feat(iam): add v3 to the library

CHANGELOG.md

@@ -6,11 +6,17 @@ breaking changes in the upcoming 3.x release. This release is scheduled for
 
 ## v2.37.0 - TBD
 
+### New Libraries
+
 We are happy to announce the following GA libraries. Unless specifically noted,
 the APIs in these libraries are stable, and are ready for production use.
 
 - [Financial Services API](/google/cloud/financialservices/README.md)
 
+### Updated Libraries
+
+- [iam](/google/cloud/iam/README.md) - add v3 version of the library
+
 **BREAKING CHANGES**
 
 Client library `resourcesettings` is being removed because the service has been turned down.

ci/cloudbuild/builds/cmake-install.sh

@@ -153,6 +153,7 @@ expected_dirs+=(
   ./lib64/cmake/google_cloud_cpp_grpc_utils
   ./lib64/cmake/google_cloud_cpp_logging_type
   ./lib64/cmake/google_cloud_cpp_iam_v2
+  ./lib64/cmake/google_cloud_cpp_iam_v3
   ./lib64/cmake/google_cloud_cpp_mocks
   ./lib64/cmake/google_cloud_cpp_oauth2
   ./lib64/cmake/google_cloud_cpp_opentelemetry

ci/etc/expected_install_directories

@@ -799,6 +799,9 @@
 ./include/google/cloud/iam/v2
 ./include/google/cloud/iam/v2/internal
 ./include/google/cloud/iam/v2/mocks
+./include/google/cloud/iam/v3
+./include/google/cloud/iam/v3/internal
+./include/google/cloud/iam/v3/mocks
 ./include/google/cloud/iap
 ./include/google/cloud/iap/mocks
 ./include/google/cloud/iap/v1
@@ -1240,6 +1243,7 @@
 ./include/google/iam/credentials/v1
 ./include/google/iam/v1
 ./include/google/iam/v2
+./include/google/iam/v3
 ./include/google/identity
 ./include/google/identity/accesscontextmanager
 ./include/google/identity/accesscontextmanager/v1

external/googleapis/protodeps/iam_v3.deps

@@ -0,0 +1,10 @@
+@com_google_googleapis//google/api:annotations_proto
+@com_google_googleapis//google/api:client_proto
+@com_google_googleapis//google/api:field_behavior_proto
+@com_google_googleapis//google/api:field_info_proto
+@com_google_googleapis//google/api:http_proto
+@com_google_googleapis//google/api:launch_stage_proto
+@com_google_googleapis//google/api:resource_proto
+@com_google_googleapis//google/longrunning:operations_proto
+@com_google_googleapis//google/rpc:status_proto
+@com_google_googleapis//google/type:expr_proto

external/googleapis/protolists/iam_v3.list

@@ -0,0 +1,5 @@
+@com_google_googleapis//google/iam/v3:operation_metadata.proto
+@com_google_googleapis//google/iam/v3:policy_binding_resources.proto
+@com_google_googleapis//google/iam/v3:policy_bindings_service.proto
+@com_google_googleapis//google/iam/v3:principal_access_boundary_policies_service.proto
+@com_google_googleapis//google/iam/v3:principal_access_boundary_policy_resources.proto

external/googleapis/update_libraries.sh

@@ -166,6 +166,7 @@ declare -A -r LIBRARIES=(
   ["grafeas"]="@com_google_googleapis//grafeas/v1:grafeas_cc_grpc"
   ["iam"]="@com_google_googleapis//google/iam/admin/v1:admin_cc_grpc"
   ["iam_v2"]="@com_google_googleapis//google/iam/v2:iam_cc_grpc"
+  ["iam_v3"]="@com_google_googleapis//google/iam/v3:iam_cc_grpc"
   ["iap"]="@com_google_googleapis//google/cloud/iap/v1:iap_cc_grpc"
   ["ids"]="@com_google_googleapis//google/cloud/ids/v1:ids_cc_grpc"
   ["kms"]="$(

generator/generator_config.textproto

@@ -2606,6 +2606,20 @@ service {
   retryable_status_codes: ["kUnavailable"]
 }
 
+service {
+  service_proto_path: "google/iam/v3/policy_bindings_service.proto"
+  product_path: "google/cloud/iam/v3"
+  initial_copyright_year: "2025"
+  retryable_status_codes: ["kUnavailable"]
+}
+
+service {
+  service_proto_path: "google/iam/v3/principal_access_boundary_policies_service.proto"
+  product_path: "google/cloud/iam/v3"
+  initial_copyright_year: "2025"
+  retryable_status_codes: ["kUnavailable"]
+}
+
 # Identity-Aware Proxy (IAP)
 service {
   service_proto_path: "google/cloud/iap/v1/service.proto"

