1558
1642
:return: A `DetailedResponse` containing the result, headers and HTTP status code.
1559
1643
:rtype: DetailedResponse with `dict` result representing a `PolicyTemplateCollection` object
@@ -1573,6 +1657,7 @@ def list_policy_templates(
1573
1657
1574
1658
params = {
1575
1659
'account_id' : account_id ,
1660
+ 'state' : state ,
1576
1661
}
1577
1662
1578
1663
if 'headers' in kwargs :
@@ -1684,6 +1769,8 @@ def create_policy_template(
1684
1769
def get_policy_template (
1685
1770
self ,
1686
1771
policy_template_id : str ,
1772
+ * ,
1773
+ state : Optional [str ] = None ,
1687
1774
** kwargs ,
1688
1775
) -> DetailedResponse :
1689
1776
"""
@@ -1693,6 +1780,7 @@ def get_policy_template(
1693
1780
ID.
1694
1781
1695
1782
:param str policy_template_id: The policy template ID.
1783
+ :param str state: (optional) The policy template state.
1696
1784
:param dict headers: A `dict` containing the request headers
1697
1785
:return: A `DetailedResponse` containing the result, headers and HTTP status code.
1698
1786
:rtype: DetailedResponse with `dict` result representing a `PolicyTemplate` object
@@ -1708,6 +1796,10 @@ def get_policy_template(
1708
1796
)
1709
1797
headers .update (sdk_headers )
1710
1798
1799
+ params = {
1800
+ 'state' : state ,
1801
+ }
1802
+
1711
1803
if 'headers' in kwargs :
1712
1804
headers .update (kwargs .get ('headers' ))
1713
1805
del kwargs ['headers' ]
@@ -1721,6 +1813,7 @@ def get_policy_template(
1721
1813
method = 'GET' ,
1722
1814
url = url ,
1723
1815
headers = headers ,
1816
+ params = params ,
1724
1817
)
1725
1818
1726
1819
response = self .send (request , ** kwargs )
@@ -1849,6 +1942,8 @@ def create_policy_template_version(
1849
1942
def list_policy_template_versions (
1850
1943
self ,
1851
1944
policy_template_id : str ,
1945
+ * ,
1946
+ state : Optional [str ] = None ,
1852
1947
** kwargs ,
1853
1948
) -> DetailedResponse :
1854
1949
"""
@@ -1857,6 +1952,7 @@ def list_policy_template_versions(
1857
1952
Retrieve the versions of a policy template by providing a policy template ID.
1858
1953
1859
1954
:param str policy_template_id: The policy template ID.
1955
+ :param str state: (optional) The policy template state.
1860
1956
:param dict headers: A `dict` containing the request headers
1861
1957
:return: A `DetailedResponse` containing the result, headers and HTTP status code.
1862
1958
:rtype: DetailedResponse with `dict` result representing a `PolicyTemplateVersionsCollection` object
@@ -1872,6 +1968,10 @@ def list_policy_template_versions(
1872
1968
)
1873
1969
headers .update (sdk_headers )
1874
1970
1971
+ params = {
1972
+ 'state' : state ,
1973
+ }
1974
+
1875
1975
if 'headers' in kwargs :
1876
1976
headers .update (kwargs .get ('headers' ))
1877
1977
del kwargs ['headers' ]
@@ -1885,6 +1985,7 @@ def list_policy_template_versions(
1885
1985
method = 'GET' ,
1886
1986
url = url ,
1887
1987
headers = headers ,
1988
+ params = params ,
1888
1989
)
1889
1990
1890
1991
response = self .send (request , ** kwargs )
@@ -2368,6 +2469,48 @@ class Format(str, Enum):
2368
2469
DISPLAY = 'display'
2369
2470
2370
2471
2472
+ class ListPolicyTemplatesEnums :
2473
+ """
2474
+ Enums for list_policy_templates parameters.
2475
+ """
2476
+
2477
+ class State (str , Enum ):
2478
+ """
2479
+ The policy template state.
