google-api-client 0.31.0 → 0.32.0

data/generated/google/apis/cloudkms_v1.rb

@@ -26,7 +26,7 @@ module Google
     # @see https://cloud.google.com/kms/
     module CloudkmsV1
       VERSION = 'V1'
-      REVISION = '20190824'
+      REVISION = '20190926'
 
       # View and manage your data across Google Cloud Platform services
       AUTH_CLOUD_PLATFORM = 'https://www.googleapis.com/auth/cloud-platform'

data/generated/google/apis/cloudkms_v1/classes.rb

@@ -316,7 +316,7 @@ module Google
         # @return [Google::Apis::CloudkmsV1::CryptoKeyVersion]
         attr_accessor :primary
       
-        # The immutable purpose of this CryptoKey.
+        # Immutable. The immutable purpose of this CryptoKey.
         # Corresponds to the JSON property `purpose`
         # @return [String]
         attr_accessor :purpose
@@ -501,7 +501,7 @@ module Google
       class DecryptRequest
         include Google::Apis::Core::Hashable
       
-        # Optional data that must match the data originally supplied in
+        # Optional. Optional data that must match the data originally supplied in
         # EncryptRequest.additional_authenticated_data.
         # Corresponds to the JSON property `additionalAuthenticatedData`
         # NOTE: Values are automatically base64 encoded/decoded in the client library.
@@ -597,7 +597,8 @@ module Google
       class EncryptRequest
         include Google::Apis::Core::Hashable
       
-        # Optional data that, if specified, must also be provided during decryption
+        # Optional. Optional data that, if specified, must also be provided during
+        # decryption
         # through DecryptRequest.additional_authenticated_data.
         # The maximum size depends on the key version's
         # protection_level. For
@@ -739,6 +740,10 @@ module Google
         # using AES-KWP (RFC 5649).
         # </li>
         # </ol>
+        # If importing symmetric key material, it is expected that the unwrapped
+        # key contains plain bytes. If importing asymmetric key material, it is
+        # expected that the unwrapped key is in PKCS#8-encoded DER format (the
+        # PrivateKeyInfo structure from RFC 5208).
         # This format is the same as the format produced by PKCS#11 mechanism
         # CKM_RSA_AES_KEY_WRAP.
         # Corresponds to the JSON property `rsaAesWrappedKey`
@@ -813,8 +818,7 @@ module Google
         # @return [String]
         attr_accessor :generate_time
       
-        # Required and immutable. The wrapping method to be used for incoming
-        # key material.
+        # Required. Immutable. The wrapping method to be used for incoming key material.
         # Corresponds to the JSON property `importMethod`
         # @return [String]
         attr_accessor :import_method
@@ -825,8 +829,8 @@ module Google
         # @return [String]
         attr_accessor :name
       
-        # Required and immutable. The protection level of the ImportJob. This
-        # must match the
+        # Required. Immutable. The protection level of the ImportJob. This must match
+        # the
         # protection_level of the
         # version_template on the CryptoKey you
         # attempt to import into.
@@ -1146,25 +1150,34 @@ module Google
       
