iampb

type AccessTuple struct {

	// Required. The email address of the principal whose access you want to
	// check. For example, `alice@example.com` or
	// `my-service-account@my-project.iam.gserviceaccount.com`.
	//
	// The principal must be a Google Account or a service account. Other types of
	// principals are not supported.
	Principal string `protobuf:"bytes,1,opt,name=principal,proto3" json:"principal,omitempty"`
	// Required. The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// Required. The IAM permission to check for, either in the `v1` permission
	// format or the `v2` permission format.
	//
	// For a complete list of IAM permissions in the `v1` format, see
	// https://cloud.google.com/iam/help/permissions/reference.
	//
	// For a list of IAM permissions in the `v2` format, see
	// https://cloud.google.com/iam/help/deny/supported-permissions.
	//
	// For a complete list of predefined IAM roles and the permissions in each
	// role, see https://cloud.google.com/iam/help/roles/reference.
	Permission string `protobuf:"bytes,3,opt,name=permission,proto3" json:"permission,omitempty"`
	// Output only. The permission that Policy Troubleshooter checked for, in
	// the `v2` format.
	PermissionFqdn string `protobuf:"bytes,4,opt,name=permission_fqdn,json=permissionFqdn,proto3" json:"permission_fqdn,omitempty"`
	// Optional. Additional context for the request, such as the request time or
	// IP address. This context allows Policy Troubleshooter to troubleshoot
	// conditional role bindings and deny rules.
	ConditionContext *ConditionContext `protobuf:"bytes,5,opt,name=condition_context,json=conditionContext,proto3" json:"condition_context,omitempty"`
	// contains filtered or unexported fields
}

type AllowAccessState int32

type AllowBindingExplanation struct {

	// Required. Indicates whether _this role binding_ gives the specified
	// permission to the specified principal on the specified resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission on the resource. There might be another role binding that
	// overrides this role binding. To determine whether the principal actually
	// has the permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	AllowAccessState AllowAccessState `` /* 175-byte string literal not displayed */
	// The role that this role binding grants. For example,
	// `roles/compute.admin`.
	//
	// For a complete list of predefined IAM roles, as well as the permissions in
	// each role, see https://cloud.google.com/iam/help/roles/reference.
	Role string `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
	// Indicates whether the role granted by this role binding contains the
	// specified permission.
	RolePermission RolePermissionInclusionState `` /* 179-byte string literal not displayed */
	// The relevance of the permission's existence, or nonexistence, in the role
	// to the overall determination for the entire policy.
	RolePermissionRelevance HeuristicRelevance `` /* 198-byte string literal not displayed */
	// The combined result of all memberships. Indicates if the principal is
	// included in any role binding, either directly or indirectly.
	CombinedMembership *AllowBindingExplanation_AnnotatedAllowMembership `protobuf:"bytes,5,opt,name=combined_membership,json=combinedMembership,proto3" json:"combined_membership,omitempty"`
	// Indicates whether each role binding includes the principal specified in the
	// request, either directly or indirectly. Each key identifies a principal in
	// the role binding, and each value indicates whether the principal in the
	// role binding includes the principal in the request.
	//
	// For example, suppose that a role binding includes the following principals:
	//
	// * `user:alice@example.com`
	// * `group:product-eng@example.com`
	//
	// You want to troubleshoot access for `user:bob@example.com`. This user is a
	// member of the group `group:product-eng@example.com`.
	//
	// For the first principal in the role binding, the key is
	// `user:alice@example.com`, and the `membership` field in the value is set to
	// `NOT_INCLUDED`.
	//
	// For the second principal in the role binding, the key is
	// `group:product-eng@example.com`, and the `membership` field in the value is
	// set to `INCLUDED`.
	Memberships map[string]*AllowBindingExplanation_AnnotatedAllowMembership `` /* 163-byte string literal not displayed */
	// The relevance of this role binding to the overall determination for the
	// entire policy.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// A condition expression that specifies when the role binding grants access.
	//
	// To learn about IAM Conditions, see
	// https://cloud.google.com/iam/help/conditions/overview.
	Condition *expr.Expr `protobuf:"bytes,8,opt,name=condition,proto3" json:"condition,omitempty"`
	// Condition evaluation state for this role binding.
	ConditionExplanation *ConditionExplanation `protobuf:"bytes,9,opt,name=condition_explanation,json=conditionExplanation,proto3" json:"condition_explanation,omitempty"`
	// contains filtered or unexported fields
}

type AllowBindingExplanation_AnnotatedAllowMembership struct {

	// Indicates whether the role binding includes the principal.
	Membership MembershipMatchingState `` /* 144-byte string literal not displayed */
	// The relevance of the principal's status to the overall determination for
	// the role binding.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AllowPolicyExplanation struct {

