Access control with Identity and Access Management

usingGoogle.Cloud.Iam.V1 ;
usingGoogle.Cloud.PubSub.V1 ;
publicclassGetSubscriptionIamPolicySample
{
publicPolicyGetSubscriptionIamPolicy(stringprojectId,stringsubscriptionId)
{
PublisherServiceApiClient publisher=PublisherServiceApiClient .Create ();
SubscriptionName subscriptionName=SubscriptionName .FromProjectSubscription (projectId,subscriptionId);
Policy policy=publisher.IAMPolicyClient .GetIamPolicy(newGetIamPolicyRequest
{
ResourceAsResourceName=subscriptionName
});
returnpolicy;
}
}

import(
"context"
"fmt"
"io"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/pubsub/v2"
)
funcgetIAMPolicy(wio.Writer,projectID,subscriptionstring)error{
// projectID := "my-project-id"
// subscription := "projects/my-project/subscriptions/my-sub"
ctx:=context.Background()
client,err:=pubsub.NewClient(ctx,projectID)
iferr!=nil{
returnfmt.Errorf("pubsub.NewClient: %w",err)
}
deferclient.Close()
req:=&iampb.GetIamPolicyRequest {
Resource:subscription,
}
policy,err:=client.SubscriptionAdminClient.GetIamPolicy (ctx,req)
iferr!=nil{
returnfmt.Errorf("Policy: %w",err)
}
for_,b:=rangepolicy.Bindings{
for_,m:=rangeb.Members{
fmt.Fprintf(w,"role: %s, member: %s\n",b.Role,m)
}
}
returnnil
}

importcom.google.cloud.pubsub.v1.SubscriptionAdminClient ;
importcom.google.iam.v1.GetIamPolicyRequest ;
importcom.google.iam.v1.Policy ;
importcom.google.pubsub.v1.ProjectSubscriptionName ;
importjava.io.IOException;
publicclass GetSubscriptionPolicyExample{
publicstaticvoidmain(String...args)throwsException{
// TODO(developer): Replace these variables before running the sample.
StringprojectId="your-project-id";
StringsubscriptionId="your-subscription-id";
getSubscriptionPolicyExample(projectId,subscriptionId);
}
publicstaticvoidgetSubscriptionPolicyExample(StringprojectId,StringsubscriptionId)
throwsIOException{
try(SubscriptionAdminClient subscriptionAdminClient=SubscriptionAdminClient .create()){
ProjectSubscriptionName subscriptionName=
ProjectSubscriptionName .of(projectId,subscriptionId);
GetIamPolicyRequest getIamPolicyRequest=
GetIamPolicyRequest .newBuilder().setResource(subscriptionName.toString ()).build();
Policy policy=subscriptionAdminClient.getIamPolicy(getIamPolicyRequest);
System.out.println("Subscription policy: "+policy);
}
}
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const subscriptionNameOrId = 'YOUR_SUBSCRIPTION_NAME_OR_ID';
// Imports the Google Cloud client library
const{PubSub}=require('@google-cloud/pubsub');
// Creates a client; cache this for further use
constpubSubClient=newPubSub ();
asyncfunctiongetSubscriptionPolicy(subscriptionNameOrId){
// Retrieves the IAM policy for the subscription
const[policy]=awaitpubSubClient
.subscription(subscriptionNameOrId)
.iam.getPolicy ();
console.log(`Policy for subscription: ${JSON.stringify(policy.bindings)}.`);
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const subscriptionNameOrId = 'YOUR_SUBSCRIPTION_NAME_OR_ID';
// Imports the Google Cloud client library
import{PubSub,Policy}from'@google-cloud/pubsub';
// Creates a client; cache this for further use
constpubSubClient=newPubSub();
asyncfunctiongetSubscriptionPolicy(subscriptionNameOrId:string){
// Retrieves the IAM policy for the subscription
const[policy]:[Policy]=awaitpubSubClient
.subscription(subscriptionNameOrId)
.iam.getPolicy();
console.log(`Policy for subscription: ${JSON.stringify(policy.bindings)}.`);
}

use Google\Cloud\PubSub\PubSubClient;
/**
 * Prints the policy for a PubSub subscription.
 *
 * @param string $projectId The Google project ID.
 * @param string $subscriptionName The Pub/Sub subscription name.
 */
function get_subscription_policy($projectId, $subscriptionName)
{
 $pubsub = new PubSubClient([
 'projectId' => $projectId,
 ]);
 $subscription = $pubsub->subscription($subscriptionName);
 $policy = $subscription->iam()->policy();
 print_r($policy);
}

fromgoogle.cloudimport pubsub_v1
# TODO(developer): Choose an existing subscription.
# project_id = "your-project-id"
# subscription_id = "your-subscription-id"
client = pubsub_v1.SubscriberClient ()
subscription_path = client.subscription_path(project_id, subscription_id)
policy = client.get_iam_policy(request={"resource": subscription_path})
print("Policy for subscription {}:".format(subscription_path))
for binding in policy.bindings:
 print("Role: {}, Members: {}".format(binding.role, binding.members))
client.close ()