       # Defines an Identity and Access Management (IAM) policy. It is used to
       # specify access control policies for Cloud Platform resources.
-      # A `Policy` consists of a list of `bindings`. A `binding` binds a list of
-      # `members` to a `role`, where the members can be user accounts, Google groups,
-      # Google domains, and service accounts. A `role` is a named list of permissions
-      # defined by IAM.
+      # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+      # `members` to a single `role`. Members can be user accounts, service accounts,
+      # Google groups, and domains (such as G Suite). A `role` is a named list of
+      # permissions (defined by IAM or configured by users). A `binding` can
+      # optionally specify a `condition`, which is a logic expression that further
+      # constrains the role binding based on attributes about the request and/or
+      # target resource.
       # **JSON Example**
       # `
       # "bindings": [
       # `
-      # "role": "roles/owner",
+      # "role": "roles/resourcemanager.organizationAdmin",
       # "members": [
       # "user:mike@example.com",
       # "group:admins@example.com",
       # "domain:google.com",
-      # "serviceAccount:my-other-app@appspot.gserviceaccount.com"
+      # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
       # ]
       # `,
       # `
-      # "role": "roles/viewer",
-      # "members": ["user:sean@example.com"]
+      # "role": "roles/resourcemanager.organizationViewer",
+      # "members": ["user:eve@example.com"],
+      # "condition": `
+      # "title": "expirable access",
+      # "description": "Does not grant access after Sep 2020",
+      # "expression": "request.time <
+      # timestamp('2020-10-01T00:00:00.000Z')",
+      # `
       # `
       # ]
       # `
@@ -1174,11 +1187,15 @@ module Google
       # - user:mike@example.com
       # - group:admins@example.com
       # - domain:google.com
-      # - serviceAccount:my-other-app@appspot.gserviceaccount.com
-      # role: roles/owner
+      # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+      # role: roles/resourcemanager.organizationAdmin
       # - members:
-      # - user:sean@example.com
-      # role: roles/viewer
+      # - user:eve@example.com
+      # role: roles/resourcemanager.organizationViewer
+      # condition:
+      # title: expirable access
+      # description: Does not grant access after Sep 2020
+      # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
       # For a description of IAM and its features, see the
       # [IAM developer's guide](https://cloud.google.com/iam/docs).
       class Policy
@@ -1189,7 +1206,8 @@ module Google
         # @return [Array<Google::Apis::CloudkmsV1::AuditConfig>]
         attr_accessor :audit_configs
       
-        # Associates a list of `members` to a `role`.
+        # Associates a list of `members` to a `role`. Optionally may specify a
+        # `condition` that determines when binding is in effect.
         # `bindings` with no members will result in an error.
         # Corresponds to the JSON property `bindings`
         # @return [Array<Google::Apis::CloudkmsV1::Binding>]
@@ -1203,13 +1221,24 @@ module Google
         # systems are expected to put that etag in the request to `setIamPolicy` to
         # ensure that their change will be applied to the same version of the policy.
         # If no `etag` is provided in the call to `setIamPolicy`, then the existing
-        # policy is overwritten.
+        # policy is overwritten. Due to blind-set semantics of an etag-less policy,
+        # 'setIamPolicy' will not fail even if either of incoming or stored policy
+        # does not meet the version requirements.
         # Corresponds to the JSON property `etag`
         # NOTE: Values are automatically base64 encoded/decoded in the client library.
         # @return [String]
         attr_accessor :etag
       
-        # Deprecated.
+        # Specifies the format of the policy.
+        # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
+        # rejected.
+        # Operations affecting conditional bindings must specify version 3. This can
+        # be either setting a conditional policy, modifying a conditional binding,
+        # or removing a conditional binding from the stored conditional policy.
+        # Operations on non-conditional policies may specify any valid value or
+        # leave the field unset.
+        # If no etag is provided in the call to `setIamPolicy`, any version
+        # compliance checks on the incoming and/or stored policy is skipped.
         # Corresponds to the JSON property `version`
         # @return [Fixnum]
         attr_accessor :version
@@ -1277,25 +1306,34 @@ module Google
       
         # Defines an Identity and Access Management (IAM) policy. It is used to
         # specify access control policies for Cloud Platform resources.
-        # A `Policy` consists of a list of `bindings`. A `binding` binds a list of
-        # `members` to a `role`, where the members can be user accounts, Google groups,
-        # Google domains, and service accounts. A `role` is a named list of permissions
-        # defined by IAM.
+        # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+        # `members` to a single `role`. Members can be user accounts, service accounts,
+        # Google groups, and domains (such as G Suite). A `role` is a named list of
+        # permissions (defined by IAM or configured by users). A `binding` can
+        # optionally specify a `condition`, which is a logic expression that further
+        # constrains the role binding based on attributes about the request and/or
+        # target resource.
         # **JSON Example**
         # `
         # "bindings": [
         # `
-        # "role": "roles/owner",
+        # "role": "roles/resourcemanager.organizationAdmin",
         # "members": [
         # "user:mike@example.com",
         # "group:admins@example.com",
         # "domain:google.com",
-        # "serviceAccount:my-other-app@appspot.gserviceaccount.com"
+        # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
         # ]
         # `,
         # `
-        # "role": "roles/viewer",
-        # "members": ["user:sean@example.com"]
+        # "role": "roles/resourcemanager.organizationViewer",
+        # "members": ["user:eve@example.com"],
+        # "condition": `
+        # "title": "expirable access",
+        # "description": "Does not grant access after Sep 2020",
+        # "expression": "request.time <
+        # timestamp('2020-10-01T00:00:00.000Z')",
+        # `
         # `
         # ]
         # `
@@ -1305,11 +1343,15 @@ module Google
         # - user:mike@example.com
         # - group:admins@example.com
         # - domain:google.com
-        # - serviceAccount:my-other-app@appspot.gserviceaccount.com
-        # role: roles/owner
+        # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+        # role: roles/resourcemanager.organizationAdmin
         # - members:
-        # - user:sean@example.com
-        # role: roles/viewer
+        # - user:eve@example.com
+        # role: roles/resourcemanager.organizationViewer
+        # condition:
+        # title: expirable access
+        # description: Does not grant access after Sep 2020
+        # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
         # For a description of IAM and its features, see the
         # [IAM developer's guide](https://cloud.google.com/iam/docs).
         # Corresponds to the JSON property `policy`
@@ -1382,7 +1424,7 @@ module Google
       class UpdateCryptoKeyPrimaryVersionRequest
         include Google::Apis::Core::Hashable
       