	// Indicates whether the principal has the specified permission for the
	// specified resource, based on evaluating all applicable IAM allow policies.
	AllowAccessState AllowAccessState `` /* 175-byte string literal not displayed */
	// List of IAM allow policies that were evaluated to check the principal's
	// permissions, with annotations to indicate how each policy contributed to
	// the final result.
	//
	// The list of policies includes the policy for the resource itself, as well
	// as allow policies that are inherited from higher levels of the resource
	// hierarchy, including the organization, the folder, and the project.
	//
	// To learn more about the resource hierarchy, see
	// https://cloud.google.com/iam/help/resource-hierarchy.
	ExplainedPolicies []*ExplainedAllowPolicy `protobuf:"bytes,2,rep,name=explained_policies,json=explainedPolicies,proto3" json:"explained_policies,omitempty"`
	// The relevance of the allow policy type to the overall access state.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ConditionContext struct {

	// Represents a target resource that is involved with a network activity.
	// If multiple resources are involved with an activity, this must be the
	// primary one.
	Resource *ConditionContext_Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// The destination of a network activity, such as accepting a TCP connection.
	// In a multi-hop network activity, the destination represents the receiver of
	// the last hop.
	Destination *ConditionContext_Peer `protobuf:"bytes,2,opt,name=destination,proto3" json:"destination,omitempty"`
	// Represents a network request, such as an HTTP request.
	Request *ConditionContext_Request `protobuf:"bytes,3,opt,name=request,proto3" json:"request,omitempty"`
	// Output only. The effective tags on the resource. The effective tags are
	// fetched during troubleshooting.
	EffectiveTags []*ConditionContext_EffectiveTag `protobuf:"bytes,4,rep,name=effective_tags,json=effectiveTags,proto3" json:"effective_tags,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_EffectiveTag struct {

	// Output only. Resource name for TagValue in the format `tagValues/456`.
	TagValue string `protobuf:"bytes,1,opt,name=tag_value,json=tagValue,proto3" json:"tag_value,omitempty"`
	// Output only. The namespaced name of the TagValue. Can be in the form
	// `{organization_id}/{tag_key_short_name}/{tag_value_short_name}` or
	// `{project_id}/{tag_key_short_name}/{tag_value_short_name}` or
	// `{project_number}/{tag_key_short_name}/{tag_value_short_name}`.
	NamespacedTagValue string `protobuf:"bytes,2,opt,name=namespaced_tag_value,json=namespacedTagValue,proto3" json:"namespaced_tag_value,omitempty"`
	// Output only. The name of the TagKey, in the format `tagKeys/{id}`, such
	// as `tagKeys/123`.
	TagKey string `protobuf:"bytes,3,opt,name=tag_key,json=tagKey,proto3" json:"tag_key,omitempty"`
	// Output only. The namespaced name of the TagKey. Can be in the form
	// `{organization_id}/{tag_key_short_name}` or
	// `{project_id}/{tag_key_short_name}` or
	// `{project_number}/{tag_key_short_name}`.
	NamespacedTagKey string `protobuf:"bytes,4,opt,name=namespaced_tag_key,json=namespacedTagKey,proto3" json:"namespaced_tag_key,omitempty"`
	// The parent name of the tag key.
	// Must be in the format `organizations/{organization_id}` or
	// `projects/{project_number}`
	TagKeyParentName string `protobuf:"bytes,6,opt,name=tag_key_parent_name,json=tagKeyParentName,proto3" json:"tag_key_parent_name,omitempty"`
	// Output only. Indicates the inheritance status of a tag value
	// attached to the given resource. If the tag value is inherited from one of
	// the resource's ancestors, inherited will be true. If false, then the tag
	// value is directly attached to the resource, inherited will be false.
	Inherited bool `protobuf:"varint,5,opt,name=inherited,proto3" json:"inherited,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_Peer struct {