# subscription_id = "your-subscription-id"
pubsub=Google::Cloud::PubSub .new
policy=pubsub.iam .get_iam_policy\
resource:pubsub.subscription_path(subscription_id)
puts"Subscription policy:"
putspolicy.bindings.first.role

usingGoogle.Cloud.Iam.V1 ;
usingGoogle.Cloud.PubSub.V1 ;
publicclassGetTopicIamPolicySample
{
publicPolicyGetTopicIamPolicy(stringprojectId,stringtopicId)
{
PublisherServiceApiClient publisher=PublisherServiceApiClient .Create ();
TopicName topicName=TopicName .FromProjectTopic (projectId,topicId);
Policy policy=publisher.IAMPolicyClient .GetIamPolicy(newGetIamPolicyRequest
{
ResourceAsResourceName=topicName
});
returnpolicy;
}
}

import(
"context"
"fmt"
"io"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/pubsub/v2"
)
funcgetIAMPolicy(wio.Writer,projectID,topicIDstring)error{
// projectID := "my-project-id"
// topicID := "my-topic"
ctx:=context.Background()
client,err:=pubsub.NewClient(ctx,projectID)
iferr!=nil{
returnfmt.Errorf("pubsub.NewClient: %w",err)
}
deferclient.Close()
req:=&iampb.GetIamPolicyRequest {
Resource:fmt.Sprintf("projects/%s/topics/%s",projectID,topicID),
}
policy,err:=client.TopicAdminClient.GetIamPolicy (ctx,req)
iferr!=nil{
returnfmt.Errorf("Policy: %w",err)
}
for_,b:=rangepolicy.Bindings{
for_,m:=rangeb.Members{
fmt.Fprintf(w,"role: %s, member: %s\n",b.Role,m)
}
}
returnnil
}

importcom.google.cloud.pubsub.v1.TopicAdminClient ;
importcom.google.iam.v1.GetIamPolicyRequest ;
importcom.google.iam.v1.Policy ;
importcom.google.pubsub.v1.TopicName ;
importjava.io.IOException;
publicclass GetTopicPolicyExample{
publicstaticvoidmain(String...args)throwsException{
// TODO(developer): Replace these variables before running the sample.
StringprojectId="your-project-id";
StringtopicId="your-topic-id";
getTopicPolicyExample(projectId,topicId);
}
publicstaticvoidgetTopicPolicyExample(StringprojectId,StringtopicId)throwsIOException{
try(TopicAdminClient topicAdminClient=TopicAdminClient .create()){
TopicName topicName=TopicName .of(projectId,topicId);
GetIamPolicyRequest getIamPolicyRequest=
GetIamPolicyRequest .newBuilder().setResource(topicName.toString ()).build();
Policy policy=topicAdminClient.getIamPolicy(getIamPolicyRequest);
System.out.println("Topic policy: "+policy);
}
}
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const topicNameOrId = 'YOUR_TOPIC_NAME_OR_ID';
// Imports the Google Cloud client library
const{PubSub}=require('@google-cloud/pubsub');
// Creates a client; cache this for further use
constpubSubClient=newPubSub ();
asyncfunctiongetTopicPolicy(topicNameOrId){
// Retrieves the IAM policy for the topic
const[policy]=awaitpubSubClient.topic(topicNameOrId).iam.getPolicy ();
console.log('Policy for topic: %j.',policy.bindings);
}

use Google\Cloud\PubSub\PubSubClient;
/**
 * Prints the policy for a Pub/Sub topic.
 *
 * @param string $projectId The Google project ID.
 * @param string $topicName The Pub/Sub topic name.
 */
function get_topic_policy($projectId, $topicName)
{
 $pubsub = new PubSubClient([
 'projectId' => $projectId,
 ]);
 $topic = $pubsub->topic($topicName);
 $policy = $topic->iam()->policy();
 print_r($policy);
}

fromgoogle.cloudimport pubsub_v1
# TODO(developer): Choose an existing topic.
# project_id = "your-project-id"
# topic_id = "your-topic-id"
client = pubsub_v1.PublisherClient ()
topic_path = client.topic_path(project_id, topic_id)
policy = client.get_iam_policy(request={"resource": topic_path})
print("Policy for topic {}:".format(topic_path))
for binding in policy.bindings:
 print("Role: {}, Members: {}".format(binding.role, binding.members))

