google-apis-iam_v1 0.60.0 → 0.62.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ce7696f487b577d098a11b1ee58da736f7509aaa76cf1230a4e5afb6e254033
-  data.tar.gz: 1f1bf447e54e47f0fc48b3d5e2b4e551621e40699b9abf3e8a2bf3ac73ad5a74
+  metadata.gz: 483c848def6aa7b9d449918df38a05b46c2be902675df35291b57da6404224b6
+  data.tar.gz: 00211f6630169d8dc64c828b186990bee4b6edbf526d35a80c30cd3dbd73a825
 SHA512:
-  metadata.gz: 0be6783c3b148a2d425fef6e358bde1b41c3c59b17c392c978fa677d16cd2c8aa6def8e25b903d33ca7d4697ebe2029a2cfe6f3f00e413cc5fae3fc58d73b811
-  data.tar.gz: dbf8390439c27a89e83e434585ff37c4aa62c007702a113cd64f0dac52a5585ed6724ddd9122fb7a5020ae2cc8ad964e6a3685c28e30ccca02d9f5b80aa909c2
+  metadata.gz: ad8e7a4afab6c5cc4ca502dfc45d0f171d52afceca989320fc0ac82c01ec20ce91221be72e3be6d47fe8f4e6c647d1dda5072599c7301b7fd64e89d52f44d7f1
+  data.tar.gz: 97baa8e19bce026809fd8947cfe71e0fc4ec4c09d5bef75ad5571e900fadbbc33375eec99d1a8bb1e9bd4339438366ec3728a2bf95f8ae741910791a97028907

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Release history for google-apis-iam_v1
 
+### v0.62.0 (2024-12-02)
+
+* Regenerated from discovery document revision 20241114
+* Regenerated using generator version 0.15.1
+
+### v0.61.0 (2024-07-25)
+
+* Regenerated from discovery document revision 20240722
+
 ### v0.60.0 (2024-06-23)
 
 * Regenerated from discovery document revision 20240617

data/lib/google/apis/iam_v1/classes.rb

@@ -752,13 +752,13 @@ module Google
         # @return [String]
         attr_accessor :issuer_uri
       
-        # OIDC JWKs in JSON String format. For details on the definition of a JWK, see
-        # https://tools.ietf.org/html/rfc7517. If not set, the `jwks_uri` from the
-        # discovery document(fetched from the .well-known path of the `issuer_uri`) will
-        # be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use
-        # following format and include only the following fields: ` "keys": [ ` "kty": "
-        # RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "", "y": ""
-        # , "crv": "" ` ] `
+        # Optional. OIDC JWKs in JSON String format. For details on the definition of a
+        # JWK, see https://tools.ietf.org/html/rfc7517. If not set, the `jwks_uri` from
+        # the discovery document(fetched from the .well-known path of the `issuer_uri`)
+        # will be used. Currently, RSA and EC asymmetric keys are supported. The JWK
+        # must use following format and include only the following fields: ` "keys": [ `
+        # "kty": "RSA/EC", "alg": "", "use": "sig", "kid": "", "n": "", "e": "", "x": "",
+        # "y": "", "crv": "" ` ] `
         # Corresponds to the JSON property `jwksJson`
         # @return [String]
         attr_accessor :jwks_json
@@ -805,8 +805,9 @@ module Google
       class GoogleIamAdminV1WorkforcePoolProviderOidcClientSecretValue
         include Google::Apis::Core::Hashable
       
-        # Input only. The plain text of the client secret value. For security reasons,
-        # this field is only used for input and will never be populated in any response.
+        # Optional. Input only. The plain text of the client secret value. For security
+        # reasons, this field is only used for input and will never be populated in any
+        # response.
         # Corresponds to the JSON property `plainText`
         # @return [String]
         attr_accessor :plain_text
@@ -831,9 +832,9 @@ module Google
       class GoogleIamAdminV1WorkforcePoolProviderOidcWebSsoConfig
         include Google::Apis::Core::Hashable
       
-        # Additional scopes to request for in the OIDC authentication request on top of
-        # scopes requested by default. By default, the `openid`, `profile` and `email`
-        # scopes that are supported by the identity provider are requested. Each
+        # Optional. Additional scopes to request for in the OIDC authentication request
+        # on top of scopes requested by default. By default, the `openid`, `profile` and
+        # `email` scopes that are supported by the identity provider are requested. Each
         # additional scope may be at most 256 characters. A maximum of 10 additional
         # scopes may be configured.
         # Corresponds to the JSON property `additionalScopes`
@@ -1396,8 +1397,8 @@ module Google
         # @return [String]
         attr_accessor :expire_time
       
