POSITIONAL ARGUMENTS

Attestor resource - The Binary Authorization attestor for which to add IAM policy binding to. This represents a Cloud resource. (NOTE) Some attributes are not given arguments in this group but can be set in other ways. To set the [project] attribute: provide the argument [attestor] on the command line with a fully specified name; set the property [core/project]; provide the argument [--project] on the command line. This must be specified.

ATTESTOR

ID of the attestor or fully qualified identifier for the attestor.

REQUIRED FLAGS

--member=MEMBER

The member to remove the binding for. Should be of the form user|group|serviceAccount:email or domain:domain.
Examples: user:test-user@gmail.com, group:admins@example.com, serviceAccount:test123@example.domain.com, or domain:example.domain.com.
Can also be one of the following special values:

---

allUsers - anyone who is on the internet, with or without a Google account.

---

allAuthenticatedUsers - anyone who is authenticated with a Google account or a service account.

--role=ROLE

The role to remove the member from.

OPTIONAL FLAGS

At most one of these may be specified:

--all

Remove all bindings with this role and member, irrespective of any conditions.

--condition=[KEY=VALUE,...]

Condition of the binding to be removed. When condition is explicitly specified as None (e.g. --condition=None), it matches a binding without a condition. Otherwise, only the binding with a condition which exactly matches the specified condition (including the optional description) will be removed.

expression

(Required) Expression of the condition which evaluates to True or False. This uses a subset of Common Expression Language syntax.

title

(Required) Title for the expression, i.e. a short string describing its purpose.

description

(Optional) Description for the expression. This is a longer text which describes the expression.
NOTE: An unsatisfied condition will not allow access via this binding.

--condition-from-file=CONDITION_FROM_FILE

Path to a local JSON or YAML file that defines the condition. To see available fields, see the help for --condition.

GCLOUD WIDE FLAGS

API REFERENCE

EXAMPLES

$ gcloud alpha container binauthz attestors \
    remove-iam-policy-binding my_attestor \
    --member='user:test-user@gmail.com' \
    --role='roles/binaryauthorization.attestorsEditor'

$ gcloud alpha container binauthz attestors \
    remove-iam-policy-binding my_attestor \
    --member='user:test-user@gmail.com' \
    --role='roles/binaryauthorization.attestorsEditor' \
    --condition='expression=request.time <
 timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,descrip\ tion=Expires at midnight on 2018-12-31'

NOTES

$ gcloud beta container binauthz attestors remove-iam-policy-binding