release_tracks: [ALPHA, BETA, GA]
help_text:
  brief: Add IAM policy binding to a service.
  description: |
    Add an IAM policy binding to a service.

    Note: The 'roles/servicemanagement.serviceConsumer' role can only be added to a member which is
    a user, group, or service account.

  examples: |
    To add an IAM policy binding with the role of 'roles/servicemanagement.serviceConsumer' for the
    user 'test-user@example.com' on the service 'my-service', run:

      $ {command} my-service --member='user:test-user@example.com' --role='roles/servicemanagement.serviceConsumer'

    To add an IAM policy binding with the role of
    'roles/servicemanagement.serviceConsumer' for the service account
    'my-iam-account@my-project.iam.gserviceaccount.com' on the service 'my-service', run:

      $ {command} my-service \
          --member='serviceAccount:my-iam-account@my-project.iam.gserviceaccount.com' \
          --role='roles/servicemanagement.serviceConsumer'

    See https://cloud.google.com/iam/docs/managing-policies for details of
    policy role and member types.

request:
  collection: servicemanagement.services
  use_relative_name: false

arguments:
  resource:
    help_text: The service for which to add IAM policy binding to.
    spec: !REF googlecloudsdk.command_lib.endpoints.resources:service

ALPHA:
  help_text:
    brief: Add IAM policy binding to a service.
    description: |
      Add an IAM policy binding to the IAM policy of a service. One binding consists of a member,
      a role, and an optional condition.

      Note: The 'roles/servicemanagement.serviceConsumer' role can only be added to a member which is
      a user, group, or service account.

    examples: |
      To add an IAM policy binding with the role of 'roles/servicemanagement.serviceConsumer'
      for the user 'test-user@example.com' on the service 'my-service', run:

        $ {command} my-service --member='user:test-user@example.com' --role='roles/servicemanagement.serviceConsumer'

      To add an IAM policy binding with the role of
      'roles/servicemanagement.serviceConsumer' for the service account
      'my-iam-account@my-project.iam.gserviceaccount.com' on the service 'my-service', run:

        $ {command} my-service \
            --member='serviceAccount:my-iam-account@my-project.iam.gserviceaccount.com' \
            --role='roles/servicemanagement.serviceConsumer'

      To add an IAM policy binding which expires at the end of the year 2018 for the role of
      'roles/servicemanagement.quotaAdmin' and the user 'test-user@example.com' with service 'my-service', run:

        $ {command} my-service --member='user:test-user@example.com' --role='roles/servicemanagement.quotaAdmin' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'

      See https://cloud.google.com/iam/docs/managing-policies for details of
      policy role and member types.
      See https://cloud.google.com/iam/docs/conditions-overview for details on conditions.

  iam:
    enable_condition: true