-        # Immutable. The resource name of the OauthClient. Format:`projects/`project`/
-        # locations/`location`/oauthClients/`oauth_client``.
+        # Immutable. Identifier. The resource name of the OauthClient. Format:`projects/`
+        # project`/locations/`location`/oauthClients/`oauth_client``.
         # Corresponds to the JSON property `name`
         # @return [String]
         attr_accessor :name
@@ -1455,9 +1456,9 @@ module Google
         # @return [String]
         attr_accessor :display_name
       
-        # Immutable. The resource name of the OauthClientCredential. Format: `projects/`
-        # project`/locations/`location`/oauthClients/`oauth_client`/credentials/`
-        # credential``
+        # Immutable. Identifier. The resource name of the OauthClientCredential. Format:
+        # `projects/`project`/locations/`location`/oauthClients/`oauth_client`/
+        # credentials/`credential``
         # Corresponds to the JSON property `name`
         # @return [String]
         attr_accessor :name
@@ -1479,11 +1480,11 @@ module Google
       class Oidc
         include Google::Apis::Core::Hashable
       
-        # Acceptable values for the `aud` field (audience) in the OIDC token. Token
-        # exchange requests are rejected if the token audience does not match one of the
-        # configured values. Each audience may be at most 256 characters. A maximum of
-        # 10 audiences may be configured. If this list is empty, the OIDC token audience
-        # must be equal to the full canonical resource name of the
+        # Optional. Acceptable values for the `aud` field (audience) in the OIDC token.
+        # Token exchange requests are rejected if the token audience does not match one
+        # of the configured values. Each audience may be at most 256 characters. A
+        # maximum of 10 audiences may be configured. If this list is empty, the OIDC
+        # token audience must be equal to the full canonical resource name of the
         # WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``
         # ` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/
         # https://iam.googleapis.com/projects//locations//workloadIdentityPools//
@@ -1592,9 +1593,9 @@ module Google
         attr_accessor :api_version
       
         # Output only. Identifies whether the user has requested cancellation of the
-        # operation. Operations that have been cancelled successfully have Operation.
-        # error value with a google.rpc.Status.code of 1, corresponding to `Code.
-        # CANCELLED`.
+        # operation. Operations that have been cancelled successfully have google.
+        # longrunning.Operation.error value with a google.rpc.Status.code of `1`,
+        # corresponding to `Code.CANCELLED`.
         # Corresponds to the JSON property `cancelRequested`
         # @return [Boolean]
         attr_accessor :cancel_requested
@@ -1641,46 +1642,6 @@ module Google
         end
       end
       
-      # The service account key patch request.
-      class PatchServiceAccountKeyRequest
-        include Google::Apis::Core::Hashable
-      
-        # Represents a service account key. A service account has two sets of key-pairs:
-        # user-managed, and system-managed. User-managed key-pairs can be created and
-        # deleted by users. Users are responsible for rotating these keys periodically
-        # to ensure security of their service accounts. Users retain the private key of
-        # these key-pairs, and Google retains ONLY the public key. System-managed keys
-        # are automatically rotated by Google, and are used for signing for a maximum of
-        # two weeks. The rotation process is probabilistic, and usage of the new key
-        # will gradually ramp up and down over the key's lifetime. If you cache the
-        # public key set for a service account, we recommend that you update the cache
-        # every 15 minutes. User-managed keys can be added and removed at any time, so
-        # it is important to update the cache frequently. For Google-managed keys,
-        # Google will publish a key at least 6 hours before it is first used for signing
-        # and will keep publishing it for at least 6 hours after it was last used for
-        # signing. Public keys for all service accounts are also published at the OAuth2
-        # Service Account API.
-        # Corresponds to the JSON property `serviceAccountKey`
-        # @return [Google::Apis::IamV1::ServiceAccountKey]
-        attr_accessor :service_account_key
-      
-        # Required. The update mask to apply to the service account key. Only the
-        # following fields are eligible for patching: - contact - description
-        # Corresponds to the JSON property `updateMask`
-        # @return [String]
-        attr_accessor :update_mask
-      
-        def initialize(**args)
-           update!(**args)
-        end
-      
-        # Update properties of this object
-        def update!(**args)
-          @service_account_key = args[:service_account_key] if args.key?(:service_account_key)
-          @update_mask = args[:update_mask] if args.key?(:update_mask)
-        end
-      end
-      
       # The service account patch request. You can patch only the `display_name` and `
       # description` fields. You must use the `update_mask` field to specify which of
       # these fields you want to patch. Only the fields specified in the request are
@@ -1731,8 +1692,7 @@ module Google
         # @return [String]
         attr_accessor :custom_roles_support_level
       
