# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
  - BETA
  auto_generated: true
  hidden: true
  help_text:
    brief: Create AccessPolicy instance.
    description: |
      Create AccessPolicy instance.
    examples: |-
      To create a policy instance called `my-policy`, run:

      $ {command} my-policy --organization=123 --location=global --details.rules=rule1.json
  arguments:
    params:
    - help_text: |-
        Identifier. The resource name of the access policy.

        The following formats are supported:
          `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}`
          `projects/{project_number}/locations/{location}/accessPolicies/{policy_id}`
          `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}`
          `organizations/{organization_id}/locations/{location}/accessPolicies/{policy_id}`
      is_positional: true
      is_primary_resource: true
      request_id_field: accessPolicyId
      resource_spec: !REF googlecloudsdk.command_lib.iam.v3beta_resources:folders_or_organizations_or_projects_locations_access_policies
      required: true
    - arg_name: etag
      api_field: googleIamV3betaAccessPolicy.etag
      required: false
      repeated: false
      help_text: |-
        The etag for the access policy.
        If this is provided on update, it must match the server's etag.
    - arg_name: display-name
      api_field: googleIamV3betaAccessPolicy.displayName
      required: false
      repeated: false
      help_text: |-
        The description of the access policy. Must be less than
        or equal to 63 characters.
    - arg_name: annotations
      api_field: googleIamV3betaAccessPolicy.annotations
      required: false
      repeated: true
      help_text: |-
        User defined annotations. See https://google.aip.dev/148#annotations for
        more details such as format and size limitations
      spec:
      - api_field: key
      - api_field: value
    - group:
        api_field: googleIamV3betaAccessPolicy.details
        required: false
        help_text: |-
          Access policy details.
        params:
        - arg_name: details-rules
          api_field: googleIamV3betaAccessPolicy.details.rules
          required: true
          repeated: true
          help_text: |-
            A list of access policy rules.
          spec:
          - api_field: description
            one_of_index: 0
            help_text: |-
              Customer specified description of the rule. Must be less than or equal to
              256 characters.
          - api_field: effect
            one_of_index: 1
            help_text: |-
              The effect of the rule (deny)
          - api_field: principals
            help_text: |-
              The identities for which this rule's effect governs using one or more
               permissions on Google Cloud resources. This field can contain the
               following values:

               * `principal://goog/subject/{email_id}`: A specific Google Account.
                 Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
                 example, `principal://goog/subject/alice@example.com`.

               If an identifier that was previously set on a policy is soft deleted, then
               calls to read that policy will return the identifier with a deleted
               prefix. Users cannot set identifiers with this syntax.
               * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
                 Google Account that was deleted recently. For example,
                 `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If
                 the Google Account is recovered, this identifier reverts to the standard
                 identifier for a Google Account.

               * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
                 that was deleted recently. For example,
                 `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`.
                 If the Google group is restored, this identifier reverts to the standard
                 identifier for a Google group.

               * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
                 A Google Cloud service account that was deleted recently. For example,
                 `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account@iam.gserviceaccount.com?uid=1234567890`.
                 If the service account is undeleted, this identifier reverts to the
                 standard identifier for a service account.
          - api_field: excludedPrincipals
            help_text: |-
              The identities that are excluded from the access policy rule, even if they
              are listed in the `principals`. For example, you could add a Google
              group to the `principals`, then exclude specific users who belong to
              that group.
          - api_field: operation
            help_text: |-
              Attributes that are used to determine whether this rule applies to a
              request.
            spec:
            - api_field: permissions
              help_text: |-
                The permissions that are explicitly affected by this rule. Each
                permission uses the format `{service_fqdn}/{resource}.{verb}`, where
                `{service_fqdn}` is the fully qualified domain name for the service.
                Currently supported permissions are:

                * `eventarc.googleapis.com/messageBuses.publish`.
            - api_field: excludedPermissions
              help_text: |-
                Specifies the permissions that this rule excludes from the set of
                affected permissions given by `permissions`. If a permission appears in
                `permissions` _and_ in `excluded_permissions` then it will _not_ be
                subject to the policy effect.

                The excluded permissions can be specified using the same syntax as
                `permissions`.
          - api_field: conditions
            help_text: |-
              The conditions that determine whether this rule applies to a request.
              Conditions are identified by their key, which is the FQDN of the service
              that they are relevant to, e.g.:

              "conditions": {
                "iam.googleapis.com": <cel expression>
              }

              Each rule is evaluated independently. If this rule does not apply
              to a request, other rules might still apply.
              Currently supported keys are:

              * `eventarc.googleapis.com// The conditions that determine whether this
              rule applies to a request. Conditions are identified by their key, which is
              the FQDN of the service that they are relevant to, e.g.:

              "conditions": {
                "iam.googleapis.com": {
                 "cel_condition": <cel expression>
                }
              }

              Each rule is evaluated independently. If this rule does not apply
              to a request, other rules might still apply.
              Currently supported keys are:

              * `eventarc.googleapis.com`
              * `iam.googleapis.com`
            spec:
            - api_field: key
            - api_field: value
              spec:
              - api_field: expression
                help_text: |-
                  Textual representation of an expression in Common Expression Language
                  syntax.
              - api_field: title
                help_text: |-
                  Title for the expression, i.e. a short string describing
                  its purpose. This can be used e.g. in UIs which allow to enter the
                  expression.
              - api_field: description
                help_text: |-
                  Description of the expression. This is a longer text which
                  describes the expression, e.g. when hovered over it in a UI.
              - api_field: location
                help_text: |-
                  String indicating the location of the expression for error
                  reporting, e.g. a file name and a position in the file.
    - arg_name: validate-only
      api_field: validateOnly
      action: store_true
      required: false
      type: bool
      help_text: |-
        If set, validate the request and preview the creation, but do not actually
        post it.
      default: null
  request:
    api_version: v3beta
    collection:
    - iam.folders.locations.accessPolicies
    - iam.organizations.locations.accessPolicies
    - iam.projects.locations.accessPolicies
  async:
    collection:
    - iam.folders.locations.operations
    - iam.organizations.locations.operations
    - iam.projects.locations.operations