	// The IPv4 or IPv6 address of the peer.
	Ip string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
	// The network port of the peer.
	Port int64 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_Request struct {

	// Optional. The timestamp when the destination service receives the first
	// byte of the request.
	ReceiveTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=receive_time,json=receiveTime,proto3" json:"receive_time,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_Resource struct {

	// The name of the service that this resource belongs to, such as
	// `compute.googleapis.com`. The service name might not match the DNS
	// hostname that actually serves the request.
	//
	// For a full list of resource service values, see
	// https://cloud.google.com/iam/help/conditions/resource-services
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// The stable identifier (name) of a resource on the `service`. A resource
	// can be logically identified as `//{resource.service}/{resource.name}`.
	// Unlike the resource URI, the resource name doesn't contain any protocol
	// and version information.
	//
	// For a list of full resource name formats, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// The type of the resource, in the format `{service}/{kind}`.
	//
	// For a full list of resource type values, see
	// https://cloud.google.com/iam/help/conditions/resource-types
	Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
	// contains filtered or unexported fields
}

type ConditionExplanation struct {

	// Value of the condition.
	Value *structpb.Value `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
	// Any errors that prevented complete evaluation of the condition expression.
	Errors []*status.Status `protobuf:"bytes,3,rep,name=errors,proto3" json:"errors,omitempty"`
	// The value of each statement of the condition expression. The value can be
	// `true`, `false`, or `null`. The value is `null` if the statement can't be
	// evaluated.
	EvaluationStates []*ConditionExplanation_EvaluationState `protobuf:"bytes,2,rep,name=evaluation_states,json=evaluationStates,proto3" json:"evaluation_states,omitempty"`
	// contains filtered or unexported fields
}

type ConditionExplanation_EvaluationState struct {

	// Start position of an expression in the condition, by character.
	Start int32 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
	// End position of an expression in the condition, by character,
	// end included, for example: the end position of the first part of
	// `a==b || c==d` would be 4.
	End int32 `protobuf:"varint,2,opt,name=end,proto3" json:"end,omitempty"`
	// Value of this expression.
	Value *structpb.Value `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
	// Any errors that prevented complete evaluation of the condition
	// expression.
	Errors []*status.Status `protobuf:"bytes,4,rep,name=errors,proto3" json:"errors,omitempty"`
	// contains filtered or unexported fields
}

type DenyAccessState int32

type DenyPolicyExplanation struct {

	// Indicates whether the principal is denied the specified permission for
	// the specified resource, based on evaluating all applicable IAM deny
	// policies.
	DenyAccessState DenyAccessState `` /* 171-byte string literal not displayed */
	// List of resources with IAM deny policies that were evaluated to check the
	// principal's denied permissions, with annotations to indicate how each
	// policy contributed to the final result.
	//
	// The list of resources includes the policy for the resource itself, as well
	// as policies that are inherited from higher levels of the resource
	// hierarchy, including the organization, the folder, and the project. The
	// order of the resources starts from the resource and climbs up the resource
	// hierarchy.
	//
	// To learn more about the resource hierarchy, see
	// https://cloud.google.com/iam/help/resource-hierarchy.
	ExplainedResources []*ExplainedDenyResource `protobuf:"bytes,2,rep,name=explained_resources,json=explainedResources,proto3" json:"explained_resources,omitempty"`
	// The relevance of the deny policy result to the overall access state.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// Indicates whether the permission to troubleshoot is supported in deny
	// policies.
	PermissionDeniable bool `protobuf:"varint,4,opt,name=permission_deniable,json=permissionDeniable,proto3" json:"permission_deniable,omitempty"`
	// contains filtered or unexported fields
}