-        # A brief description of what this Permission is used for. This permission can
-        # ONLY be used in predefined roles.
+        # A brief description of what this Permission is used for.
         # Corresponds to the JSON property `description`
         # @return [String]
         attr_accessor :description
@@ -1975,7 +1935,7 @@ module Google
         attr_accessor :full_resource_name
       
         # Optional limit on the number of roles to include in the response. The default
-        # is 300, and the maximum is 1,000.
+        # is 300, and the maximum is 2,000.
         # Corresponds to the JSON property `pageSize`
         # @return [Fixnum]
         attr_accessor :page_size
@@ -2321,23 +2281,6 @@ module Google
       class ServiceAccountKey
         include Google::Apis::Core::Hashable
       
-        # Optional. A user provided email address as the point of contact for this
-        # service account key. Must be an email address. Limit 64 characters.
-        # Corresponds to the JSON property `contact`
-        # @return [String]
-        attr_accessor :contact
-      
-        # Output only. The cloud identity that created this service account key.
-        # Populated automatically when the key is created and not editable by the user.
-        # Corresponds to the JSON property `creator`
-        # @return [String]
-        attr_accessor :creator
-      
-        # Optional. A user provided description of this service account key.
-        # Corresponds to the JSON property `description`
-        # @return [String]
-        attr_accessor :description
-      
         # Output only. optional. If the key is disabled, it may have a DisableReason
         # describing why it was disabled.
         # Corresponds to the JSON property `disableReason`
@@ -2421,9 +2364,6 @@ module Google
       
         # Update properties of this object
         def update!(**args)
-          @contact = args[:contact] if args.key?(:contact)
-          @creator = args[:creator] if args.key?(:creator)
-          @description = args[:description] if args.key?(:description)
           @disable_reason = args[:disable_reason] if args.key?(:disable_reason)
           @disabled = args[:disabled] if args.key?(:disabled)
           @extended_status = args[:extended_status] if args.key?(:extended_status)
@@ -2890,21 +2830,22 @@ module Google
         # @return [Google::Apis::IamV1::AccessRestrictions]
         attr_accessor :access_restrictions
       
-        # A user-specified description of the pool. Cannot exceed 256 characters.
+        # Optional. A user-specified description of the pool. Cannot exceed 256
+        # characters.
         # Corresponds to the JSON property `description`
         # @return [String]
         attr_accessor :description
       
-        # Disables the workforce pool. You cannot use a disabled pool to exchange tokens,
-        # or use existing tokens to access resources. If the pool is re-enabled,
-        # existing tokens grant access again.
+        # Optional. Disables the workforce pool. You cannot use a disabled pool to
+        # exchange tokens, or use existing tokens to access resources. If the pool is re-
+        # enabled, existing tokens grant access again.
         # Corresponds to the JSON property `disabled`
         # @return [Boolean]
         attr_accessor :disabled
         alias_method :disabled?, :disabled
       
-        # A user-specified display name of the pool in Google Cloud Console. Cannot
-        # exceed 32 characters.
+        # Optional. A user-specified display name of the pool in Google Cloud Console.
+        # Cannot exceed 32 characters.
         # Corresponds to the JSON property `displayName`
         # @return [String]
         attr_accessor :display_name
@@ -2926,12 +2867,13 @@ module Google
         # @return [String]
         attr_accessor :parent
       
-        # Duration that the Google Cloud access tokens, console sign-in sessions, and `
-        # gcloud` sign-in sessions from this pool are valid. Must be greater than 15
-        # minutes (900s) and less than 12 hours (43200s). If `session_duration` is not
-        # configured, minted credentials have a default duration of one hour (3600s).
-        # For SAML providers, the lifetime of the token is the minimum of the `
-        # session_duration` and the `SessionNotOnOrAfter` claim in the SAML assertion.
+        # Optional. Duration that the Google Cloud access tokens, console sign-in
+        # sessions, and `gcloud` sign-in sessions from this pool are valid. Must be
+        # greater than 15 minutes (900s) and less than 12 hours (43200s). If `
+        # session_duration` is not configured, minted credentials have a default
+        # duration of one hour (3600s). For SAML providers, the lifetime of the token is
+        # the minimum of the `session_duration` and the `SessionNotOnOrAfter` claim in
+        # the SAML assertion.
         # Corresponds to the JSON property `sessionDuration`
         # @return [String]
         attr_accessor :session_duration
@@ -2963,20 +2905,20 @@ module Google
       class WorkforcePoolProvider
         include Google::Apis::Core::Hashable
       