google/cloud/iam/BUILD.bazel

@@ -24,13 +24,15 @@ service_dirs = [
     "credentials/v1/",
     "v1/",
     "v2/",
+    "v3/",
 ]
 
 googleapis_deps = [
     "@com_google_googleapis//google/iam/admin/v1:admin_cc_grpc",
     "@com_google_googleapis//google/iam/credentials/v1:credentials_cc_grpc",
     "@com_google_googleapis//google/iam/v1:iam_cc_grpc",
     "@com_google_googleapis//google/iam/v2:iam_cc_grpc",
+    "@com_google_googleapis//google/iam/v3:iam_cc_grpc",
 ]
 
 cc_gapic_library(

google/cloud/iam/CMakeLists.txt

@@ -18,8 +18,8 @@ include(GoogleCloudCppLibrary)
 
 google_cloud_cpp_add_gapic_library(
     iam "Google Cloud IAM API"
-    SERVICE_DIRS "__EMPTY__" "admin/v1/" "credentials/v1/" "v1/" "v2/"
-    SHARED_PROTO_DEPS "iam_v2")
+    SERVICE_DIRS "__EMPTY__" "admin/v1/" "credentials/v1/" "v1/" "v2/" "v3/"
+    SHARED_PROTO_DEPS "iam_v2" "iam_v3")
 
 # Examples are enabled if possible, but package maintainers may want to disable
 # compilation to speed up their builds.

google/cloud/iam/doc/environment-variables.dox

@@ -26,6 +26,14 @@ environment variables are convenient when troubleshooting problems.
   `EndpointOption` (which defaults to "iam.googleapis.com")
   used by `MakePoliciesConnection()`.
 
+- `GOOGLE_CLOUD_CPP_POLICY_BINDINGS_ENDPOINT=...` overrides the
+  `EndpointOption` (which defaults to "iam.googleapis.com")
+  used by `MakePolicyBindingsConnection()`.
+
+- `GOOGLE_CLOUD_CPP_PRINCIPAL_ACCESS_BOUNDARY_POLICIES_ENDPOINT=...` overrides the
+  `EndpointOption` (which defaults to "iam.googleapis.com")
+  used by `MakePrincipalAccessBoundaryPoliciesConnection()`.
+
 <!-- inject-endpoint-env-vars-end -->
 
 @see google::cloud::EndpointOption

google/cloud/iam/doc/main.dox

@@ -34,6 +34,8 @@ application.
 - [\c iam_credentials_v1::IAMCredentialsClient](@ref google::cloud::iam_credentials_v1::IAMCredentialsClient)
 - [\c iam_v1::IAMPolicyClient](@ref google::cloud::iam_v1::IAMPolicyClient)
 - [\c iam_v2::PoliciesClient](@ref google::cloud::iam_v2::PoliciesClient)
+- [\c iam_v3::PolicyBindingsClient](@ref google::cloud::iam_v3::PolicyBindingsClient)
+- [\c iam_v3::PrincipalAccessBoundaryPoliciesClient](@ref google::cloud::iam_v3::PrincipalAccessBoundaryPoliciesClient)
 <!-- inject-client-list-end -->
 
 ## Next Steps

google/cloud/iam/doc/override-authentication.dox

@@ -17,6 +17,8 @@ Follow these links to find examples for other \c *Client classes:
 - [\c iam_credentials_v1::IAMCredentialsClient](@ref iam_credentials_v1::IAMCredentialsClient-service-account-snippet)
 - [\c iam_v1::IAMPolicyClient](@ref iam_v1::IAMPolicyClient-service-account-snippet)
 - [\c iam_v2::PoliciesClient](@ref iam_v2::PoliciesClient-service-account-snippet)
+- [\c iam_v3::PolicyBindingsClient](@ref iam_v3::PolicyBindingsClient-service-account-snippet)
+- [\c iam_v3::PrincipalAccessBoundaryPoliciesClient](@ref iam_v3::PrincipalAccessBoundaryPoliciesClient-service-account-snippet)
 
 <!-- inject-service-account-snippet-end -->
 
@@ -56,5 +58,17 @@ guide for more details.
 
 @snippet google/cloud/iam/v2/samples/policies_client_samples.cc with-service-account
 