-        # The id of the child CryptoKeyVersion to use as primary.
+        # Required. The id of the child CryptoKeyVersion to use as primary.
         # Corresponds to the JSON property `cryptoKeyVersionId`
         # @return [String]
         attr_accessor :crypto_key_version_id

data/generated/google/apis/cloudkms_v1/service.rb

@@ -157,7 +157,7 @@ module Google
         
         # Returns metadata for a given KeyRing.
         # @param [String] name
-        #   The name of the KeyRing to get.
+        #   Required. The name of the KeyRing to get.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -193,9 +193,11 @@ module Google
         #   See the operation documentation for the appropriate value for this field.
         # @param [Fixnum] options_requested_policy_version
         #   Optional. The policy format version to be returned.
-        #   Acceptable values are 0, 1, and 3.
-        #   If the value is 0, or the field is omitted, policy format version 1 will be
-        #   returned.
+        #   Valid values are 0, 1, and 3. Requests specifying an invalid value will be
+        #   rejected.
+        #   Requests for policies with any conditional bindings must specify version 3.
+        #   Policies without any conditional bindings may specify any valid value or
+        #   leave the field unset.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -239,12 +241,12 @@ module Google
         #   [Sorting and filtering list
         #   results](https://cloud.google.com/kms/docs/sorting-and-filtering).
         # @param [Fixnum] page_size
-        #   Optional limit on the number of KeyRings to include in the
+        #   Optional. Optional limit on the number of KeyRings to include in the
         #   response.  Further KeyRings can subsequently be obtained by
         #   including the ListKeyRingsResponse.next_page_token in a subsequent
         #   request.  If unspecified, the server will pick an appropriate default.
         # @param [String] page_token
-        #   Optional pagination token, returned earlier via
+        #   Optional. Optional pagination token, returned earlier via
         #   ListKeyRingsResponse.next_page_token.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
@@ -475,7 +477,7 @@ module Google
         # Returns metadata for a given CryptoKey, as well as its
         # primary CryptoKeyVersion.
         # @param [String] name
-        #   The name of the CryptoKey to get.
+        #   Required. The name of the CryptoKey to get.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -511,9 +513,11 @@ module Google
         #   See the operation documentation for the appropriate value for this field.
         # @param [Fixnum] options_requested_policy_version
         #   Optional. The policy format version to be returned.
-        #   Acceptable values are 0, 1, and 3.
-        #   If the value is 0, or the field is omitted, policy format version 1 will be
-        #   returned.
+        #   Valid values are 0, 1, and 3. Requests specifying an invalid value will be
+        #   rejected.
+        #   Requests for policies with any conditional bindings must specify version 3.
+        #   Policies without any conditional bindings may specify any valid value or
+        #   leave the field unset.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -557,12 +561,12 @@ module Google
         #   [Sorting and filtering list
         #   results](https://cloud.google.com/kms/docs/sorting-and-filtering).
         # @param [Fixnum] page_size
-        #   Optional limit on the number of CryptoKeys to include in the
+        #   Optional. Optional limit on the number of CryptoKeys to include in the
         #   response.  Further CryptoKeys can subsequently be obtained by
         #   including the ListCryptoKeysResponse.next_page_token in a subsequent
         #   request.  If unspecified, the server will pick an appropriate default.
         # @param [String] page_token
-        #   Optional pagination token, returned earlier via
+        #   Optional. Optional pagination token, returned earlier via
         #   ListCryptoKeysResponse.next_page_token.
         # @param [String] version_view
         #   The fields of the primary version to include in the response.
@@ -604,7 +608,7 @@ module Google
         #   `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
         # @param [Google::Apis::CloudkmsV1::CryptoKey] crypto_key_object
         # @param [String] update_mask
-        #   Required list of fields to be updated in this request.
+        #   Required. List of fields to be updated in this request.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -712,7 +716,7 @@ module Google
         # Update the version of a CryptoKey that will be used in Encrypt.
         # Returns an error if called on an asymmetric key.
         # @param [String] name
-        #   The resource name of the CryptoKey to update.
+        #   Required. The resource name of the CryptoKey to update.
         # @param [Google::Apis::CloudkmsV1::UpdateCryptoKeyPrimaryVersionRequest] update_crypto_key_primary_version_request_object
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
@@ -862,7 +866,7 @@ module Google
         # Before the destroy_time is reached,
         # RestoreCryptoKeyVersion may be called to reverse the process.
         # @param [String] name
-        #   The resource name of the CryptoKeyVersion to destroy.
+        #   Required. The resource name of the CryptoKeyVersion to destroy.
         # @param [Google::Apis::CloudkmsV1::DestroyCryptoKeyVersionRequest] destroy_crypto_key_version_request_object
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
@@ -895,7 +899,7 @@ module Google
         
