delowan.googlecloud.gcp_storage_bucket_access_control (1.0.2) — module

Install collection

Install with ansible-galaxy collection install delowan.googlecloud:==1.0.2

Add to requirements.yml

  collections:
    - name: delowan.googlecloud
      version: 1.0.2

Description

The BucketAccessControls resource represents the Access Control Lists (ACLs) for buckets within Google Cloud Storage. ACLs let you specify who has access to your data and to what extent.

There are three roles that can be assigned to an entity: READERs can get the bucket, though no acl property will be returned, and list the bucket's objects. WRITERs are READERs, and they can insert objects into the bucket and delete the bucket's objects. OWNERs are WRITERs, and they can get the acl property of a bucket, update a bucket, and call all BucketAccessControls methods on the bucket. For more information, see Access Control, with the caveat that this API uses READER, WRITER, and OWNER instead of READ, WRITE, and FULL_CONTROL.

Requirements

• python >= 2.6
• requests >= 2.18.4
• google-auth >= 1.3.0

Usage examples

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: create a bucket
  google.cloud.gcp_storage_bucket:
    name: "{{ resource_name }}"
    project: "{{ gcp_project }}"
    auth_kind: "{{ gcp_cred_kind }}"
    service_account_file: "{{ gcp_cred_file }}"
    state: present
  register: bucket

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: create a bucket access control
  google.cloud.gcp_storage_bucket_access_control:
    bucket: "{{ bucket }}"
    entity: user-alexstephen@google.com
    role: WRITER
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present

Inputs

    
role:
    description:
    - The access permission for the entity.
    - 'Some valid choices include: "OWNER", "READER", "WRITER"'
    required: false
    type: str

state:
    choices:
    - present
    - absent
    default: present
    description:
    - Whether the given object should exist in GCP
    type: str

bucket:
    description:
    - The name of the bucket.
    - 'This field represents a link to a Bucket resource in GCP. It can be specified in
      two ways. First, you can place a dictionary with key ''name'' and value of your
      resource''s name Alternatively, you can add `register: name-of-resource` to a gcp_storage_bucket
      task and then set this bucket field to "{{ name-of-resource }}"'
    required: true
    type: dict

entity:
    description:
    - 'The entity holding the permission, in one of the following forms: user-userId user-email
      group-groupId group-email domain-domain project-team-projectId allUsers allAuthenticatedUsers
      Examples: The user liz@example.com would be user-liz@example.com.'
    - The group example@googlegroups.com would be group-example@googlegroups.com.
    - To refer to all members of the Google Apps for Business domain example.com, the
      entity would be domain-example.com.
    required: true
    type: str

scopes:
    description:
    - Array of scopes to be used
    elements: str
    type: list

project:
    description:
    - The Google Cloud Platform project to use.
    type: str

env_type:
    description:
    - Specifies which Ansible environment you're running this module within.
    - This should not be set unless you know what you're doing.
    - This only alters the User Agent string for any API requests.
    type: str

auth_kind:
    choices:
    - application
    - machineaccount
    - serviceaccount
    description:
    - The type of credential used.
    required: true
    type: str

service_account_file:
    description:
    - The path of a Service Account JSON file if serviceaccount is selected as type.
    type: path

service_account_email:
    description:
    - An optional service account email address if machineaccount is selected and the
      user does not wish to use the default email.
    type: str

service_account_contents:
    description:
    - The contents of a Service Account JSON file, either in a dictionary or as a JSON
      string that represents it.
    type: jsonarg

Outputs

bucket:
  description:
  - The name of the bucket.
  returned: success
  type: dict
domain:
  description:
  - The domain associated with the entity.
  returned: success
  type: str
email:
  description:
  - The email address associated with the entity.
  returned: success
  type: str
entity:
  description:
  - 'The entity holding the permission, in one of the following forms: user-userId
    user-email group-groupId group-email domain-domain project-team-projectId allUsers
    allAuthenticatedUsers Examples: The user liz@example.com would be user-liz@example.com.'
  - The group example@googlegroups.com would be group-example@googlegroups.com.
  - To refer to all members of the Google Apps for Business domain example.com, the
    entity would be domain-example.com.
  returned: success
  type: str
entityId:
  description:
  - The ID for the entity.
  returned: success
  type: str
id:
  description:
  - The ID of the access-control entry.
  returned: success
  type: str
projectTeam:
  contains:
    projectNumber:
      description:
      - The project team associated with the entity.
      returned: success
      type: str
    team:
      description:
      - The team.
      returned: success
      type: str
  description:
  - The project team associated with the entity.
  returned: success
  type: complex
role:
  description:
  - The access permission for the entity.
  returned: success
  type: str