Skip to content

Commit 5f0771a

Browse files
ryanmatsbshaffer
ryanmats
authored and
bshaffer
committed
Storage Bucket Level IAM samples (GoogleCloudPlatform#361)
1 parent 5dfb977 commit 5f0771a

File tree

8 files changed

+445
-21
lines changed

8 files changed

+445
-21
lines changed

‎storage/api/composer.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
"files": [
1212
"src/functions/add_bucket_acl.php",
1313
"src/functions/add_bucket_default_acl.php",
14+
"src/functions/add_bucket_iam_member.php",
1415
"src/functions/add_object_acl.php",
1516
"src/functions/copy_object.php",
1617
"src/functions/create_bucket.php",
@@ -34,9 +35,11 @@
3435
"src/functions/list_objects_with_prefix.php",
3536
"src/functions/make_public.php",
3637
"src/functions/move_object.php",
38+
"src/functions/remove_bucket_iam_member.php",
3739
"src/functions/rotate_encryption_key.php",
3840
"src/functions/upload_encrypted_object.php",
39-
"src/functions/upload_object.php"
41+
"src/functions/upload_object.php",
42+
"src/functions/view_bucket_iam_members.php"
4043
]
4144
},
4245
"require-dev": {

‎storage/api/composer.lock‎

Lines changed: 20 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎storage/api/src/IamCommand.php‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
<?php
2+
/**
3+
* Copyright 2016 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
namespace Google\Cloud\Samples\Storage;
19+
20+
use Symfony\Component\Console\Command\Command;
21+
use Symfony\Component\Console\Input\InputArgument;
22+
use Symfony\Component\Console\Input\InputInterface;
23+
use Symfony\Component\Console\Input\InputOption;
24+
use Symfony\Component\Console\Output\OutputInterface;
25+
use InvalidArgumentException;
26+
27+
/**
28+
* Command line utility to manage Storage IAM.
29+
*
30+
* Usage: php storage.php iam
31+
*/
32+
class IamCommand extends Command
33+
{
34+
protected function configure()
35+
{
36+
$this
37+
->setName('iam')
38+
->setDescription('Manage IAM for Storage')
39+
->setHelp(<<<EOF
40+
The <info>%command.name%</info> command manages Storage IAM policies.
41+
42+
<info>php %command.full_name% my-bucket</info>
43+
44+
<info>php %command.full_name% my-bucket --role my-role --add-member user/[email protected]</info>
45+
46+
<info>php %command.full_name% my-bucket --role my-role --remove-member user/[email protected]</info>
47+
48+
EOF
49+
)
50+
->addArgument(
51+
'bucket',
52+
InputArgument::REQUIRED,
53+
'The bucket that you want to change IAM for. '
54+
)
55+
->addOption(
56+
'role',
57+
null,
58+
InputOption::VALUE_REQUIRED,
59+
'The new role to add to a bucket. '
60+
)
61+
->addOption(
62+
'add-member',
63+
null,
64+
InputOption::VALUE_REQUIRED,
65+
'The new member to add with the new role to the bucket. '
66+
)
67+
->addOption(
68+
'remove-member',
69+
null,
70+
InputOption::VALUE_REQUIRED,
71+
'The member to remove from a role for a bucket. '
72+
)
73+
;
74+
}
75+
76+
protected function execute(InputInterface $input, OutputInterface $output)
77+
{
78+
$bucketName = $input->getArgument('bucket');
79+
$role = $input->getOption('role');
80+
$addMember = $input->getOption('add-member');
81+
$removeMember = $input->getOption('remove-member');
82+
if ($addMember) {
83+
if (!$role) {
84+
throw new InvalidArgumentException('Must provide role as an option.');
85+
}
86+
add_bucket_iam_member($bucketName, $role, $addMember);
87+
} elseif ($removeMember) {
88+
if (!$role) {
89+
throw new InvalidArgumentException('Must provide role as an option.');
90+
}
91+
remove_bucket_iam_member($bucketName, $role, $removeMember);
92+
} else {
93+
view_bucket_iam_members($bucketName);
94+
}
95+
}
96+
}

‎storage/api/src/functions/add_bucket_iam_member.php‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<?php
2+
/**
3+
* Copyright 2016 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/master/storage/api/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START add_bucket_iam_member]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Adds a new member / role IAM pair to a given Cloud Storage bucket.
31+
*
32+
* @param string $bucketName the name of your Cloud Storage bucket.
33+
* @param string $role the role you want to add a given member to.
34+
* @param string $member the member you want to give the new role for the Cloud
35+
* Storage bucket.
36+
*
37+
* @return void
38+
*/
39+
function add_bucket_iam_member($bucketName, $role, $member)
40+
{
41+
$storage = new StorageClient();
42+
$bucket = $storage->bucket($bucketName);
43+
44+
$policy = $bucket->iam()->policy();
45+
46+
$policy['bindings'][] = [
47+
'role' => $role,
48+
'members' => [$member]
49+
];
50+
51+
$bucket->iam()->setPolicy($policy);
52+
53+
printf('User %s added to role %s for bucket %s' . PHP_EOL, $member, $role, $bucketName);
54+
}
55+
# [END add_bucket_iam_member]

‎storage/api/src/functions/remove_bucket_iam_member.php‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<?php
2+
/**
3+
* Copyright 2016 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/master/storage/api/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START remove_bucket_iam_member]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Removes a member / role IAM pair from a given Cloud Storage bucket.
31+
*
32+
* @param string $bucketName the name of your Cloud Storage bucket.
33+
* @param string $role the role you want to remove a given member from.
34+
* @param string $member the member you want to remove from the given role.
35+
*
36+
* @return void
37+
*/
38+
function remove_bucket_iam_member($bucketName, $role, $member)
39+
{
40+
$storage = new StorageClient();
41+
$bucket = $storage->bucket($bucketName);
42+
43+
$policy = $bucket->iam()->policy();
44+
45+
foreach ($policy['bindings'] as $i => &$binding) {
46+
if ($binding['role'] == $role) {
47+
if (false !== $j = array_search($member, $binding['members'])) {
48+
unset($binding['members'][$j]);
49+
$binding['members'] = array_values($binding['members']);
50+
if (empty($binding['members'])) {
51+
unset($policy['bindings'][$i]);
52+
$policy['bindings'] = array_values($policy['bindings']);
53+
}
54+
$bucket->iam()->setPolicy($policy);
55+
printf('User %s removed from role %s for bucket %s' . PHP_EOL, $member, $role, $bucketName);
56+
return;
57+
} else {
58+
printf('Member %s not found for role %s for bucket %s.' . PHP_EOL, $member, $role, $bucketName);
59+
}
60+
}
61+
}
62+
printf('Role %s not found for bucket %s.' . PHP_EOL, $role, $bucketName);
63+
}
64+
# [END remove_bucket_iam_member]

0 commit comments

Comments
 (0)