REST Resource: organizations.gcpUserAccessBindings

Resource: GcpUserAccessBinding

Restricts access to Cloud Console and Google Cloud APIs for a set of users using Context-Aware Access.

JSON representation 
{
  "name": string,
  "groupKey": string,
  "principal": {
    object (Principal)
  },
  "accessLevels": [
    string
  ],
  "dryRunAccessLevels": [
    string
  ],
  "sessionSettings": {
    object (SessionSettings)
  },
  "scopedAccessSettings": [
    {
      object (ScopedAccessSettings)
    }
  ]
}
Fields
name

string

Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by RFC 3986 Section 2.3). Should not be specified by the client during creation. Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
groupKey

string

Optional. Immutable. Google Group ID whose users are subject to this binding's restrictions. See "id" in the Google Workspace Directory API's Group Resource. If a group's email address or alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: "01d520gv4vjcrht"
principal

object (Principal)

Optional. Immutable. The principal that is subject to the access policies in this policy binding.
accessLevels[]

string

Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"
dryRunAccessLevels[]

string

Optional. Dry-run access level that is evaluated, but not enforced. Any access denial based on the dry-run policy is logged. Only one access level is supported, not multiple. This list must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"
sessionSettings

object (SessionSettings)

Optional. The Google Cloud session length (GCSL) policy for the group key.
scopedAccessSettings[]

object (ScopedAccessSettings)

Optional. A list of scoped access settings that set this binding's restrictions on a subset of applications.

Principal

The comprehensive identity container supporting identities including groups, service accounts, and federated identities. Only one of them can be set to create an access binding.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "federatedPrincipal": string,
  "serviceAccountProjectNumber": string,
  "serviceAccount": string
  // End of mutually exclusive fields.
}
Fields
Types that are valid to be assigned to the principal. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
federatedPrincipal

string

Immutable. The IAM principal identifier of the federated workforce or workload to assign the policy to. Examples include the following:

  • Single principal: principal://iam.googleapis.com/projects/{projectNumber}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}
  • All workloads in a workload identity pool: principalSet://iam.googleapis.com/projects/{projectNumber}/locations/global/workloadIdentityPools/{pool_id}/*
  • All Workforce Pools in a Google Cloud organization: principalSet://cloudresourcemanager.googleapis.com/organizations/{organizationId}/type/WorkforcePool

Bindings created for all Workforce Pools in a Google Cloud organization support only scopedAccessSettings with the restrictedProject client scope and active sessionSettings. No other configurations are allowed.
serviceAccountProjectNumber

string

Immutable. Cloud project number used to assign policies to all service accounts owned by the project.
serviceAccount

string

Immutable. Service account email used to assign policies to a specific service account. If a service account is subject to multiple policies (for example, if there is a policy for all service accounts in a project and a policy for the service account), the closest (that is, the most specific) dry-run policy is used for the dry-run functionality and the closest enforcement policy is used for enforcement.
End of mutually exclusive fields.

SessionSettings

Stores settings related to Google Cloud Session Length, including session duration, the type of challenge (that is, method) a user faces when their session expires, and other related settings.

JSON representation 
{
  "sessionReauthMethod": enum (SessionReauthMethod),
  "sessionLength": string,
  "maxInactivity": string,
  "useOidcMaxAge": boolean,
  "sessionLengthEnabled": boolean
}
Fields
sessionReauthMethod

enum (SessionReauthMethod)

Optional. Session challenge method when a user's Google Cloud session expires.
sessionLength

string (Duration format)

Optional. The session length. Setting this field to zero allows for sessions that are active indefinitely. Also, setting sessionLengthEnabled to false disregards session limits, which means that sessions never expire. If useOidcMaxAge is true, for OIDC apps, the session length will be the minimum of this field and the OIDC max_age parameter. If this field is set to zero, sessionLengthEnabled must be set to false or left unset.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
maxInactivity

string (Duration format)

Optional. How long a user is allowed to take between actions before a new access token must be issued. Only set for Google Cloud apps.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
useOidcMaxAge

boolean

Optional. Only useful for OIDC apps. When false, the OIDC max_age parameter, if passed in the authentication request, is ignored. When true, the re-authentication period is the minimum of the sessionLength field and the max_age OIDC parameter.
sessionLengthEnabled

boolean

Optional. This field enables or disables Google Cloud session length. When false, all fields set above are disregarded and the session length is effectively infinite. If sessionLength is set to zero, this field must be set to false.

SessionReauthMethod

The session challenges proposed to users when the Google Cloud session length expires.

Enums
SESSION_REAUTH_METHOD_UNSPECIFIED If the method is undefined in the API, LOGIN is used by default.
LOGIN The user will be prompted to perform regular login. Users who are enrolled for two-step verification and haven't chosen "Remember this computer" will be prompted for their second factor.
SECURITY_KEY The user will be prompted to authenticate using their security key. If no security key has been configured, then authentication will fall back to LOGIN.
PASSWORD The user will be prompted for their password.

ScopedAccessSettings

A relationship between access settings and their scope.

JSON representation 
{
  "scope": {
    object (AccessScope)
  },
  "activeSettings": {
    object (AccessSettings)
  },
  "dryRunSettings": {
    object (AccessSettings)
  }
}
Fields
scope

object (AccessScope)

Optional. Application or other resource to which the access settings are applied. Implicitly, this is the scoped access settings key; as such, it must be unique and non-empty.
activeSettings

object (AccessSettings)

Optional. Access settings for this ScopedAccessSettings. This field may be empty if dryRunSettings is set.
dryRunSettings

object (AccessSettings)

Optional. Dry-run access settings for this ScopedAccessSettings. This field may be empty if activeSettings is set.

AccessScope

Access scope represents the client scope to which the settings are applied.

JSON representation 
{
  "clientScope": {
    object (ClientScope)
  }
}
Fields
clientScope

object (ClientScope)

Optional. Client scope for this access scope.

ClientScope

Client scope represents the application, project, or other resource subject to this binding's restrictions.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "restrictedClientApplication": {
    object (Application)
  },
  "restrictedProject": {
    object (Project)
  }
  // End of mutually exclusive fields.
}
Fields
Client scope identifier. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
restrictedClientApplication

object (Application)

Optional. The application that is subject to this binding's scope.
restrictedProject

object (Project)

Optional. The Google Cloud project that is subject to this binding's scope.
End of mutually exclusive fields.

Application

An application that accesses Google Cloud APIs.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "clientId": string,
  "name": string
  // End of mutually exclusive fields.
}
Fields
An identifier of the application. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
clientId

string

The OAuth client ID of the application.
name

string

The name of the application. Example: "Cloud Console"
End of mutually exclusive fields.

Project

A Google Cloud project that contains applications and resources that users can access.

JSON representation 
{
  "name": string
}
Fields
name

string

The Google Cloud project resource name. Format: projects/{projectNumber}. Only the project number is supported. Example: projects/1234567890

AccessSettings

Access settings represent the set of conditions that must be met for access to be granted. At least one of the fields must be set.

JSON representation 
{
  "accessLevels": [
    string
  ],
  "sessionSettings": {
    object (SessionSettings)
  }
}
Fields
accessLevels[]

string

Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"
sessionSettings

object (SessionSettings)

Optional. Session settings applied to user access on a given AccessScope.

Methods

create

 Creates a GcpUserAccessBinding.

delete

 Deletes a GcpUserAccessBinding.

get

 Gets the GcpUserAccessBinding with the given name.

list

 Lists all GcpUserAccessBindings for a Google Cloud organization.

patch

 Updates a GcpUserAccessBinding.