type DenyRuleExplanation struct {

	// Required. Indicates whether _this rule_ denies the specified permission to
	// the specified principal for the specified resource.
	//
	// This field does _not_ indicate whether the principal is actually denied on
	// the permission for the resource. There might be another rule that overrides
	// this rule. To determine whether the principal actually has the permission,
	// use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	DenyAccessState DenyAccessState `` /* 171-byte string literal not displayed */
	// Indicates whether the permission in the request is listed as a denied
	// permission in the deny rule.
	CombinedDeniedPermission *DenyRuleExplanation_AnnotatedPermissionMatching `` /* 135-byte string literal not displayed */
	// Lists all denied permissions in the deny rule and indicates whether each
	// permission matches the permission in the request.
	//
	// Each key identifies a denied permission in the rule, and each value
	// indicates whether the denied permission matches the permission in the
	// request.
	DeniedPermissions map[string]*DenyRuleExplanation_AnnotatedPermissionMatching `` /* 200-byte string literal not displayed */
	// Indicates whether the permission in the request is listed as an exception
	// permission in the deny rule.
	CombinedExceptionPermission *DenyRuleExplanation_AnnotatedPermissionMatching `` /* 144-byte string literal not displayed */
	// Lists all exception permissions in the deny rule and indicates whether each
	// permission matches the permission in the request.
	//
	// Each key identifies a exception permission in the rule, and each value
	// indicates whether the exception permission matches the permission in the
	// request.
	ExceptionPermissions map[string]*DenyRuleExplanation_AnnotatedPermissionMatching `` /* 209-byte string literal not displayed */
	// Indicates whether the principal is listed as a denied principal in the
	// deny rule, either directly or through membership in a principal set.
	CombinedDeniedPrincipal *DenyRuleExplanation_AnnotatedDenyPrincipalMatching `` /* 132-byte string literal not displayed */
	// Lists all denied principals in the deny rule and indicates whether each
	// principal matches the principal in the request, either directly or through
	// membership in a principal set.
	//
	// Each key identifies a denied principal in the rule, and each value
	// indicates whether the denied principal matches the principal in the
	// request.
	DeniedPrincipals map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching `` /* 197-byte string literal not displayed */
	// Indicates whether the principal is listed as an exception principal in the
	// deny rule, either directly or through membership in a principal set.
	CombinedExceptionPrincipal *DenyRuleExplanation_AnnotatedDenyPrincipalMatching `` /* 141-byte string literal not displayed */
	// Lists all exception principals in the deny rule and indicates whether each
	// principal matches the principal in the request, either directly or through
	// membership in a principal set.
	//
	// Each key identifies a exception principal in the rule, and each value
	// indicates whether the exception principal matches the principal in the
	// request.
	ExceptionPrincipals map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching `` /* 206-byte string literal not displayed */
	// The relevance of this role binding to the overall determination for the
	// entire policy.
	Relevance HeuristicRelevance `` /* 138-byte string literal not displayed */
	// A condition expression that specifies when the deny rule denies the
	// principal access.
	//
	// To learn about IAM Conditions, see
	// https://cloud.google.com/iam/help/conditions/overview.
	Condition *expr.Expr `protobuf:"bytes,11,opt,name=condition,proto3" json:"condition,omitempty"`
	// Condition evaluation state for this role binding.
	ConditionExplanation *ConditionExplanation `protobuf:"bytes,12,opt,name=condition_explanation,json=conditionExplanation,proto3" json:"condition_explanation,omitempty"`
	// contains filtered or unexported fields
}

type DenyRuleExplanation_AnnotatedDenyPrincipalMatching struct {

	// Indicates whether the principal is listed as a denied principal in the
	// deny rule, either directly or through membership in a principal set.
	Membership MembershipMatchingState `` /* 144-byte string literal not displayed */
	// The relevance of the principal's status to the overall determination for
	// the role binding.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DenyRuleExplanation_AnnotatedPermissionMatching struct {

	// Indicates whether the permission in the request is denied by the deny
	// rule.
	PermissionMatchingState PermissionPatternMatchingState `` /* 210-byte string literal not displayed */
	// The relevance of the permission status to the overall determination for
	// the rule.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ExplainedAllowPolicy struct {