+*/
+
+/*! @page iam_v3::PolicyBindingsClient-service-account-snippet Override iam_v3::PolicyBindingsClient Authentication Defaults
+
+@snippet google/cloud/iam/v3/samples/policy_bindings_client_samples.cc with-service-account
+
+*/
+
+/*! @page iam_v3::PrincipalAccessBoundaryPoliciesClient-service-account-snippet Override iam_v3::PrincipalAccessBoundaryPoliciesClient Authentication Defaults
+
+@snippet google/cloud/iam/v3/samples/principal_access_boundary_policies_client_samples.cc with-service-account
+
 */
 // <!-- inject-authentication-pages-end -->

google/cloud/iam/doc/override-endpoint.dox

@@ -17,6 +17,8 @@ Follow these links to find examples for other \c *Client classes:
 - [\c iam_credentials_v1::IAMCredentialsClient](@ref iam_credentials_v1::IAMCredentialsClient-endpoint-snippet)
 - [\c iam_v1::IAMPolicyClient](@ref iam_v1::IAMPolicyClient-endpoint-snippet)
 - [\c iam_v2::PoliciesClient](@ref iam_v2::PoliciesClient-endpoint-snippet)
+- [\c iam_v3::PolicyBindingsClient](@ref iam_v3::PolicyBindingsClient-endpoint-snippet)
+- [\c iam_v3::PrincipalAccessBoundaryPoliciesClient](@ref iam_v3::PrincipalAccessBoundaryPoliciesClient-endpoint-snippet)
 
 <!-- inject-endpoint-snippet-end -->
 
@@ -46,5 +48,17 @@ Follow these links to find examples for other \c *Client classes:
 
 @snippet google/cloud/iam/v2/samples/policies_client_samples.cc set-client-endpoint
 
+*/
+
+/*! @page iam_v3::PolicyBindingsClient-endpoint-snippet Override iam_v3::PolicyBindingsClient Endpoint Configuration
+
+@snippet google/cloud/iam/v3/samples/policy_bindings_client_samples.cc set-client-endpoint
+
+*/
+
+/*! @page iam_v3::PrincipalAccessBoundaryPoliciesClient-endpoint-snippet Override iam_v3::PrincipalAccessBoundaryPoliciesClient Endpoint Configuration
+
+@snippet google/cloud/iam/v3/samples/principal_access_boundary_policies_client_samples.cc set-client-endpoint
+
 */
 // <!-- inject-endpoint-pages-end -->

google/cloud/iam/doc/override-retry-policies.dox

@@ -83,6 +83,8 @@ Follow these links to find examples for other \c *Client classes:
 - [\c iam_credentials_v1::IAMCredentialsClient](@ref iam_credentials_v1::IAMCredentialsClient-retry-snippet)
 - [\c iam_v1::IAMPolicyClient](@ref iam_v1::IAMPolicyClient-retry-snippet)
 - [\c iam_v2::PoliciesClient](@ref iam_v2::PoliciesClient-retry-snippet)
+- [\c iam_v3::PolicyBindingsClient](@ref iam_v3::PolicyBindingsClient-retry-snippet)
+- [\c iam_v3::PrincipalAccessBoundaryPoliciesClient](@ref iam_v3::PrincipalAccessBoundaryPoliciesClient-retry-snippet)
 
 <!-- inject-retry-snippet-end -->
 
@@ -144,5 +146,29 @@ Assuming you have created a custom idempotency policy. Such as:
 
 @snippet google/cloud/iam/v2/samples/policies_client_samples.cc custom-idempotency-policy
 
+*/
+
+/*! @page iam_v3::PolicyBindingsClient-retry-snippet Override iam_v3::PolicyBindingsClient Retry Policies
+
+This shows how to override the retry policies for iam_v3::PolicyBindingsClient:
+
+@snippet google/cloud/iam/v3/samples/policy_bindings_client_samples.cc set-retry-policy
+
+Assuming you have created a custom idempotency policy. Such as:
+
+@snippet google/cloud/iam/v3/samples/policy_bindings_client_samples.cc custom-idempotency-policy
+
+*/
+
+/*! @page iam_v3::PrincipalAccessBoundaryPoliciesClient-retry-snippet Override iam_v3::PrincipalAccessBoundaryPoliciesClient Retry Policies
+
+This shows how to override the retry policies for iam_v3::PrincipalAccessBoundaryPoliciesClient:
+
+@snippet google/cloud/iam/v3/samples/principal_access_boundary_policies_client_samples.cc set-retry-policy
+
+Assuming you have created a custom idempotency policy. Such as:
+
+@snippet google/cloud/iam/v3/samples/principal_access_boundary_policies_client_samples.cc custom-idempotency-policy
+
 */
 // <!-- inject-retry-pages-end -->

google/cloud/iam/v3/.repo-metadata.json

@@ -0,0 +1,14 @@
+{
+    "api_id": "iam.googleapis.com",
+    "api_shortname": "iam",
+    "client_documentation": "https://cloud.google.com/cpp/docs/reference/iam/latest",
+    "distribution_name": "google-cloud-cpp",
+    "issue_tracker": "https://issuetracker.google.com/issues?q=componentid:1077618%20status=open",
+    "language": "cpp",
+    "library_type": "GAPIC_AUTO",
+    "name_pretty": "Identity and Access Management (IAM) API",
+    "product_documentation": "https://cloud.google.com/iam/docs/overview",
+    "release_level": "stable",
+    "repo": "googleapis/google-cloud-cpp",
+    "requires_billing": true
+}