-        # A [Common Expression Language](https://opensource.google/projects/cel)
-        # expression, in plain text, to restrict what otherwise valid authentication
-        # credentials issued by the provider should not be accepted. The expression must
-        # output a boolean representing whether to allow the federation. The following
-        # keywords may be referenced in the expressions: * `assertion`: JSON
-        # representing the authentication credential issued by the provider. * `google`:
-        # The Google attributes mapped from the assertion in the `attribute_mappings`. `
-        # google.profile_photo`, `google.display_name` and `google.posix_username` are
-        # not supported. * `attribute`: The custom attributes mapped from the assertion
-        # in the `attribute_mappings`. The maximum length of the attribute condition
-        # expression is 4096 characters. If unspecified, all valid authentication
-        # credentials will be accepted. The following example shows how to only allow
-        # credentials with a mapped `google.groups` value of `admins`: ``` "'admins' in
-        # google.groups" ```
+        # Optional. A [Common Expression Language](https://opensource.google/projects/
+        # cel) expression, in plain text, to restrict what otherwise valid
+        # authentication credentials issued by the provider should not be accepted. The
+        # expression must output a boolean representing whether to allow the federation.
+        # The following keywords may be referenced in the expressions: * `assertion`:
+        # JSON representing the authentication credential issued by the provider. * `
+        # google`: The Google attributes mapped from the assertion in the `
+        # attribute_mappings`. `google.profile_photo`, `google.display_name` and `google.
+        # posix_username` are not supported. * `attribute`: The custom attributes mapped
+        # from the assertion in the `attribute_mappings`. The maximum length of the
+        # attribute condition expression is 4096 characters. If unspecified, all valid
+        # authentication credentials will be accepted. The following example shows how
+        # to only allow credentials with a mapped `google.groups` value of `admins`: ```
+        # "'admins' in google.groups" ```
         # Corresponds to the JSON property `attributeCondition`
         # @return [String]
         attr_accessor :attribute_condition
@@ -3026,19 +2968,21 @@ module Google
         # @return [Hash<String,String>]
         attr_accessor :attribute_mapping
       
-        # A user-specified description of the provider. Cannot exceed 256 characters.
+        # Optional. A user-specified description of the provider. Cannot exceed 256
+        # characters.
         # Corresponds to the JSON property `description`
         # @return [String]
         attr_accessor :description
       
-        # Disables the workforce pool provider. You cannot use a disabled provider to
-        # exchange tokens. However, existing tokens still grant access.
+        # Optional. Disables the workforce pool provider. You cannot use a disabled
+        # provider to exchange tokens. However, existing tokens still grant access.
         # Corresponds to the JSON property `disabled`
         # @return [Boolean]
         attr_accessor :disabled
         alias_method :disabled?, :disabled
       
-        # A user-specified display name for the provider. Cannot exceed 32 characters.
+        # Optional. A user-specified display name for the provider. Cannot exceed 32
+        # characters.
         # Corresponds to the JSON property `displayName`
         # @return [String]
         attr_accessor :display_name
@@ -3151,20 +3095,20 @@ module Google
       class WorkloadIdentityPool
         include Google::Apis::Core::Hashable
       
-        # A description of the pool. Cannot exceed 256 characters.
+        # Optional. A description of the pool. Cannot exceed 256 characters.
         # Corresponds to the JSON property `description`
         # @return [String]
         attr_accessor :description
       
-        # Whether the pool is disabled. You cannot use a disabled pool to exchange
-        # tokens, or use existing tokens to access resources. If the pool is re-enabled,
-        # existing tokens grant access again.
+        # Optional. Whether the pool is disabled. You cannot use a disabled pool to
+        # exchange tokens, or use existing tokens to access resources. If the pool is re-
+        # enabled, existing tokens grant access again.
         # Corresponds to the JSON property `disabled`
         # @return [Boolean]
         attr_accessor :disabled
         alias_method :disabled?, :disabled
       
-        # A display name for the pool. Cannot exceed 32 characters.
+        # Optional. A display name for the pool. Cannot exceed 32 characters.
         # Corresponds to the JSON property `displayName`
         # @return [String]
         attr_accessor :display_name
@@ -3217,59 +3161,61 @@ module Google
       class WorkloadIdentityPoolProvider
         include Google::Apis::Core::Hashable
       