# topic_id = "your-topic-id"
pubsub=Google::Cloud::PubSub .new
policy=pubsub.iam .get_iam_policyresource:pubsub.topic_path(topic_id)
puts"Topic policy:"
putspolicy.bindings.first.role

usingGoogle.Cloud.Iam.V1 ;
usingGoogle.Cloud.PubSub.V1 ;
publicclassSetSubscriptionIamPolicySample
{
publicPolicySetSubscriptionIamPolicy(stringprojectId,stringsubscriptionId,stringrole,stringmember)
{
PublisherServiceApiClient publisher=PublisherServiceApiClient .Create ();
stringroleToBeAddedToPolicy=$"roles/{role}";
Policy policy=newPolicy
{
Bindings={
newBinding
{
Role=roleToBeAddedToPolicy,
Members={member}
}
}
};
SetIamPolicyRequest request=newSetIamPolicyRequest
{
ResourceAsResourceName=SubscriptionName .FromProjectSubscription (projectId,subscriptionId),
Policy=policy
};
Policy response=publisher.IAMPolicyClient .SetIamPolicy(request);
returnresponse;
}
}

import(
"context"
"fmt"
"io"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/pubsub/v2"
)
funcaddUsersToSubscription(wio.Writer,projectID,subIDstring)error{
// projectID := "my-project-id"
// subID := "my-sub"
ctx:=context.Background()
client,err:=pubsub.NewClient(ctx,projectID)
iferr!=nil{
returnfmt.Errorf("pubsub.NewClient: %w",err)
}
deferclient.Close()
subName:=fmt.Sprintf("projects/%s/subscriptions/%s",projectID,subID)
req:=&iampb.GetIamPolicyRequest {
Resource:subName,
}
policy,err:=client.SubscriptionAdminClient.GetIamPolicy (ctx,req)
iferr!=nil{
returnfmt.Errorf("error calling GetIamPolicy: %w",err)
}
b:=&iampb.Binding {
Role:"roles/editor",
// Other valid prefixes are "serviceAccount:", "user:"
// See the documentation for more values.
Members:[]string{"group:cloud-logs@google.com"},
}
policy.Bindings=append(policy.Bindings,b)
setRequest:=&iampb.SetIamPolicyRequest {
Resource:subName,
Policy:policy,
}
_,err=client.SubscriptionAdminClient.SetIamPolicy (ctx,setRequest)
iferr!=nil{
returnfmt.Errorf("error calling SetIamPolicy: %w",err)
}
fmt.Fprintln(w,"Added roles to subscription.")
returnnil
}

importcom.google.cloud.pubsub.v1.SubscriptionAdminClient ;
importcom.google.iam.v1.Binding ;
importcom.google.iam.v1.GetIamPolicyRequest ;
importcom.google.iam.v1.Policy ;
importcom.google.iam.v1.SetIamPolicyRequest ;
importcom.google.pubsub.v1.ProjectSubscriptionName ;
importjava.io.IOException;
publicclass SetSubscriptionPolicyExample{
publicstaticvoidmain(String...args)throwsException{
// TODO(developer): Replace these variables before running the sample.
StringprojectId="your-project-id";
StringsubscriptionId="your-subscription-id";
setSubscriptionPolicyExample(projectId,subscriptionId);
}
publicstaticvoidsetSubscriptionPolicyExample(StringprojectId,StringsubscriptionId)
throwsIOException{
try(SubscriptionAdminClient subscriptionAdminClient=SubscriptionAdminClient .create()){
ProjectSubscriptionName subscriptionName=
ProjectSubscriptionName .of(projectId,subscriptionId);
GetIamPolicyRequest getIamPolicyRequest=
GetIamPolicyRequest .newBuilder().setResource(subscriptionName.toString ()).build();
Policy oldPolicy=subscriptionAdminClient.getIamPolicy(getIamPolicyRequest);
// Create new role -> members binding
Binding binding=
Binding .newBuilder()
.setRole("roles/pubsub.editor")
.addMembers ("domain:google.com")
.build();
// Add new binding to updated policy
Policy updatedPolicy=Policy .newBuilder(oldPolicy).addBindings (binding).build();
SetIamPolicyRequest setIamPolicyRequest=
SetIamPolicyRequest .newBuilder()
.setResource(subscriptionName.toString ())
.setPolicy (updatedPolicy)
.build();
Policy newPolicy=subscriptionAdminClient.setIamPolicy(setIamPolicyRequest);
System.out.println("New subscription policy: "+newPolicy);
}
}
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const subscriptionNameOrId = 'YOUR_SUBSCRIPTION_NAME_OR_ID';
// Imports the Google Cloud client library
const{PubSub}=require('@google-cloud/pubsub');
// Creates a client; cache this for further use
constpubSubClient=newPubSub ();
asyncfunctionsetSubscriptionPolicy(subscriptionNameOrId){
// The new IAM policy
constnewPolicy={
bindings:[
{
// Add a group as editors
role:'roles/pubsub.editor',
members:['group:cloud-logs@google.com'],
},
{
// Add all users as viewers
role:'roles/pubsub.viewer',
members:['allUsers'],
},
],
};
// Updates the IAM policy for the subscription
const[updatedPolicy]=awaitpubSubClient
.subscription(subscriptionNameOrId)
.iam.setPolicy (newPolicy);
console.log('Updated policy for subscription: %j',updatedPolicy.bindings);
}

