|dZddlmZddlmZddlmZddlmZddlmZddl m Z ejejjejGdd ej Zejejj$ejj&Gd d eZy ) zRemove IAM Policy Binding.)absolute_import)division)unicode_literals)base)iam_util)utilc2eZdZdZddiZdZedZdZy)RemoveIamPolicyBinding"Remove IAM policy binding from an IAP IAM resource. Removes a policy binding from the IAM policy of an IAP IAM resource. One binding consists of a member, a role and an optional condition. See $ {parent_command} get-iam-policy for examples of how to specify an IAP IAM resource. EXAMPLESav See $ {parent_command} get-iam-policy for examples of how to specify an IAP IAM resource. To remove an IAM policy binding for the role of 'roles/editor' for the user 'test-user@gmail.com' on IAP IAM resource IAP_IAM_RESOURCE, run: $ {command} --resource-type=IAP_IAM_RESOURCE --member='user:test-user@gmail.com' --role='roles/editor' To remove an IAM policy binding for the role of 'roles/editor' for the user 'test-user@gmail.com' on regional IAP IAM resource IAP_IAM_RESOURCE, run: $ {command} --resource-type=IAP_IAM_RESOURCE --member='user:test-user@gmail.com' --role='roles/editor' --region=REGION To remove an IAM policy binding for the role of 'roles/editor' from all authenticated users on IAP IAM resource IAP_IAM_RESOURCE,run: $ {command} --resource-type=IAP_IAM_RESOURCE --member='allAuthenticatedUsers' --role='roles/editor' To remove an IAM policy binding with a condition of expression='request.time < timestamp("2019-01-01T00:00:00Z")', title='expires_end_of_2018', and description='Expires at midnight on 2018-12-31' for the role of 'roles/browser' for the user 'test-user@gmail.com' on IAP IAM resource IAP_IAM_RESOURCE, run: $ {command} --resource-type=IAP_IAM_RESOURCE --member='user:test-user@gmail.com' --role='roles/browser' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018, description=Expires at midnight on 2018-12-31' To remove all IAM policy bindings regardless of the condition for the role of 'roles/browser' and for the user 'test-user@gmail.com' on IAP IAM resource IAP_IAM_RESOURCE, run: $ {command} --resource-type=IAP_IAM_RESOURCE --member='user:test-user@gmail.com' --role='roles/browser' --all See https://cloud.google.com/iam/docs/managing-policies for details of policy role and member types. Fctj||jtj|tj j |y)zRegister flags for this command. Args: parser: An argparse.ArgumentParser-like object. It is mocked out in order to capture some information, but behaves like an ArgumentParser. )support_cloud_runN)iap_utilAddIapIamResourceArgs_support_cloud_runAddRemoveIamPolicyBindingArgsrURI_FLAGRemoveFromParser)clsparsers 0lib/surface/iap/web/remove_iam_policy_binding.pyArgszRemoveIamPolicyBinding.ArgsXs@ ""00  **62MM""6*ctj|}tj|j ||j }|j |j|j||jS)a This is what gets called when the user runs this command. Args: args: an argparse namespace. All the arguments that were provided to this command invocation. Returns: The specified function with its description and configured filter. ) rValidateAndExtractConditionrParseIapIamResource ReleaseTrackrr memberroleall)selfargs condition iap_iam_refs rRunzRemoveIamPolicyBinding.Rungsf44T:I..   K  - -dkk499i.2hh 88rN) __name__ __module__ __qualname____doc__ detailed_helpr classmethodrr%rrr r s8, /-b + +8rr ceZdZdZdZy)RemoveIamPolicyBindingAlphar TN)r&r'r(r)rr,rrr.r.{srr.N)r) __future__rrrgooglecloudsdk.calliopergooglecloudsdk.command_lib.iamrgooglecloudsdk.command_lib.iaprr ReleaseTracksrGADefaultUniverseOnlyCommandr ALPHABETAr.r,rrr9s !&'(3;D%%(()[8T\\[8*[8|D%%++T->->-C-CD "8 E r