-        # [A Common Expression Language](https://opensource.google/projects/cel)
-        # expression, in plain text, to restrict what otherwise valid authentication
-        # credentials issued by the provider should not be accepted. The expression must
-        # output a boolean representing whether to allow the federation. The following
-        # keywords may be referenced in the expressions: * `assertion`: JSON
-        # representing the authentication credential issued by the provider. * `google`:
-        # The Google attributes mapped from the assertion in the `attribute_mappings`. *
-        # `attribute`: The custom attributes mapped from the assertion in the `
-        # attribute_mappings`. The maximum length of the attribute condition expression
-        # is 4096 characters. If unspecified, all valid authentication credential are
-        # accepted. The following example shows how to only allow credentials with a
-        # mapped `google.groups` value of `admins`: ``` "'admins' in google.groups" ```
+        # Optional. [A Common Expression Language](https://opensource.google/projects/
+        # cel) expression, in plain text, to restrict what otherwise valid
+        # authentication credentials issued by the provider should not be accepted. The
+        # expression must output a boolean representing whether to allow the federation.
+        # The following keywords may be referenced in the expressions: * `assertion`:
+        # JSON representing the authentication credential issued by the provider. * `
+        # google`: The Google attributes mapped from the assertion in the `
+        # attribute_mappings`. * `attribute`: The custom attributes mapped from the
+        # assertion in the `attribute_mappings`. The maximum length of the attribute
+        # condition expression is 4096 characters. If unspecified, all valid
+        # authentication credential are accepted. The following example shows how to
+        # only allow credentials with a mapped `google.groups` value of `admins`: ``` "'
+        # admins' in google.groups" ```
         # Corresponds to the JSON property `attributeCondition`
         # @return [String]
         attr_accessor :attribute_condition
       
-        # Maps attributes from authentication credentials issued by an external
-        # identity provider to Google Cloud attributes, such as `subject` and `segment`.
-        # Each key must be a string specifying the Google Cloud IAM attribute to map to.
-        # The following keys are supported: * `google.subject`: The principal IAM is
-        # authenticating. You can reference this value in IAM bindings. This is also the
-        # subject that appears in Cloud Logging logs. Cannot exceed 127 bytes. * `google.
-        # groups`: Groups the external identity belongs to. You can grant groups access
-        # to resources using an IAM `principalSet` binding; access applies to all
-        # members of the group. You can also provide custom attributes by specifying `
-        # attribute.`custom_attribute``, where ``custom_attribute`` is the name of the
-        # custom attribute to be mapped. You can define a maximum of 50 custom
-        # attributes. The maximum length of a mapped attribute key is 100 characters,
-        # and the key may only contain the characters [a-z0-9_]. You can reference these
-        # attributes in IAM policies to define fine-grained access for a workload to
-        # Google Cloud resources. For example: * `google.subject`: `principal://iam.
-        # googleapis.com/projects/`project`/locations/`location`/workloadIdentityPools/`
-        # pool`/subject/`value`` * `google.groups`: `principalSet://iam.googleapis.com/
-        # projects/`project`/locations/`location`/workloadIdentityPools/`pool`/group/`
-        # value`` * `attribute.`custom_attribute``: `principalSet://iam.googleapis.com/
-        # projects/`project`/locations/`location`/workloadIdentityPools/`pool`/attribute.
-        # `custom_attribute`/`value`` Each value must be a [Common Expression Language] (
-        # https://opensource.google/projects/cel) function that maps an identity
-        # provider credential to the normalized attribute specified by the corresponding
-        # map key. You can use the `assertion` keyword in the expression to access a
-        # JSON representation of the authentication credential issued by the provider.
-        # The maximum length of an attribute mapping expression is 2048 characters. When
-        # evaluated, the total size of all mapped attributes must not exceed 8KB. For
-        # AWS providers, if no attribute mapping is defined, the following default
-        # mapping applies: ``` ` "google.subject":"assertion.arn", "attribute.aws_role":
-        # "assertion.arn.contains('assumed-role')" " ? assertion.arn.extract('`
-        # account_arn`assumed-role/')" " + 'assumed-role/'" " + assertion.arn.extract('
-        # assumed-role/`role_name`/')" " : assertion.arn", ` ``` If any custom attribute
-        # mappings are defined, they must include a mapping to the `google.subject`
-        # attribute. For OIDC providers, you must supply a custom mapping, which must
-        # include the `google.subject` attribute. For example, the following maps the `
-        # sub` claim of the incoming credential to the `subject` attribute on a Google
-        # token: ``` `"google.subject": "assertion.sub"` ```
+        # Optional. Maps attributes from authentication credentials issued by an
+        # external identity provider to Google Cloud attributes, such as `subject` and `
+        # segment`. Each key must be a string specifying the Google Cloud IAM attribute
+        # to map to. The following keys are supported: * `google.subject`: The principal
+        # IAM is authenticating. You can reference this value in IAM bindings. This is
+        # also the subject that appears in Cloud Logging logs. Cannot exceed 127 bytes. *
+        # `google.groups`: Groups the external identity belongs to. You can grant
+        # groups access to resources using an IAM `principalSet` binding; access applies
+        # to all members of the group. You can also provide custom attributes by
+        # specifying `attribute.`custom_attribute``, where ``custom_attribute`` is the
+        # name of the custom attribute to be mapped. You can define a maximum of 50
+        # custom attributes. The maximum length of a mapped attribute key is 100
+        # characters, and the key may only contain the characters [a-z0-9_]. You can
+        # reference these attributes in IAM policies to define fine-grained access for a
+        # workload to Google Cloud resources. For example: * `google.subject`: `
+        # principal://iam.googleapis.com/projects/`project`/locations/`location`/
+        # workloadIdentityPools/`pool`/subject/`value`` * `google.groups`: `principalSet:
+        # //iam.googleapis.com/projects/`project`/locations/`location`/
+        # workloadIdentityPools/`pool`/group/`value`` * `attribute.`custom_attribute``: `
+        # principalSet://iam.googleapis.com/projects/`project`/locations/`location`/
+        # workloadIdentityPools/`pool`/attribute.`custom_attribute`/`value`` Each value
+        # must be a [Common Expression Language] (https://opensource.google/projects/cel)
+        # function that maps an identity provider credential to the normalized
+        # attribute specified by the corresponding map key. You can use the `assertion`
+        # keyword in the expression to access a JSON representation of the
+        # authentication credential issued by the provider. The maximum length of an
+        # attribute mapping expression is 2048 characters. When evaluated, the total
+        # size of all mapped attributes must not exceed 8KB. For AWS providers, if no
+        # attribute mapping is defined, the following default mapping applies: ``` ` "
+        # google.subject":"assertion.arn", "attribute.aws_role": "assertion.arn.contains(
+        # 'assumed-role')" " ? assertion.arn.extract('`account_arn`assumed-role/')" " + '
+        # assumed-role/'" " + assertion.arn.extract('assumed-role/`role_name`/')" " :
+        # assertion.arn", ` ``` If any custom attribute mappings are defined, they must
+        # include a mapping to the `google.subject` attribute. For OIDC providers, you
+        # must supply a custom mapping, which must include the `google.subject`
+        # attribute. For example, the following maps the `sub` claim of the incoming
+        # credential to the `subject` attribute on a Google token: ``` `"google.subject":
+        # "assertion.sub"` ```
         # Corresponds to the JSON property `attributeMapping`
         # @return [Hash<String,String>]
         attr_accessor :attribute_mapping
@@ -3279,19 +3225,19 @@ module Google
         # @return [Google::Apis::IamV1::Aws]
         attr_accessor :aws
       
