-
Notifications
You must be signed in to change notification settings - Fork 132
feat(spanner): add samples for fine grained access control #2172
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 5 commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
a37902d
feat(spanner): add samples for fine grained access control
rahul2393 75b2c74
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] 033375c
fix sample checkstyles
rahul2393 51c8726
incorporate review comment
rahul2393 d92aae6
incorporate requested changes
rahul2393 aaa7a9d
incorporate requested changes
rahul2393 d4ad45f
fix checkstyle
rahul2393 49a3b0d
incorporate review comments
rahul2393 339c232
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] 99cad71
refactoring
rahul2393 abb9713
remove role check & exceptions
rahul2393 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
85 changes: 85 additions & 0 deletions
85
samples/snippets/src/main/java/com/example/spanner/AddAndDropDatabaseRole.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| /* | ||
| * Copyright 2022 Google Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.example.spanner; | ||
|
|
||
| // [START spanner_add_and_drop_database_role] | ||
| import com.google.api.gax.longrunning.OperationFuture; | ||
| import com.google.cloud.spanner.DatabaseAdminClient; | ||
| import com.google.cloud.spanner.Spanner; | ||
| import com.google.cloud.spanner.SpannerOptions; | ||
| import com.google.common.collect.ImmutableList; | ||
| import com.google.spanner.admin.database.v1.UpdateDatabaseDdlMetadata; | ||
| import java.util.concurrent.ExecutionException; | ||
| import java.util.concurrent.TimeUnit; | ||
| import java.util.concurrent.TimeoutException; | ||
|
|
||
| public class AddAndDropDatabaseRole { | ||
|
|
||
| static void addAndDropDatabaseRole() { | ||
| // TODO(developer): Replace these variables before running the sample. | ||
| String projectId = "my-project"; | ||
| String instanceId = "my-instance"; | ||
| String databaseId = "my-database"; | ||
| String parentRole = "new-parent"; | ||
| String childRole = "new-child"; | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| addAndDropDatabaseRole(projectId, instanceId, databaseId, parentRole, childRole); | ||
| } | ||
|
|
||
| static void addAndDropDatabaseRole( | ||
| String projectId, String instanceId, String databaseId, String parentRole, String childRole) { | ||
| try (Spanner spanner = | ||
| SpannerOptions.newBuilder().setProjectId(projectId).build().getService()) { | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| final DatabaseAdminClient adminClient = spanner.getDatabaseAdminClient(); | ||
| OperationFuture<Void, UpdateDatabaseDdlMetadata> operation = | ||
| adminClient.updateDatabaseDdl( | ||
| instanceId, | ||
| databaseId, | ||
| ImmutableList.of( | ||
| "CREATE ROLE " + parentRole, | ||
| "GRANT SELECT ON TABLE Albums TO ROLE " + parentRole, | ||
| "CREATE ROLE " + childRole, | ||
| "GRANT ROLE " + parentRole + " TO ROLE " + childRole), | ||
| null); | ||
| try { | ||
| System.out.println("Waiting for role create operation to complete..."); | ||
| operation.get(5, TimeUnit.MINUTES); | ||
| System.out.printf( | ||
| "Created roles %s and %s and granted privileges%n", parentRole, childRole); | ||
| // Delete role and membership. | ||
| operation = | ||
| adminClient.updateDatabaseDdl( | ||
| instanceId, | ||
| databaseId, | ||
| ImmutableList.of( | ||
| "REVOKE ROLE " + parentRole + " FROM ROLE " + childRole, | ||
| "DROP ROLE " + childRole), | ||
| null); | ||
| System.out.println("Waiting for role revoke & drop operation to complete..."); | ||
| operation.get(5, TimeUnit.MINUTES); | ||
| System.out.printf("Revoked privileges and dropped role %s%n", childRole); | ||
| } catch (ExecutionException | TimeoutException e) { | ||
| System.out.printf( | ||
| "Error: AddAndDropDatabaseRole failed with error message %s\n", e.getMessage()); | ||
| e.printStackTrace(); | ||
| } catch (InterruptedException e) { | ||
| System.out.println( | ||