2480
+ """
2481
+
2482
+ ACTIVE = 'active'
2483
+ DELETED = 'deleted'
2484
+
2485
+
2486
+ class GetPolicyTemplateEnums :
2487
+ """
2488
+ Enums for get_policy_template parameters.
2489
+ """
2490
+
2491
+ class State (str , Enum ):
2492
+ """
2493
+ The policy template state.
2494
+ """
2495
+
2496
+ ACTIVE = 'active'
2497
+ DELETED = 'deleted'
2498
+
2499
+
2500
+ class ListPolicyTemplateVersionsEnums :
2501
+ """
2502
+ Enums for list_policy_template_versions parameters.
2503
+ """
2504
+
2505
+ class State (str , Enum ):
2506
+ """
2507
+ The policy template state.
2508
+ """
2509
+
2510
+ ACTIVE = 'active'
2511
+ DELETED = 'deleted'
2512
+
2513
+
2371
2514
##############################################################################
2372
2515
# Models
2373
2516
##############################################################################
@@ -3310,7 +3453,7 @@ def __ne__(self, other: 'LimitData') -> bool:
3310
3453
3311
3454
class NestedCondition :
3312
3455
"""
3313
- Condition that specifies additional conditions or RuleAttribute to grant access.s.
3456
+ Condition that specifies additional conditions or RuleAttribute to grant access.
3314
3457
3315
3458
"""
3316
3459
@@ -4290,6 +4433,7 @@ class PolicyTemplate:
4290
4433
:param bool committed: (optional) Committed status of the template version.
4291
4434
:param TemplatePolicy policy: The core set of properties associated with the
4292
4435
template's policy objet.
4436
+ :param str state: (optional) State of policy template.
4293
4437
:param str id: (optional) The policy template ID.
4294
4438
:param str href: (optional) The href URL that links to the policy templates API
4295
4439
by policy template ID.
@@ -4312,6 +4456,7 @@ def __init__(
4312
4456
* ,
4313
4457
description : Optional [str ] = None ,
4314
4458
committed : Optional [bool ] = None ,
4459
+ state : Optional [str ] = None ,
4315
4460
id : Optional [str ] = None ,
4316
4461
href : Optional [str ] = None ,
4317
4462
created_at : Optional [datetime ] = None ,
@@ -4335,13 +4480,15 @@ def __init__(
4335
4480
purpose or context of the policy for enterprise users managing IAM
4336
4481
templates.
4337
4482
:param bool committed: (optional) Committed status of the template version.
4483
+ :param str state: (optional) State of policy template.
4338
4484
"""
4339
4485
self .name = name
4340
4486
self .description = description
4341
4487
self .account_id = account_id
4342
4488
self .version = version
4343
4489
self .committed = committed
4344
4490
self .policy = policy
4491
+ self .state = state
4345
4492
self .id = id
4346
4493
self .href = href
4347
4494
self .created_at = created_at
@@ -4373,6 +4520,8 @@ def from_dict(cls, _dict: Dict) -> 'PolicyTemplate':
4373
4520
args ['policy' ] = TemplatePolicy .from_dict (_dict .get ('policy' ))
4374
4521
else :
4375
4522
raise ValueError ('Required property \' policy\' not present in PolicyTemplate JSON' )
4523
+ if 'state' in _dict :
4524
+ args ['state' ] = _dict .get ('state' )
4376
4525
if 'id' in _dict :
4377
4526
args ['id' ] = _dict .get ('id' )
4378
4527
if 'href' in _dict :
@@ -4410,6 +4559,8 @@ def to_dict(self) -> Dict:
4410
4559
_dict ['policy' ] = self .policy
4411
4560
else :
4412
4561
_dict ['policy' ] = self .policy .to_dict ()
4562
+ if hasattr (self , 'state' ) and self .state is not None :
4563
+ _dict ['state' ] = self .state
4413
4564
if hasattr (self , 'id' ) and getattr (self , 'id' ) is not None :
4414
4565
_dict ['id' ] = getattr (self , 'id' )
4415
4566
if hasattr (self , 'href' ) and getattr (self , 'href' ) is not None :
@@ -4442,6 +4593,14 @@ def __ne__(self, other: 'PolicyTemplate') -> bool:
4442
4593
"""Return `true` when self and other are not equal, false otherwise."""