-        # A description for the provider. Cannot exceed 256 characters.
+        # Optional. A description for the provider. Cannot exceed 256 characters.
         # Corresponds to the JSON property `description`
         # @return [String]
         attr_accessor :description
       
-        # Whether the provider is disabled. You cannot use a disabled provider to
-        # exchange tokens. However, existing tokens still grant access.
+        # Optional. Whether the provider is disabled. You cannot use a disabled provider
+        # to exchange tokens. However, existing tokens still grant access.
         # Corresponds to the JSON property `disabled`
         # @return [Boolean]
         attr_accessor :disabled
         alias_method :disabled?, :disabled
       
-        # A display name for the provider. Cannot exceed 32 characters.
+        # Optional. A display name for the provider. Cannot exceed 32 characters.
         # Corresponds to the JSON property `displayName`
         # @return [String]
         attr_accessor :display_name

data/lib/google/apis/iam_v1/gem_version.rb

@@ -16,13 +16,13 @@ module Google
   module Apis
     module IamV1
       # Version of the google-apis-iam_v1 gem
-      GEM_VERSION = "0.60.0"
+      GEM_VERSION = "0.62.0"
 
       # Version of the code generator used to generate this client
-      GENERATOR_VERSION = "0.15.0"
+      GENERATOR_VERSION = "0.15.1"
 
       # Revision of the discovery document this client was generated from
-      REVISION = "20240617"
+      REVISION = "20241114"
     end
   end
 end

data/lib/google/apis/iam_v1/representations.rb

@@ -310,12 +310,6 @@ module Google
         include Google::Apis::Core::JsonObjectSupport
       end
       
-      class PatchServiceAccountKeyRequest
-        class Representation < Google::Apis::Core::JsonRepresentation; end
-      
-        include Google::Apis::Core::JsonObjectSupport
-      end
-      
       class PatchServiceAccountRequest
         class Representation < Google::Apis::Core::JsonRepresentation; end
       