use Google\Cloud\PubSub\PubSubClient;
/**
 * Adds a user to the policy for a Pub/Sub subscription.
 *
 * @param string $projectId The Google project ID.
 * @param string $subscriptionName The Pub/Sub subscription name.
 * @param string $userEmail The user email to add to the policy.
 */
function set_subscription_policy($projectId, $subscriptionName, $userEmail)
{
 $pubsub = new PubSubClient([
 'projectId' => $projectId,
 ]);
 $subscription = $pubsub->subscription($subscriptionName);
 $policy = $subscription->iam()->policy();
 $policy['bindings'][] = [
 'role' => 'roles/pubsub.subscriber',
 'members' => ['user:' . $userEmail]
 ];
 $subscription->iam()->setPolicy($policy);
 printf(
 'User %s added to policy for %s' . PHP_EOL,
 $userEmail,
 $subscriptionName
 );
}

fromgoogle.cloudimport pubsub_v1
# TODO(developer): Choose an existing subscription.
# project_id = "your-project-id"
# subscription_id = "your-subscription-id"
client = pubsub_v1.SubscriberClient ()
subscription_path = client.subscription_path(project_id, subscription_id)
policy = client.get_iam_policy(request={"resource": subscription_path})
# Add all users as viewers.
policy.bindings.add(role="roles/pubsub.viewer", members=["domain:google.com"])
# Add a group as an editor.
policy.bindings.add(role="roles/editor", members=["group:cloud-logs@google.com"])
# Set the policy
policy = client.set_iam_policy(
 request={"resource": subscription_path, "policy": policy}
)
print("IAM policy for subscription {} set: {}".format(subscription_id, policy))
client.close ()

# subscription_id = "your-subscription-id"
# role = "roles/pubsub.subscriber"
# service_account_email =
# "serviceAccount:account_name@project_name.iam.gserviceaccount.com"
pubsub=Google::Cloud::PubSub .new
bindings=Google::Iam::V1 ::Binding.new \
role:role,
members:[service_account_email]
pubsub.iam .set_iam_policyresource:pubsub.subscription_path(subscription_id),
policy:{
bindings:[bindings]
}

usingGoogle.Cloud.Iam.V1 ;
usingGoogle.Cloud.PubSub.V1 ;
publicclassSetTopicIamPolicySample
{
publicPolicySetTopicIamPolicy(stringprojectId,stringtopicId,stringrole,stringmember)
{
PublisherServiceApiClient publisher=PublisherServiceApiClient .Create ();
stringroleToBeAddedToPolicy=$"roles/{role}";
Policy policy=newPolicy
{
Bindings={
newBinding
{
Role=roleToBeAddedToPolicy,
Members={member}
}
}
};
SetIamPolicyRequest request=newSetIamPolicyRequest
{
ResourceAsResourceName=TopicName .FromProjectTopic (projectId,topicId),
Policy=policy
};
Policy response=publisher.IAMPolicyClient .SetIamPolicy(request);
returnresponse;
}
}