	// Required. Indicates whether _this policy_ provides the specified permission
	// to the specified principal for the specified resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission for the resource. There might be another policy that overrides
	// this policy. To determine whether the principal actually has the
	// permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	AllowAccessState AllowAccessState `` /* 175-byte string literal not displayed */
	// The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// Details about how each role binding in the policy affects the principal's
	// ability, or inability, to use the permission for the resource. The order of
	// the role bindings matches the role binding order in the policy.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	BindingExplanations []*AllowBindingExplanation `protobuf:"bytes,3,rep,name=binding_explanations,json=bindingExplanations,proto3" json:"binding_explanations,omitempty"`
	// The relevance of this policy to the overall access state in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// The IAM allow policy attached to the resource.
	//
	// If the sender of the request does not have access to the policy, this field
	// is empty.
	Policy *iampb.Policy `protobuf:"bytes,5,opt,name=policy,proto3" json:"policy,omitempty"`
	// contains filtered or unexported fields
}

type ExplainedDenyPolicy struct {

	// Required. Indicates whether _this policy_ denies the specified permission
	// to the specified principal for the specified resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission for the resource. There might be another policy that overrides
	// this policy. To determine whether the principal actually has the
	// permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	DenyAccessState DenyAccessState `` /* 171-byte string literal not displayed */
	// The IAM deny policy attached to the resource.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Policy *iampb1.Policy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
	// Details about how each rule in the policy affects the principal's inability
	// to use the permission for the resource. The order of the deny rule matches
	// the order of the rules in the deny policy.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	RuleExplanations []*DenyRuleExplanation `protobuf:"bytes,3,rep,name=rule_explanations,json=ruleExplanations,proto3" json:"rule_explanations,omitempty"`
	// The relevance of this policy to the overall access state in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ExplainedDenyResource struct {

	// Required. Indicates whether any policies attached to _this resource_ deny
	// the specific permission to the specified principal for the specified
	// resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission for the resource. There might be another policy that overrides
	// this policy. To determine whether the principal actually has the
	// permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	DenyAccessState DenyAccessState `` /* 171-byte string literal not displayed */
	// The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// List of IAM deny policies that were evaluated to check the principal's
	// denied permissions, with annotations to indicate how each policy
	// contributed to the final result.
	ExplainedPolicies []*ExplainedDenyPolicy `protobuf:"bytes,3,rep,name=explained_policies,json=explainedPolicies,proto3" json:"explained_policies,omitempty"`
	// The relevance of this policy to the overall access state in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Relevance HeuristicRelevance `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type HeuristicRelevance int32

type MembershipMatchingState int32

type PermissionPatternMatchingState int32

type PolicyTroubleshooterClient interface {
	// Checks whether a principal has a specific permission for a specific
	// resource, and explains why the principal does or doesn't have that
	// permission.
	TroubleshootIamPolicy(ctx context.Context, in *TroubleshootIamPolicyRequest, opts ...grpc.CallOption) (*TroubleshootIamPolicyResponse, error)
}

type PolicyTroubleshooterServer interface {
	// Checks whether a principal has a specific permission for a specific
	// resource, and explains why the principal does or doesn't have that
	// permission.
	TroubleshootIamPolicy(context.Context, *TroubleshootIamPolicyRequest) (*TroubleshootIamPolicyResponse, error)
}

type RolePermissionInclusionState int32

type TroubleshootIamPolicyRequest struct {

	// The information to use for checking whether a principal has a permission
	// for a resource.
	AccessTuple *AccessTuple `protobuf:"bytes,1,opt,name=access_tuple,json=accessTuple,proto3" json:"access_tuple,omitempty"`
	// contains filtered or unexported fields
}

type TroubleshootIamPolicyResponse struct {

	// Indicates whether the principal has the specified permission for the
	// specified resource, based on evaluating all types of the applicable IAM
	// policies.
	OverallAccessState TroubleshootIamPolicyResponse_OverallAccessState `` /* 213-byte string literal not displayed */
	// The access tuple from the request, including any provided context used to
	// evaluate the condition.
	AccessTuple *AccessTuple `protobuf:"bytes,2,opt,name=access_tuple,json=accessTuple,proto3" json:"access_tuple,omitempty"`
	// An explanation of how the applicable IAM allow policies affect the final
	// access state.
	AllowPolicyExplanation *AllowPolicyExplanation `` /* 129-byte string literal not displayed */
	// An explanation of how the applicable IAM deny policies affect the final
	// access state.
	DenyPolicyExplanation *DenyPolicyExplanation `` /* 126-byte string literal not displayed */
	// contains filtered or unexported fields
}

type TroubleshootIamPolicyResponse_OverallAccessState int32

type UnimplementedPolicyTroubleshooterServer struct {
}