         # Returns metadata for a given CryptoKeyVersion.
         # @param [String] name
-        #   The name of the CryptoKeyVersion to get.
+        #   Required. The name of the CryptoKeyVersion to get.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -928,7 +932,7 @@ module Google
         # ASYMMETRIC_SIGN or
         # ASYMMETRIC_DECRYPT.
         # @param [String] name
-        #   The name of the CryptoKeyVersion public key to
+        #   Required. The name of the CryptoKeyVersion public key to
         #   get.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
@@ -1009,13 +1013,13 @@ module Google
         #   [Sorting and filtering list
         #   results](https://cloud.google.com/kms/docs/sorting-and-filtering).
         # @param [Fixnum] page_size
-        #   Optional limit on the number of CryptoKeyVersions to
+        #   Optional. Optional limit on the number of CryptoKeyVersions to
         #   include in the response. Further CryptoKeyVersions can
         #   subsequently be obtained by including the
         #   ListCryptoKeyVersionsResponse.next_page_token in a subsequent request.
         #   If unspecified, the server will pick an appropriate default.
         # @param [String] page_token
-        #   Optional pagination token, returned earlier via
+        #   Optional. Optional pagination token, returned earlier via
         #   ListCryptoKeyVersionsResponse.next_page_token.
         # @param [String] view
         #   The fields to include in the response.
@@ -1062,7 +1066,7 @@ module Google
         #   `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
         # @param [Google::Apis::CloudkmsV1::CryptoKeyVersion] crypto_key_version_object
         # @param [String] update_mask
-        #   Required list of fields to be updated in this request.
+        #   Required. List of fields to be updated in this request.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -1100,7 +1104,7 @@ module Google
         # will be set to DISABLED,
         # and destroy_time will be cleared.
         # @param [String] name
-        #   The resource name of the CryptoKeyVersion to restore.
+        #   Required. The resource name of the CryptoKeyVersion to restore.
         # @param [Google::Apis::CloudkmsV1::RestoreCryptoKeyVersionRequest] restore_crypto_key_version_request_object
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
@@ -1172,7 +1176,7 @@ module Google
         
