Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 037be58

Browse filesBrowse files
dpebotdpebot
authored
Merge pull request GoogleCloudPlatform#480 from GoogleCloudPlatform/pubsub-iam-samples
2 parents d1d79c1 + 5833866 commit 037be58
Copy full SHA for 037be58

File tree

Expand file treeCollapse file tree

2 files changed

+283
-0
lines changed
Filter options
Expand file treeCollapse file tree

2 files changed

+283
-0
lines changed

‎pubsub/cloud-client/iam.py

Copy file name to clipboard
+182Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
#!/usr/bin/env python
2+
3+
# Copyright 2016 Google Inc. All Rights Reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
"""This application demonstrates how to perform basic operations on IAM
18+
policies with the Cloud Pub/Sub API.
19+
20+
For more information, see the README.md under /pubsub and the documentation
21+
at https://cloud.google.com/pubsub/docs.
22+
"""
23+
24+
import argparse
25+
26+
from gcloud import pubsub
27+
28+
29+
def get_topic_policy(topic_name):
30+
"""Prints the IAM policy for the given topic."""
31+
pubsub_client = pubsub.Client()
32+
topic = pubsub_client.topic(topic_name)
33+
34+
policy = topic.get_iam_policy()
35+
36+
print('Policy for topic {}:'.format(topic.name))
37+
print('Version: {}'.format(policy.version))
38+
print('Owners: {}'.format(policy.owners))
39+
print('Editors: {}'.format(policy.editors))
40+
print('Viewers: {}'.format(policy.viewers))
41+
print('Publishers: {}'.format(policy.publishers))
42+
print('Subscribers: {}'.format(policy.subscribers))
43+
44+
45+
def get_subscription_policy(topic_name, subscription_name):
46+
"""Prints the IAM policy for the given subscription."""
47+
pubsub_client = pubsub.Client()
48+
topic = pubsub_client.topic(topic_name)
49+
subscription = topic.subscription(subscription_name)
50+
51+
policy = subscription.get_iam_policy()
52+
53+
print('Policy for subscription {} on topic {}:'.format(
54+
subscription.name, topic.name))
55+
print('Version: {}'.format(policy.version))
56+
print('Owners: {}'.format(policy.owners))
57+
print('Editors: {}'.format(policy.editors))
58+
print('Viewers: {}'.format(policy.viewers))
59+
print('Publishers: {}'.format(policy.publishers))
60+
print('Subscribers: {}'.format(policy.subscribers))
61+
62+
63+
def set_topic_policy(topic_name):
64+
"""Sets the IAM policy for a topic."""
65+
pubsub_client = pubsub.Client()
66+
topic = pubsub_client.topic(topic_name)
67+
policy = topic.get_iam_policy()
68+
69+
# Add all users as viewers.
70+
policy.viewers.add(policy.all_users())
71+
# Add a group as editors.
72+
policy.editors.add(policy.group('cloud-logs@google.com'))
73+
74+
# Set the policy
75+
topic.set_iam_policy(policy)
76+
77+
print('IAM policy for topic {} set.'.format(topic.name))
78+
79+
80+
def set_subscription_policy(topic_name, subscription_name):
81+
"""Sets the IAM policy for a topic."""
82+
pubsub_client = pubsub.Client()
83+
topic = pubsub_client.topic(topic_name)
84+
subscription = topic.subscription(subscription_name)
85+
policy = subscription.get_iam_policy()
86+
87+
# Add all users as viewers.
88+
policy.viewers.add(policy.all_users())
89+
# Add a group as editors.
90+
policy.editors.add(policy.group('cloud-logs@google.com'))
91+
92+
# Set the policy
93+
subscription.set_iam_policy(policy)
94+
95+
print('IAM policy for subscription {} on topic {} set.'.format(
96+
topic.name, subscription.name))
97+
98+
99+
def check_topic_permissions(topic_name):
100+
"""Checks to which permissions are available on the given topic."""
101+
pubsub_client = pubsub.Client()
102+
topic = pubsub_client.topic(topic_name)
103+
104+
permissions_to_check = [
105+
'pubsub.topics.publish',
106+
'pubsub.topics.update'
107+
]
108+
109+
allowed_permissions = topic.check_iam_permissions(permissions_to_check)
110+
111+
print('Allowed permissions for topic {}: {}'.format(
112+
topic.name, allowed_permissions))
113+
114+
115+
def check_subscription_permissions(topic_name, subscription_name):
116+
"""Checks to which permissions are available on the given subscription."""
117+
pubsub_client = pubsub.Client()
118+
topic = pubsub_client.topic(topic_name)
119+
subscription = topic.subscription(subscription_name)
120+
121+
permissions_to_check = [
122+
'pubsub.subscriptions.consume',
123+
'pubsub.subscriptions.update'
124+
]
125+
126+
allowed_permissions = subscription.check_iam_permissions(
127+
permissions_to_check)
128+
129+
print('Allowed permissions for subscription {} on topic {}: {}'.format(
130+
subscription.name, topic.name, allowed_permissions))
131+
132+
133+
if __name__ == '__main__':
134+
parser = argparse.ArgumentParser(
135+
description=__doc__,
136+
formatter_class=argparse.RawDescriptionHelpFormatter
137+
)
138+
139+
subparsers = parser.add_subparsers(dest='command')
140+
141+
get_topic_policy_parser = subparsers.add_parser(
142+
'get-topic-policy', help=get_topic_policy.__doc__)
143+
get_topic_policy_parser.add_argument('topic_name')
144+
145+
get_subscription_policy_parser = subparsers.add_parser(
146+
'get-subscription-policy', help=get_subscription_policy.__doc__)
147+
get_subscription_policy_parser.add_argument('topic_name')
148+
get_subscription_policy_parser.add_argument('subscription_name')
149+
150+
set_topic_policy_parser = subparsers.add_parser(
151+
'set-topic-policy', help=set_topic_policy.__doc__)
152+
set_topic_policy_parser.add_argument('topic_name')
153+
154+
set_subscription_policy_parser = subparsers.add_parser(
155+
'set-subscription-policy', help=set_subscription_policy.__doc__)
156+
set_subscription_policy_parser.add_argument('topic_name')
157+
set_subscription_policy_parser.add_argument('subscription_name')
158+
159+
check_topic_permissions_parser = subparsers.add_parser(
160+
'check-topic-permissions', help=check_topic_permissions.__doc__)
161+
check_topic_permissions_parser.add_argument('topic_name')
162+
163+
check_subscription_permissions_parser = subparsers.add_parser(
164+
'check-subscription-permissions',
165+
help=check_subscription_permissions.__doc__)
166+
check_subscription_permissions_parser.add_argument('topic_name')
167+
check_subscription_permissions_parser.add_argument('subscription_name')
168+
169+
args = parser.parse_args()
170+
171+
if args.command == 'get-topic-policy':
172+
get_topic_policy(args.topic_name)
173+
elif args.command == 'get-subscription-policy':
174+
get_subscription_policy(args.topic_name, args.subscription_name)
175+
elif args.command == 'set-topic-policy':
176+
set_topic_policy(args.topic_name)
177+
elif args.command == 'set-subscription-policy':
178+
set_subscription_policy(args.topic_name, args.subscription_name)
179+
elif args.command == 'check-topic-permissions':
180+
check_topic_permissions(args.topic_name)
181+
elif args.command == 'check-subscription-permissions':
182+
check_subscription_permissions(args.topic_name, args.subscription_name)