import(
"context"
"fmt"
"io"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/pubsub/v2"
)
funcaddUsersToTopic(wio.Writer,projectID,topicIDstring)error{
// projectID := "my-project-id"
// topicID := "my-topic"
ctx:=context.Background()
client,err:=pubsub.NewClient(ctx,projectID)
iferr!=nil{
returnfmt.Errorf("pubsub.NewClient: %w",err)
}
deferclient.Close()
topicName:=fmt.Sprintf("projects/%s/topics/%s",projectID,topicID)
req:=&iampb.GetIamPolicyRequest {
Resource:topicName,
}
policy,err:=client.TopicAdminClient.GetIamPolicy (ctx,req)
iferr!=nil{
returnfmt.Errorf("error calling GetIamPolicy: %w",err)
}
b:=&iampb.Binding {
Role:"roles/editor",
// Other valid prefixes are "serviceAccount:", "user:"
// See the documentation for more values.
Members:[]string{"group:cloud-logs@google.com"},
}
policy.Bindings=append(policy.Bindings,b)
setRequest:=&iampb.SetIamPolicyRequest {
Resource:topicName,
Policy:policy,
}
_,err=client.TopicAdminClient.SetIamPolicy (ctx,setRequest)
iferr!=nil{
returnfmt.Errorf("error calling SetIamPolicy: %w",err)
}
fmt.Fprintln(w,"Added roles to topic.")
returnnil
}

importcom.google.cloud.pubsub.v1.TopicAdminClient ;
importcom.google.iam.v1.Binding ;
importcom.google.iam.v1.GetIamPolicyRequest ;
importcom.google.iam.v1.Policy ;
importcom.google.iam.v1.SetIamPolicyRequest ;
importcom.google.pubsub.v1.TopicName ;
importjava.io.IOException;
publicclass SetTopicPolicyExample{
publicstaticvoidmain(String...args)throwsException{
// TODO(developer): Replace these variables before running the sample.
StringprojectId="your-project-id";
StringtopicId="your-topic-id";
setTopicPolicyExample(projectId,topicId);
}
publicstaticvoidsetTopicPolicyExample(StringprojectId,StringtopicId)throwsIOException{
try(TopicAdminClient topicAdminClient=TopicAdminClient .create()){
TopicName topicName=TopicName .of(projectId,topicId);
GetIamPolicyRequest getIamPolicyRequest=
GetIamPolicyRequest .newBuilder().setResource(topicName.toString ()).build();
Policy oldPolicy=topicAdminClient.getIamPolicy(getIamPolicyRequest);
// Create new role -> members binding
Binding binding=
Binding .newBuilder()
.setRole("roles/pubsub.editor")
.addMembers ("domain:google.com")
.build();
// Add new binding to updated policy
Policy updatedPolicy=Policy .newBuilder(oldPolicy).addBindings (binding).build();
SetIamPolicyRequest setIamPolicyRequest=
SetIamPolicyRequest .newBuilder()
.setResource(topicName.toString ())
.setPolicy (updatedPolicy)
.build();
Policy newPolicy=topicAdminClient.setIamPolicy(setIamPolicyRequest);
System.out.println("New topic policy: "+newPolicy);
}
}
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const topicNameOrId = 'YOUR_TOPIC_NAME_OR_ID';
// Imports the Google Cloud client library
const{PubSub}=require('@google-cloud/pubsub');
// Creates a client; cache this for further use
constpubSubClient=newPubSub ();
asyncfunctionsetTopicPolicy(topicNameOrId){
// The new IAM policy
constnewPolicy={
bindings:[
{
// Add a group as editors
role:'roles/pubsub.editor',
members:['group:cloud-logs@google.com'],
},
{
// Add all users as viewers
role:'roles/pubsub.viewer',
members:['allUsers'],
},
],
};
// Updates the IAM policy for the topic
const[updatedPolicy]=awaitpubSubClient
.topic(topicNameOrId)
.iam.setPolicy (newPolicy);
console.log('Updated policy for topic: %j',updatedPolicy.bindings);
}

use Google\Cloud\PubSub\PubSubClient;
/**
 * Adds a user to the policy for a Pub/Sub topic.
 *
 * @param string $projectId The Google project ID.
 * @param string $topicName The Pub/Sub topic name.
 * @param string $userEmail The user email to add to the policy.
 */
function set_topic_policy($projectId, $topicName, $userEmail)
{
 $pubsub = new PubSubClient([
 'projectId' => $projectId,
 ]);
 $topic = $pubsub->topic($topicName);
 $policy = $topic->iam()->policy();
 $policy['bindings'][] = [
 'role' => 'roles/pubsub.publisher',
 'members' => ['user:' . $userEmail]
 ];
 $topic->iam()->setPolicy($policy);
 printf(
 'User %s added to policy for %s' . PHP_EOL,
 $userEmail,
 $topicName
 );
}