         # Returns metadata for a given ImportJob.
         # @param [String] name
-        #   The name of the ImportJob to get.
+        #   Required. The name of the ImportJob to get.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -1208,9 +1212,11 @@ module Google
         #   See the operation documentation for the appropriate value for this field.
         # @param [Fixnum] options_requested_policy_version
         #   Optional. The policy format version to be returned.
-        #   Acceptable values are 0, 1, and 3.
-        #   If the value is 0, or the field is omitted, policy format version 1 will be
-        #   returned.
+        #   Valid values are 0, 1, and 3. Requests specifying an invalid value will be
+        #   rejected.
+        #   Requests for policies with any conditional bindings must specify version 3.
+        #   Policies without any conditional bindings may specify any valid value or
+        #   leave the field unset.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -1254,12 +1260,12 @@ module Google
         #   [Sorting and filtering list
         #   results](https://cloud.google.com/kms/docs/sorting-and-filtering).
         # @param [Fixnum] page_size
-        #   Optional limit on the number of ImportJobs to include in the
+        #   Optional. Optional limit on the number of ImportJobs to include in the
         #   response. Further ImportJobs can subsequently be obtained by
         #   including the ListImportJobsResponse.next_page_token in a subsequent
         #   request. If unspecified, the server will pick an appropriate default.
         # @param [String] page_token
-        #   Optional pagination token, returned earlier via
+        #   Optional. Optional pagination token, returned earlier via
         #   ListImportJobsResponse.next_page_token.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.

data/generated/google/apis/cloudprivatecatalogproducer_v1beta1.rb

@@ -26,7 +26,7 @@ module Google
     # @see https://cloud.google.com/private-catalog/
     module CloudprivatecatalogproducerV1beta1
       VERSION = 'V1beta1'
-      REVISION = '20190907'
+      REVISION = '20190921'
 
       # View and manage your data across Google Cloud Platform services
       AUTH_CLOUD_PLATFORM = 'https://www.googleapis.com/auth/cloud-platform'

data/generated/google/apis/cloudprivatecatalogproducer_v1beta1/classes.rb

@@ -747,25 +747,34 @@ module Google
       
       # Defines an Identity and Access Management (IAM) policy. It is used to
       # specify access control policies for Cloud Platform resources.
-      # A `Policy` consists of a list of `bindings`. A `binding` binds a list of
-      # `members` to a `role`, where the members can be user accounts, Google groups,
-      # Google domains, and service accounts. A `role` is a named list of permissions
-      # defined by IAM.
+      # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+      # `members` to a single `role`. Members can be user accounts, service accounts,
+      # Google groups, and domains (such as G Suite). A `role` is a named list of
+      # permissions (defined by IAM or configured by users). A `binding` can
+      # optionally specify a `condition`, which is a logic expression that further
+      # constrains the role binding based on attributes about the request and/or
+      # target resource.
       # **JSON Example**
       # `
       # "bindings": [
       # `
-      # "role": "roles/owner",
+      # "role": "roles/resourcemanager.organizationAdmin",
       # "members": [
       # "user:mike@example.com",
       # "group:admins@example.com",
       # "domain:google.com",
-      # "serviceAccount:my-other-app@appspot.gserviceaccount.com"
+      # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
       # ]
       # `,
       # `
-      # "role": "roles/viewer",
-      # "members": ["user:sean@example.com"]
+      # "role": "roles/resourcemanager.organizationViewer",
+      # "members": ["user:eve@example.com"],
+      # "condition": `
+      # "title": "expirable access",
+      # "description": "Does not grant access after Sep 2020",
+      # "expression": "request.time <
+      # timestamp('2020-10-01T00:00:00.000Z')",
+      # `
       # `
       # ]
       # `
@@ -775,11 +784,15 @@ module Google
       # - user:mike@example.com
       # - group:admins@example.com
       # - domain:google.com
-      # - serviceAccount:my-other-app@appspot.gserviceaccount.com
-      # role: roles/owner
+      # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+      # role: roles/resourcemanager.organizationAdmin
       # - members:
-      # - user:sean@example.com
-      # role: roles/viewer
+      # - user:eve@example.com
+      # role: roles/resourcemanager.organizationViewer
+      # condition:
+      # title: expirable access
+      # description: Does not grant access after Sep 2020
+      # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
       # For a description of IAM and its features, see the
       # [IAM developer's guide](https://cloud.google.com/iam/docs).
       class GoogleIamV1Policy
@@ -790,7 +803,8 @@ module Google
         # @return [Array<Google::Apis::CloudprivatecatalogproducerV1beta1::GoogleIamV1AuditConfig>]
         attr_accessor :audit_configs
       