@@ -1011,15 +1005,6 @@ module Google
         end
       end
       
-      class PatchServiceAccountKeyRequest
-        # @private
-        class Representation < Google::Apis::Core::JsonRepresentation
-          property :service_account_key, as: 'serviceAccountKey', class: Google::Apis::IamV1::ServiceAccountKey, decorator: Google::Apis::IamV1::ServiceAccountKey::Representation
-      
-          property :update_mask, as: 'updateMask'
-        end
-      end
-      
       class PatchServiceAccountRequest
         # @private
         class Representation < Google::Apis::Core::JsonRepresentation
@@ -1169,9 +1154,6 @@ module Google
       class ServiceAccountKey
         # @private
         class Representation < Google::Apis::Core::JsonRepresentation
-          property :contact, as: 'contact'
-          property :creator, as: 'creator'
-          property :description, as: 'description'
           property :disable_reason, as: 'disableReason'
           property :disabled, as: 'disabled'
           collection :extended_status, as: 'extendedStatus', class: Google::Apis::IamV1::ExtendedStatus, decorator: Google::Apis::IamV1::ExtendedStatus::Representation

data/lib/google/apis/iam_v1/service.rb

@@ -123,14 +123,14 @@ module Google
         # Creates a new WorkforcePool. You cannot reuse the name of a deleted pool until
         # 30 days after deletion.
         # @param [String] location
-        #   The location of the pool to create. Format: `locations/`location``.
+        #   Optional. The location of the pool to create. Format: `locations/`location``.
         # @param [Google::Apis::IamV1::WorkforcePool] workforce_pool_object
         # @param [String] workforce_pool_id
-        #   The ID to use for the pool, which becomes the final component of the resource
-        #   name. The IDs must be a globally unique string of 6 to 63 lowercase letters,
-        #   digits, or hyphens. It must start with a letter, and cannot have a trailing
-        #   hyphen. The prefix `gcp-` is reserved for use by Google, and may not be
-        #   specified.
+        #   Optional. The ID to use for the pool, which becomes the final component of the
+        #   resource name. The IDs must be a globally unique string of 6 to 63 lowercase
+        #   letters, digits, or hyphens. It must start with a letter, and cannot have a
+        #   trailing hyphen. The prefix `gcp-` is reserved for use by Google, and may not
+        #   be specified.
         # @param [String] fields
         #   Selector specifying which fields to include in a partial response.
         # @param [String] quota_user
@@ -1112,10 +1112,13 @@ module Google
         # occur immediately: * You cannot bind a principal to the custom role in an IAM
         # Policy. * Existing bindings to the custom role are not changed, but they have
         # no effect. * By default, the response from ListRoles does not include the
-        # custom role. You have 7 days to undelete the custom role. After 7 days, the
-        # following changes occur: * The custom role is permanently deleted and cannot
-        # be recovered. * If an IAM policy contains a binding to the custom role, the
-        # binding is permanently removed.
+        # custom role. A deleted custom role still counts toward the [custom role limit](
+        # https://cloud.google.com/iam/help/limits) until it is permanently deleted. You
+        # have 7 days to undelete the custom role. After 7 days, the following changes
+        # occur: * The custom role is permanently deleted and cannot be recovered. * If
+        # an IAM policy contains a binding to the custom role, the binding is
+        # permanently removed. * The custom role no longer counts toward your custom
+        # role limit.
         # @param [String] name
         #   The `name` parameter's value depends on the target resource for the request,
         #   namely [projects](https://cloud.google.com/iam/docs/reference/rest/v1/projects.
@@ -1570,8 +1573,8 @@ module Google
         
         # Updates an existing OauthClient.
         # @param [String] name
-        #   Immutable. The resource name of the OauthClient. Format:`projects/`project`/
-        #   locations/`location`/oauthClients/`oauth_client``.
+        #   Immutable. Identifier. The resource name of the OauthClient. Format:`projects/`
+        #   project`/locations/`location`/oauthClients/`oauth_client``.
         # @param [Google::Apis::IamV1::OauthClient] oauth_client_object
         # @param [String] update_mask
         #   Required. The list of fields to update.
@@ -1775,9 +1778,9 @@ module Google
         