‎pubsub/cloud-client/iam_test.py

Copy file name to clipboard
+101Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Copyright 2016 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
from gcloud import pubsub
16+
import pytest
17+
18+
import iam
19+
20+
TEST_TOPIC = 'iam-test-topic'
21+
TEST_SUBSCRIPTION = 'iam-test-subscription'
22+
23+
24+
@pytest.fixture
25+
def test_topic():
26+
client = pubsub.Client()
27+
topic = client.topic(TEST_TOPIC)
28+
topic.create()
29+
yield topic
30+
if topic.exists():
31+
topic.delete()
32+
33+
34+
@pytest.fixture
35+
def test_subscription(test_topic):
36+
subscription = test_topic.subscription(TEST_SUBSCRIPTION)
37+
yield subscription
38+
if subscription.exists():
39+
subscription.delete()
40+
41+
42+
def test_get_topic_policy(test_topic, capsys):
43+
iam.get_topic_policy(test_topic.name)
44+
45+
out, _ = capsys.readouterr()
46+
assert test_topic.name in out
47+
48+
49+
def test_get_subscription_policy(test_subscription, capsys):
50+
test_subscription.create()
51+
52+
iam.get_subscription_policy(
53+
test_subscription.topic.name,
54+
test_subscription.name)
55+
56+
out, _ = capsys.readouterr()
57+
assert test_subscription.topic.name in out
58+
assert test_subscription.name in out
59+
60+
61+
def test_set_topic_policy(test_topic):
62+
iam.set_topic_policy(test_topic.name)
63+
64+
policy = test_topic.get_iam_policy()
65+
assert policy.viewers
66+
assert policy.editors
67+
68+
69+
def test_set_subscription_policy(test_subscription):
70+
test_subscription.create()
71+
72+
iam.set_subscription_policy(
73+
test_subscription.topic.name,
74+
test_subscription.name)
75+
76+
policy = test_subscription.get_iam_policy()
77+
assert policy.viewers
78+
assert policy.editors
79+
80+
81+
def test_check_topic_permissions(test_topic, capsys):
82+
iam.check_topic_permissions(test_topic.name)
83+
84+
out, _ = capsys.readouterr()
85+
86+
assert test_topic.name in out
87+
assert 'pubsub.topics.publish' in out
88+
89+
90+
def test_check_subscription_permissions(test_subscription, capsys):
91+
test_subscription.create()
92+
93+
iam.check_subscription_permissions(
94+
test_subscription.topic.name,
95+
test_subscription.name)
96+
97+
out, _ = capsys.readouterr()
98+
99+
assert test_subscription.topic.name in out
100+
assert test_subscription.name in out
101+
assert 'pubsub.subscriptions.consume' in out

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.