| "Error: Waiting for AddAndDropDatabaseRole operation to finish was interrupted"); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| // [END spanner_add_and_drop_database_role] | ||
101 changes: 101 additions & 0 deletions
101
samples/snippets/src/main/java/com/example/spanner/EnableFineGrainedAccess.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| /* | ||
| * Copyright 2022 Google Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.example.spanner; | ||
|
|
||
| // [START spanner_enable_fine_grained_access] | ||
| import com.google.cloud.Binding; | ||
| import com.google.cloud.Condition; | ||
| import com.google.cloud.Policy; | ||
| import com.google.cloud.spanner.DatabaseAdminClient; | ||
| import com.google.cloud.spanner.Spanner; | ||
| import com.google.cloud.spanner.SpannerOptions; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| public class EnableFineGrainedAccess { | ||
|
|
||
| static void enableFineGrainedAccess() { | ||
| // TODO(developer): Replace these variables before running the sample. | ||
| String projectId = "my-project"; | ||
| String instanceId = "my-instance"; | ||
| String databaseId = "my-database"; | ||
| String iamMember = "user:[email protected]"; | ||
| String role = "new-parent"; | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| String title = "my condition title"; | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| enableFineGrainedAccess(projectId, instanceId, databaseId, iamMember, title, role); | ||
| } | ||
|
|
||
| static void enableFineGrainedAccess( | ||
| String projectId, | ||
| String instanceId, | ||
| String databaseId, | ||
| String iamMember, | ||
| String title, | ||
| String role) { | ||
| try (Spanner spanner = | ||
| SpannerOptions.newBuilder().setProjectId(projectId).build().getService()) { | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| final DatabaseAdminClient adminClient = spanner.getDatabaseAdminClient(); | ||
| Policy policy = adminClient.getDatabaseIAMPolicy(instanceId, databaseId, 3); | ||
| int policyVersion = policy.getVersion(); | ||
| /* getDatabaseIAMPolicy returns the IAM policy for the given database | ||
| * | ||
| * The policy in the response might use the policy version that you specified, or it might use | ||
| * a lower policy version. For example, if you specify version 3, but the policy has no | ||
| * conditional role bindings, the response uses version 1. Valid values are 0, 1, and 3. | ||
| * | ||
| */ | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| if (policy.getVersion() < 3) { | ||
| // conditional role bindings work with policy version 3 | ||
| policyVersion = 3; | ||
| } | ||
| List<String> members = new ArrayList<>(); | ||
rahul2393 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| members.add(iamMember); | ||
| List<Binding> bindings = new ArrayList<>(policy.getBindingsList()); | ||
rajatbhatta marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| bindings.add( | ||
| Binding.newBuilder() | ||
| .setRole("roles/spanner.fineGrainedAccessUser") | ||
| .setMembers(members) | ||
| .build()); | ||
|
|
||
| bindings.add( | ||
| Binding.newBuilder() | ||
| .setRole("roles/spanner.databaseRoleUser") | ||
| .setCondition( | ||
| Condition.newBuilder() | ||
| .setDescription(title) | ||
| .setExpression( | ||
| String.format("resource.name.endsWith(\"/databaseRoles/%s\")", role)) | ||
| .setTitle(title) | ||
| .build()) | ||
| .setMembers(members) | ||
| .build()); | ||
|
|
||
| Policy policyWithConditions = | ||
| Policy.newBuilder() | ||
| .setVersion(policyVersion) | ||
| .setEtag(policy.getEtag()) | ||
| .setBindings(bindings) | ||
| .build(); | ||
| Policy response = | ||
| adminClient.setDatabaseIAMPolicy(instanceId, databaseId, policyWithConditions); | ||
| System.out.printf( | ||
| "Enabled fine-grained access in IAM with version %d%n", response.getVersion()); | ||
| } | ||
| } | ||
| } | ||
| // [END spanner_enable_fine_grained_access] | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.