         # Updates an existing OauthClientCredential.
         # @param [String] name
-        #   Immutable. The resource name of the OauthClientCredential. Format: `projects/`
-        #   project`/locations/`location`/oauthClients/`oauth_client`/credentials/`
-        #   credential``
+        #   Immutable. Identifier. The resource name of the OauthClientCredential. Format:
+        #   `projects/`project`/locations/`location`/oauthClients/`oauth_client`/
+        #   credentials/`credential``
         # @param [Google::Apis::IamV1::OauthClientCredential] oauth_client_credential_object
         # @param [String] update_mask
         #   Required. The list of fields to update.
@@ -2658,10 +2661,13 @@ module Google
         # occur immediately: * You cannot bind a principal to the custom role in an IAM
         # Policy. * Existing bindings to the custom role are not changed, but they have
         # no effect. * By default, the response from ListRoles does not include the
-        # custom role. You have 7 days to undelete the custom role. After 7 days, the
-        # following changes occur: * The custom role is permanently deleted and cannot
-        # be recovered. * If an IAM policy contains a binding to the custom role, the
-        # binding is permanently removed.
+        # custom role. A deleted custom role still counts toward the [custom role limit](
+        # https://cloud.google.com/iam/help/limits) until it is permanently deleted. You
+        # have 7 days to undelete the custom role. After 7 days, the following changes
+        # occur: * The custom role is permanently deleted and cannot be recovered. * If
+        # an IAM policy contains a binding to the custom role, the binding is
+        # permanently removed. * The custom role no longer counts toward your custom
+        # role limit.
         # @param [String] name
         #   The `name` parameter's value depends on the target resource for the request,
         #   namely [projects](https://cloud.google.com/iam/docs/reference/rest/v1/projects.
@@ -3806,40 +3812,6 @@ module Google
           execute_or_queue_command(command, &block)
         end
         
-        # Patches a ServiceAccountKey.
-        # @param [String] name
-        #   The resource name of the service account key in the following format `projects/
-        #   `PROJECT_ID`/serviceAccounts/`ACCOUNT`/keys/`key``.
-        # @param [Google::Apis::IamV1::PatchServiceAccountKeyRequest] patch_service_account_key_request_object
-        # @param [String] fields
-        #   Selector specifying which fields to include in a partial response.
-        # @param [String] quota_user
-        #   Available to use for quota purposes for server-side applications. Can be any
-        #   arbitrary string assigned to a user, but should not exceed 40 characters.
-        # @param [Google::Apis::RequestOptions] options
-        #   Request-specific options
-        #
-        # @yield [result, err] Result & error if block supplied
-        # @yieldparam result [Google::Apis::IamV1::ServiceAccountKey] parsed result object
-        # @yieldparam err [StandardError] error object if request failed
-        #
-        # @return [Google::Apis::IamV1::ServiceAccountKey]
-        #
-        # @raise [Google::Apis::ServerError] An error occurred on the server and the request can be retried
-        # @raise [Google::Apis::ClientError] The request is invalid and should not be retried without modification
-        # @raise [Google::Apis::AuthorizationError] Authorization is required
-        def patch_service_account_key(name, patch_service_account_key_request_object = nil, fields: nil, quota_user: nil, options: nil, &block)
-          command = make_simple_command(:post, 'v1/{+name}:patch', options)
-          command.request_representation = Google::Apis::IamV1::PatchServiceAccountKeyRequest::Representation
-          command.request_object = patch_service_account_key_request_object
-          command.response_representation = Google::Apis::IamV1::ServiceAccountKey::Representation
-          command.response_class = Google::Apis::IamV1::ServiceAccountKey
-          command.params['name'] = name unless name.nil?
-          command.query['fields'] = fields unless fields.nil?
-          command.query['quotaUser'] = quota_user unless quota_user.nil?
-          execute_or_queue_command(command, &block)
-        end
-        
         # Uploads the public key portion of a key pair that you manage, and associates
         # the public key with a ServiceAccount. After you upload the public key, you can
         # use the private key from the key pair as a service account key.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: google-apis-iam_v1
 version: !ruby/object:Gem::Version
-  version: 0.60.0
+  version: 0.62.0
 platform: ruby
 authors:
 - Google LLC
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-23 00:00:00.000000000 Z
+date: 2024-12-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-apis-core
@@ -59,7 +59,7 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/googleapis/google-api-ruby-client/issues
   changelog_uri: https://github.com/googleapis/google-api-ruby-client/tree/main/generated/google-apis-iam_v1/CHANGELOG.md
-  documentation_uri: https://googleapis.dev/ruby/google-apis-iam_v1/v0.60.0
+  documentation_uri: https://googleapis.dev/ruby/google-apis-iam_v1/v0.62.0
   source_code_uri: https://github.com/googleapis/google-api-ruby-client/tree/main/generated/google-apis-iam_v1
 post_install_message: 
 rdoc_options: []
@@ -76,7 +76,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.6
+rubygems_version: 3.5.22
 signing_key: 
 specification_version: 4
 summary: Simple REST client for Identity and Access Management (IAM) API V1