release_tracks: [GA, BETA, ALPHA]
help_text:
  brief: Remove an IAM policy binding from a Compute Engine subnetwork.
  description: |
    Remove an IAM policy binding from a Compute Engine subnetwork.

  examples: |
    To remove an IAM policy binding for the role of 'roles/compute.securityAdmin' for the user 'test-user@gmail.com'
    with subnetwork 'my-subnet' and region 'REGION', run:

      $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin'

    See https://cloud.google.com/iam/docs/managing-policies for details of
    policy role and member types.

request:
  collection: compute.subnetworks
  use_relative_name: false
  api_version: v1
  BETA:
    api_version: beta
  ALPHA:
    api_version: alpha

iam:
  set_iam_policy_request_path: regionSetPolicyRequest
  message_type_overrides:
    policy: Policy
    set_iam_policy_request: ComputeSubnetworksSetIamPolicyRequest
  ALPHA:
    enable_condition: true
    policy_version: 3
    get_iam_policy_version_path: optionsRequestedPolicyVersion
  BETA:
    policy_version: 3
    get_iam_policy_version_path: optionsRequestedPolicyVersion

arguments:
  resource:
    help_text: The subnetwork for which to remove the IAM policy from.
    spec: !REF googlecloudsdk.command_lib.compute.resources:subnet

ALPHA:
  help_text:
    brief: Remove IAM policy binding from a Compute Engine subnetwork.
    description: |
      Remove an IAM policy binding from the IAM policy of a Compute Engine subnetwork. One binding consists of a member,
      a role, and an optional condition.

    examples: |
      To remove an IAM policy binding for the role of 'roles/compute.securityAdmin' for the user 'test-user@gmail.com'
      with subnetwork 'my-subnet' and region 'REGION', run:

        $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin'

      To remove an IAM policy binding which expires at the end of the year 2018 for the role of
      'roles/compute.securityAdmin' and the user 'test-user@gmail.com' with subnetwork 'my-subnet' and region 'REGION', run:

        $ {command} my-subnet --region=REGION --member='user:test-user@gmail.com' --role='roles/compute.securityAdmin' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'

      See https://cloud.google.com/iam/docs/managing-policies for details of
      policy role and member types.