fromgoogle.cloudimport pubsub_v1
# TODO(developer): Choose an existing topic.
# project_id = "your-project-id"
# topic_id = "your-topic-id"
client = pubsub_v1.PublisherClient ()
topic_path = client.topic_path(project_id, topic_id)
policy = client.get_iam_policy(request={"resource": topic_path})
# Add all users as viewers.
policy.bindings.add(role="roles/pubsub.viewer", members=["domain:google.com"])
# Add a group as a publisher.
policy.bindings.add(
 role="roles/pubsub.publisher", members=["group:cloud-logs@google.com"]
)
# Set the policy
policy = client.set_iam_policy(request={"resource": topic_path, "policy": policy})
print("IAM policy for topic {} set: {}".format(topic_id, policy))

# topic_id = "your-topic-id"
# role = "roles/pubsub.publisher"
# service_account_email =
# "serviceAccount:account_name@project_name.iam.gserviceaccount.com"
pubsub=Google::Cloud::PubSub .new
bindings=Google::Iam::V1 ::Binding.new \
role:role,
members:[service_account_email]
pubsub.iam .set_iam_policyresource:pubsub.topic_path(topic_id),
policy:{
bindings:[bindings]
}

usingGoogle.Cloud.Iam.V1 ;
usingGoogle.Cloud.PubSub.V1 ;
publicclassTestSubscriptionIamPermissionsSample
{
publicTestIamPermissionsResponseTestSubscriptionIamPermissionsResponse(stringprojectId,stringsubscriptionId)
{
TestIamPermissionsRequest request=newTestIamPermissionsRequest
{
ResourceAsResourceName=SubscriptionName .FromProjectSubscription (projectId,subscriptionId),
Permissions={"pubsub.subscriptions.get","pubsub.subscriptions.update"}
};
PublisherServiceApiClient publisher=PublisherServiceApiClient .Create ();
TestIamPermissionsResponse response=publisher.IAMPolicyClient .TestIamPermissions(request);
returnresponse;
}
}

import(
"context"
"fmt"
"io"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/pubsub/v2"
)
functestPermissions(wio.Writer,projectID,subIDstring)([]string,error){
// projectID := "my-project-id"
// subID := "my-sub"
ctx:=context.Background()
client,err:=pubsub.NewClient(ctx,projectID)
iferr!=nil{
returnnil,fmt.Errorf("pubsub.NewClient: %w",err)
}
req:=&iampb.TestIamPermissionsRequest {
Resource:fmt.Sprintf("projects/%s/subscriptions/%s",projectID,subID),
Permissions:[]string{
"pubsub.subscriptions.consume",
"pubsub.subscriptions.update",
},
}
resp,err:=client.SubscriptionAdminClient.TestIamPermissions (ctx,req)
iferr!=nil{
returnnil,fmt.Errorf("error calling TestIamPermissions: %w",err)
}
for_,perm:=rangeresp.Permissions{
fmt.Fprintf(w,"Allowed: %v\n",perm)
}
returnresp.Permissions,nil
}

importcom.google.cloud.pubsub.v1.SubscriptionAdminClient ;
importcom.google.iam.v1.TestIamPermissionsRequest ;
importcom.google.iam.v1.TestIamPermissionsResponse ;
importcom.google.pubsub.v1.ProjectSubscriptionName ;
importjava.io.IOException;
importjava.util.LinkedList;
importjava.util.List;
publicclass TestSubscriptionPermissionsExample{
publicstaticvoidmain(String...args)throwsException{
// TODO(developer): Replace these variables before running the sample.
StringprojectId="your-project-id";
StringsubscriptionId="your-subscription-id";
testSubscriptionPermissionsExample(projectId,subscriptionId);
}
publicstaticvoidtestSubscriptionPermissionsExample(StringprojectId,StringsubscriptionId)
throwsIOException{
try(SubscriptionAdminClient subscriptionAdminClient=SubscriptionAdminClient .create()){
ProjectSubscriptionName subscriptionName=
ProjectSubscriptionName .of(projectId,subscriptionId);
List<String>permissions=newLinkedList<>();
permissions.add("pubsub.subscriptions.consume");
permissions.add("pubsub.subscriptions.update");
TestIamPermissionsRequest testIamPermissionsRequest=
TestIamPermissionsRequest .newBuilder()
.setResource(subscriptionName.toString ())
.addAllPermissions(permissions)
.build();
TestIamPermissionsResponse testedPermissionsResponse=
subscriptionAdminClient.testIamPermissions(testIamPermissionsRequest);
System.out.println("Tested:\n"+testedPermissionsResponse);
}
}
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const subscriptionNameOrId = 'YOUR_SUBSCRIPTION_NAME_OR_ID';
// Imports the Google Cloud client library
const{PubSub}=require('@google-cloud/pubsub');
// Creates a client; cache this for further use
constpubSubClient=newPubSub ();
asyncfunctiontestSubscriptionPermissions(subscriptionNameOrId){
constpermissionsToTest=[
'pubsub.subscriptions.consume',
'pubsub.subscriptions.update',
];
// Tests the IAM policy for the specified subscription
const[permissions]=awaitpubSubClient
.subscription(subscriptionNameOrId)
.iam.testPermissions (permissionsToTest);
console.log('Tested permissions for subscription: %j',permissions);
}

