delowan.googlecloud.gcp_storage_default_object_acl (1.0.2) — module

Install collection

Install with ansible-galaxy collection install delowan.googlecloud:==1.0.2

Add to requirements.yml

  collections:
    - name: delowan.googlecloud
      version: 1.0.2

Description

The DefaultObjectAccessControls resources represent the Access Control Lists (ACLs) applied to a new object within a Google Cloud Storage bucket when no ACL was provided for that object. ACLs let you specify who has access to your bucket contents and to what extent.

There are two roles that can be assigned to an entity: READERs can get an object, though the acl property will not be revealed.

OWNERs are READERs, and they can get the acl property, update an object, and call all objectAccessControls methods on the object. The owner of an object is always an OWNER.

For more information, see Access Control, with the caveat that this API uses READER and OWNER instead of READ and FULL_CONTROL.

Requirements

• python >= 2.6
• requests >= 2.18.4
• google-auth >= 1.3.0

Usage examples

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: create a bucket
  google.cloud.gcp_storage_bucket:
    name: "{{ resource_name }}"
    project: "{{ gcp_project }}"
    auth_kind: "{{ gcp_cred_kind }}"
    service_account_file: "{{ gcp_cred_file }}"
    state: present
  register: bucket

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: create a default object acl
  google.cloud.gcp_storage_default_object_acl:
    bucket: "{{ bucket }}"
    entity: OWNER:user-alexstephen@google.com
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present

Inputs

    
role:
    description:
    - The access permission for the entity.
    - 'Some valid choices include: "OWNER", "READER"'
    required: true
    type: str

state:
    choices:
    - present
    - absent
    default: present
    description:
    - Whether the given object should exist in GCP
    type: str

bucket:
    description:
    - The name of the bucket.
    - 'This field represents a link to a Bucket resource in GCP. It can be specified in
      two ways. First, you can place a dictionary with key ''name'' and value of your
      resource''s name Alternatively, you can add `register: name-of-resource` to a gcp_storage_bucket
      task and then set this bucket field to "{{ name-of-resource }}"'
    required: true
    type: dict

entity:
    description:
    - 'The entity holding the permission, in one of the following forms: * user-{{userId}}
      * user-{{email}} (such as "user-liz@example.com") * group-{{groupId}} * group-{{email}}
      (such as "group-example@googlegroups.com") * domain-{{domain}} (such as "domain-example.com")
      * project-team-{{projectId}} * allUsers * allAuthenticatedUsers .'
    required: true
    type: str

object:
    description:
    - The name of the object, if applied to an object.
    required: false
    type: str

scopes:
    description:
    - Array of scopes to be used
    elements: str
    type: list

project:
    description:
    - The Google Cloud Platform project to use.
    type: str

env_type:
    description:
    - Specifies which Ansible environment you're running this module within.
    - This should not be set unless you know what you're doing.
    - This only alters the User Agent string for any API requests.
    type: str

auth_kind:
    choices:
    - application
    - machineaccount
    - serviceaccount
    description:
    - The type of credential used.
    required: true
    type: str

service_account_file:
    description:
    - The path of a Service Account JSON file if serviceaccount is selected as type.
    type: path

service_account_email:
    description:
    - An optional service account email address if machineaccount is selected and the
      user does not wish to use the default email.
    type: str

service_account_contents:
    description:
    - The contents of a Service Account JSON file, either in a dictionary or as a JSON
      string that represents it.
    type: jsonarg

Outputs

bucket:
  description:
  - The name of the bucket.
  returned: success
  type: dict
domain:
  description:
  - The domain associated with the entity.
  returned: success
  type: str
email:
  description:
  - The email address associated with the entity.
  returned: success
  type: str
entity:
  description:
  - 'The entity holding the permission, in one of the following forms: * user-{{userId}}
    * user-{{email}} (such as "user-liz@example.com") * group-{{groupId}} * group-{{email}}
    (such as "group-example@googlegroups.com") * domain-{{domain}} (such as "domain-example.com")
    * project-team-{{projectId}} * allUsers * allAuthenticatedUsers .'
  returned: success
  type: str
entityId:
  description:
  - The ID for the entity.
  returned: success
  type: str
generation:
  description:
  - The content generation of the object, if applied to an object.
  returned: success
  type: int
id:
  description:
  - The ID of the access-control entry.
  returned: success
  type: str
object:
  description:
  - The name of the object, if applied to an object.
  returned: success
  type: str
projectTeam:
  contains:
    projectNumber:
      description:
      - The project team associated with the entity.
      returned: success
      type: str
    team:
      description:
      - The team.
      returned: success
      type: str
  description:
  - The project team associated with the entity.
  returned: success
  type: complex
role:
  description:
  - The access permission for the entity.
  returned: success
  type: str