
                            d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
 dd	d
Z ej                  ej                  j                         G d dej                               Z ej                  ej                  j"                         G d de             Z ej                  ej                  j&                         G d de             Zy)z:Command to analyze IAM policy in the specified root asset.    )absolute_import)division)unicode_literals)client_util)base)flagsz8      Analyzes IAM policies that match a request.
      a\        To find out which users have been granted the
      iam.serviceAccounts.actAs permission on a service account, run:

        $ {command} --organization=YOUR_ORG_ID --full-resource-name=YOUR_SERVICE_ACCOUNT_FULL_RESOURCE_NAME --permissions='iam.serviceAccounts.actAs'

      To find out which resources a user can access, run:

        $ {command} --organization=YOUR_ORG_ID --identity='user:u1@foo.com'

      To find out which roles or permissions a user has been granted on a
      project, run:

        $ {command} --organization=YOUR_ORG_ID --full-resource-name=YOUR_PROJECT_FULL_RESOURCE_NAME --identity='user:u1@foo.com'

      To find out which users have been granted the
      iam.serviceAccounts.actAs permission on any applicable resources, run:

        $ {command} --organization=YOUR_ORG_ID --permissions='iam.serviceAccounts.actAs'
      )DESCRIPTIONEXAMPLESc                   B    e Zd ZdZeZej                  Ze	d        Z
d Zy)AnalyzeIamPolicyGAz+Analyzes IAM policies that match a request.c                     t        j                  |       t        j                  |       t        j                  |d       t        j                  |       t        j
                  |       y )NT)r   AddAnalyzerParentArgsAddAnalyzerSelectorsGroupAddAnalyzerOptionsGroup AddAnalyzerConditionContextGroup!AddAnalyzerSavedAnalysisQueryArgsclsparsers     'lib/surface/asset/analyze_iam_policy.pyArgszAnalyzeIamPolicyGA.Args>   sJ    	'	##F+	!!&$/	**62	++F3    c                 b    t        j                  | j                        }|j                  |      S N)r   AnalyzeIamPolicyClient_API_VERSIONAnalyze)selfargsclients      r   RunzAnalyzeIamPolicyGA.RunF   s'    //0A0ABF>>$r   N)__name__
__module____qualname____doc__DETAILED_HELPdetailed_helpr   DEFAULT_API_VERSIONr   classmethodr   r!    r   r   r   r   6   s,    3-00,4 4 r   r   c                        e Zd ZdZed        Zy)AnalyzeIamPolicyBETAz9BETA version, Analyzes IAM policies that match a request.c                 .    t         j                  |       y r   )r   r   r   s     r   r   zAnalyzeIamPolicyBETA.ArgsO   s    F#r   Nr"   r#   r$   r%   r)   r   r*   r   r   r,   r,   K   s    A$ $r   r,   c                        e Zd ZdZed        Zy)AnalyzeIamPolicyALPHAz:ALPHA version, Analyzes IAM policies that match a request.c                     t         j                  |       t        j                  |      }t        j                  |       y r   )r,   r   r   GetOrAddOptionGroup(AddAnalyzerIncludeDenyPolicyAnalysisArgs)r   r   options_groups      r   r   zAnalyzeIamPolicyALPHA.ArgsX   s0    f% --f5M	22=Ar   Nr.   r*   r   r   r0   r0   T   s    BB Br   r0   N)r%   
__future__r   r   r   googlecloudsdk.api_lib.assetr   googlecloudsdk.callioper    googlecloudsdk.command_lib.assetr   r&   ReleaseTracksReleaseTrackGACommandr   BETAr,   ALPHAr0   r*   r   r   <module>r?      s    A &  ' 4 ( 2


	6 D%%(()    * ( D%%**+$- $ ,$ D%%++,	B0 	B -	Br   