use Google\Cloud\PubSub\PubSubClient;
/**
 * Prints the permissions of a subscription.
 *
 * @param string $projectId The Google project ID.
 * @param string $subscriptionName The Pub/Sub subscription name.
 */
function test_subscription_permissions($projectId, $subscriptionName)
{
 $pubsub = new PubSubClient([
 'projectId' => $projectId,
 ]);
 $subscription = $pubsub->subscription($subscriptionName);
 $permissions = $subscription->iam()->testPermissions([
 'pubsub.subscriptions.consume',
 'pubsub.subscriptions.update'
 ]);
 foreach ($permissions as $permission) {
 printf('Permission: %s' . PHP_EOL, $permission);
 }
}

fromgoogle.cloudimport pubsub_v1
# TODO(developer): Choose an existing subscription.
# project_id = "your-project-id"
# subscription_id = "your-subscription-id"
client = pubsub_v1.SubscriberClient ()
subscription_path = client.subscription_path(project_id, subscription_id)
permissions_to_check = [
 "pubsub.subscriptions.consume",
 "pubsub.subscriptions.update",
]
allowed_permissions = client.test_iam_permissions(
 request={"resource": subscription_path, "permissions": permissions_to_check}
)
print(
 "Allowed permissions for subscription {}: {}".format(
 subscription_path, allowed_permissions
 )
)
client.close ()

# subscription_id = "your-subscription-id"
pubsub=Google::Cloud::PubSub .new
subscription_admin=pubsub.subscription_admin
permissions=["pubsub.subscriptions.consume","pubsub.subscriptions.update"]
response=pubsub.iam .test_iam_permissions\
resource:pubsub.subscription_path(subscription_id),
permissions:permissions
puts"Permission to consume"\
ifresponse.permissions.include?"pubsub.subscriptions.consume"
puts"Permission to update"\
ifresponse.permissions.include?"pubsub.subscriptions.update"

usingGoogle.Cloud.Iam.V1 ;
usingGoogle.Cloud.PubSub.V1 ;
publicclassTestTopicIamPermissionsSample
{
publicTestIamPermissionsResponseTestTopicIamPermissions(stringprojectId,stringtopicId)
{
TestIamPermissionsRequest request=newTestIamPermissionsRequest
{
ResourceAsResourceName=TopicName .FromProjectTopic (projectId,topicId),
Permissions={"pubsub.topics.get","pubsub.topics.update"}
};
PublisherServiceApiClient publisher=PublisherServiceApiClient .Create ();
TestIamPermissionsResponse response=publisher.IAMPolicyClient .TestIamPermissions(request);
returnresponse;
}
}

import(
"context"
"fmt"
"io"
"cloud.google.com/go/iam/apiv1/iampb"
"cloud.google.com/go/pubsub/v2"
)
functestPermissions(wio.Writer,projectID,topicIDstring)([]string,error){
// projectID := "my-project-id"
// topicID := "my-topic"
ctx:=context.Background()
client,err:=pubsub.NewClient(ctx,projectID)
iferr!=nil{
returnnil,fmt.Errorf("pubsub.NewClient: %w",err)
}
req:=&iampb.TestIamPermissionsRequest {
Resource:fmt.Sprintf("projects/%s/topics/%s",projectID,topicID),
Permissions:[]string{
"pubsub.topics.publish",
"pubsub.topics.update",
},
}
resp,err:=client.TopicAdminClient.TestIamPermissions (ctx,req)
iferr!=nil{
returnnil,fmt.Errorf("error calling TestIamPermissions: %w",err)
}
for_,perm:=rangeresp.Permissions{
fmt.Fprintf(w,"Allowed: %v\n",perm)
}
returnresp.Permissions,nil
}