4443
4594
return not self == other
4444
4595
4596
+ class StateEnum (str , Enum ):
4597
+ """
4598
+ State of policy template.
4599
+ """
4600
+
4601
+ ACTIVE = 'active'
4602
+ DELETED = 'deleted'
4603
+
4445
4604
4446
4605
class PolicyTemplateAssignmentCollection :
4447
4606
"""
@@ -4591,6 +4750,7 @@ class PolicyTemplateLimitData:
4591
4750
:param bool committed: (optional) Committed status of the template version.
4592
4751
:param TemplatePolicy policy: The core set of properties associated with the
4593
4752
template's policy objet.
4753
+ :param str state: (optional) State of policy template.
4594
4754
:param str id: (optional) The policy template ID.
4595
4755
:param str href: (optional) The href URL that links to the policy templates API
4596
4756
by policy template ID.
@@ -4614,6 +4774,7 @@ def __init__(
4614
4774
* ,
4615
4775
description : Optional [str ] = None ,
4616
4776
committed : Optional [bool ] = None ,
4777
+ state : Optional [str ] = None ,
4617
4778
id : Optional [str ] = None ,
4618
4779
href : Optional [str ] = None ,
4619
4780
created_at : Optional [datetime ] = None ,
@@ -4638,6 +4799,7 @@ def __init__(
4638
4799
purpose or context of the policy for enterprise users managing IAM
4639
4800
templates.
4640
4801
:param bool committed: (optional) Committed status of the template version.
4802
+ :param str state: (optional) State of policy template.
4641
4803
:param TemplateCountData counts: (optional) policy template count details.
4642
4804
"""
4643
4805
self .name = name
@@ -4646,6 +4808,7 @@ def __init__(
4646
4808
self .version = version
4647
4809
self .committed = committed
4648
4810
self .policy = policy
4811
+ self .state = state
4649
4812
self .id = id
4650
4813
self .href = href
4651
4814
self .created_at = created_at
@@ -4678,6 +4841,8 @@ def from_dict(cls, _dict: Dict) -> 'PolicyTemplateLimitData':
4678
4841
args ['policy' ] = TemplatePolicy .from_dict (_dict .get ('policy' ))
4679
4842
else :
4680
4843
raise ValueError ('Required property \' policy\' not present in PolicyTemplateLimitData JSON' )
4844
+ if 'state' in _dict :
4845
+ args ['state' ] = _dict .get ('state' )
4681
4846
if 'id' in _dict :
4682
4847
args ['id' ] = _dict .get ('id' )
4683
4848
if 'href' in _dict :
@@ -4717,6 +4882,8 @@ def to_dict(self) -> Dict:
4717
4882
_dict ['policy' ] = self .policy
4718
4883
else :
4719
4884
_dict ['policy' ] = self .policy .to_dict ()
4885
+ if hasattr (self , 'state' ) and self .state is not None :
4886
+ _dict ['state' ] = self .state
4720
4887
if hasattr (self , 'id' ) and getattr (self , 'id' ) is not None :
4721
4888
_dict ['id' ] = getattr (self , 'id' )
4722
4889
if hasattr (self , 'href' ) and getattr (self , 'href' ) is not None :
@@ -4754,6 +4921,14 @@ def __ne__(self, other: 'PolicyTemplateLimitData') -> bool:
4754
4921
"""Return `true` when self and other are not equal, false otherwise."""
4755
4922
return not self == other
4756
4923
4924
+ class StateEnum (str , Enum ):
4925
+ """
4926
+ State of policy template.
4927
+ """
4928
+
4929
+ ACTIVE = 'active'
4930
+ DELETED = 'deleted'
4931
+
4757
4932
4758
4933
class PolicyTemplateMetaData :
4759
4934
"""
0 commit comments