-        # Associates a list of `members` to a `role`.
+        # Associates a list of `members` to a `role`. Optionally may specify a
+        # `condition` that determines when binding is in effect.
         # `bindings` with no members will result in an error.
         # Corresponds to the JSON property `bindings`
         # @return [Array<Google::Apis::CloudprivatecatalogproducerV1beta1::GoogleIamV1Binding>]
@@ -804,7 +818,9 @@ module Google
         # systems are expected to put that etag in the request to `setIamPolicy` to
         # ensure that their change will be applied to the same version of the policy.
         # If no `etag` is provided in the call to `setIamPolicy`, then the existing
-        # policy is overwritten.
+        # policy is overwritten. Due to blind-set semantics of an etag-less policy,
+        # 'setIamPolicy' will not fail even if either of incoming or stored policy
+        # does not meet the version requirements.
         # Corresponds to the JSON property `etag`
         # NOTE: Values are automatically base64 encoded/decoded in the client library.
         # @return [String]
@@ -813,9 +829,13 @@ module Google
         # Specifies the format of the policy.
         # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
         # rejected.
-        # Policies with any conditional bindings must specify version 3. Policies
-        # without any conditional bindings may specify any valid value or leave the
-        # field unset.
+        # Operations affecting conditional bindings must specify version 3. This can
+        # be either setting a conditional policy, modifying a conditional binding,
+        # or removing a conditional binding from the stored conditional policy.
+        # Operations on non-conditional policies may specify any valid value or
+        # leave the field unset.
+        # If no etag is provided in the call to `setIamPolicy`, any version
+        # compliance checks on the incoming and/or stored policy is skipped.
         # Corresponds to the JSON property `version`
         # @return [Fixnum]
         attr_accessor :version
@@ -839,25 +859,34 @@ module Google
       
         # Defines an Identity and Access Management (IAM) policy. It is used to
         # specify access control policies for Cloud Platform resources.
-        # A `Policy` consists of a list of `bindings`. A `binding` binds a list of
-        # `members` to a `role`, where the members can be user accounts, Google groups,
-        # Google domains, and service accounts. A `role` is a named list of permissions
-        # defined by IAM.
+        # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+        # `members` to a single `role`. Members can be user accounts, service accounts,
+        # Google groups, and domains (such as G Suite). A `role` is a named list of
+        # permissions (defined by IAM or configured by users). A `binding` can
+        # optionally specify a `condition`, which is a logic expression that further
+        # constrains the role binding based on attributes about the request and/or
+        # target resource.
         # **JSON Example**
         # `
         # "bindings": [
         # `
-        # "role": "roles/owner",
+        # "role": "roles/resourcemanager.organizationAdmin",
         # "members": [
         # "user:mike@example.com",
         # "group:admins@example.com",
         # "domain:google.com",
-        # "serviceAccount:my-other-app@appspot.gserviceaccount.com"
+        # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
         # ]
         # `,
         # `
-        # "role": "roles/viewer",
-        # "members": ["user:sean@example.com"]
+        # "role": "roles/resourcemanager.organizationViewer",
+        # "members": ["user:eve@example.com"],
+        # "condition": `
+        # "title": "expirable access",
+        # "description": "Does not grant access after Sep 2020",
+        # "expression": "request.time <
+        # timestamp('2020-10-01T00:00:00.000Z')",
+        # `
         # `
         # ]
         # `
@@ -867,11 +896,15 @@ module Google
         # - user:mike@example.com
         # - group:admins@example.com
         # - domain:google.com
-        # - serviceAccount:my-other-app@appspot.gserviceaccount.com
-        # role: roles/owner
+        # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+        # role: roles/resourcemanager.organizationAdmin
         # - members:
-        # - user:sean@example.com
-        # role: roles/viewer
+        # - user:eve@example.com
+        # role: roles/resourcemanager.organizationViewer
+        # condition:
+        # title: expirable access
+        # description: Does not grant access after Sep 2020
+        # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
         # For a description of IAM and its features, see the
         # [IAM developer's guide](https://cloud.google.com/iam/docs).
         # Corresponds to the JSON property `policy`