importcom.google.cloud.pubsub.v1.TopicAdminClient ;
importcom.google.iam.v1.TestIamPermissionsRequest ;
importcom.google.iam.v1.TestIamPermissionsResponse ;
importcom.google.pubsub.v1.ProjectTopicName ;
importjava.io.IOException;
importjava.util.LinkedList;
importjava.util.List;
publicclass TestTopicPermissionsExample{
publicstaticvoidmain(String...args)throwsException{
// TODO(developer): Replace these variables before running the sample.
StringprojectId="your-project-id";
StringtopicId="your-topic-id";
testTopicPermissionsExample(projectId,topicId);
}
publicstaticvoidtestTopicPermissionsExample(StringprojectId,StringtopicId)
throwsIOException{
try(TopicAdminClient topicAdminClient=TopicAdminClient .create()){
ProjectTopicName topicName=ProjectTopicName .of(projectId,topicId);
List<String>permissions=newLinkedList<>();
permissions.add("pubsub.topics.attachSubscription");
permissions.add("pubsub.topics.publish");
permissions.add("pubsub.topics.update");
TestIamPermissionsRequest testIamPermissionsRequest=
TestIamPermissionsRequest .newBuilder()
.setResource(topicName.toString ())
.addAllPermissions(permissions)
.build();
TestIamPermissionsResponse testedPermissionsResponse=
topicAdminClient.testIamPermissions(testIamPermissionsRequest);
System.out.println("Tested:\n"+testedPermissionsResponse);
}
}
}

/**
 * TODO(developer): Uncomment this variable before running the sample.
 */
// const topicNameOrId = 'YOUR_TOPIC_NAME_OR_ID';
// Imports the Google Cloud client library
const{PubSub}=require('@google-cloud/pubsub');
// Creates a client; cache this for further use
constpubSubClient=newPubSub ();
asyncfunctiontestTopicPermissions(topicNameOrId){
constpermissionsToTest=[
'pubsub.topics.attachSubscription',
'pubsub.topics.publish',
'pubsub.topics.update',
];
// Tests the IAM policy for the specified topic
const[permissions]=awaitpubSubClient
.topic(topicNameOrId)
.iam.testPermissions (permissionsToTest);
console.log('Tested permissions for topic: %j',permissions);
}

use Google\Cloud\PubSub\PubSubClient;
/**
 * Prints the permissions of a topic.
 *
 * @param string $projectId The Google project ID.
 * @param string $topicName The Pub/Sub topic name.
 */
function test_topic_permissions($projectId, $topicName)
{
 $pubsub = new PubSubClient([
 'projectId' => $projectId,
 ]);
 $topic = $pubsub->topic($topicName);
 $permissions = $topic->iam()->testPermissions([
 'pubsub.topics.attachSubscription',
 'pubsub.topics.publish',
 'pubsub.topics.update'
 ]);
 foreach ($permissions as $permission) {
 printf('Permission: %s' . PHP_EOL, $permission);
 }
}

fromgoogle.cloudimport pubsub_v1
# TODO(developer): Choose an existing topic.
# project_id = "your-project-id"
# topic_id = "your-topic-id"
client = pubsub_v1.PublisherClient ()
topic_path = client.topic_path(project_id, topic_id)
permissions_to_check = ["pubsub.topics.publish", "pubsub.topics.update"]
allowed_permissions = client.test_iam_permissions(
 request={"resource": topic_path, "permissions": permissions_to_check}
)
print(
 "Allowed permissions for topic {}: {}".format(topic_path, allowed_permissions)
)

# topic_id = "your-topic-id"
pubsub=Google::Cloud::PubSub .new
topic_admin=pubsub.topic_admin
permissions=["pubsub.topics.attachSubscription","pubsub.topics.publish",
"pubsub.topics.update"]
response=pubsub.iam .test_iam_permissions\
resource:pubsub.topic_path(topic_id),
permissions:permissions
puts"Permission to attach subscription"\
ifpermissions.include?"pubsub.topics.attachSubscription"
puts"Permission to publish"\
ifresponse.permissions.include?"pubsub.topics.publish"
puts"Permission to update"\
ifresponse.permissions.include?"pubsub.topics.update"