gcloud: Thu Jan 19 00:56:33 UTC 2023

gcloud/alpha/access-context-manager/cloud-bindings/create

@@ -4,7 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha access-context-manager cloud-bindings create
-        --group-key=GROUP_KEY --level=[LEVEL,...] [--organization=ORGANIZATION]
+        --group-key=GROUP_KEY [--dry-run-level=[DRY_RUN_LEVEL,...]]
+        [--level=[LEVEL,...]] [--organization=ORGANIZATION]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -13,23 +14,31 @@ DESCRIPTION
     group tries to access the Google cloud console or API.
 
 EXAMPLES
-    To create a new cloud access binding, run:
+    To create a new cloud access binding including the dry run access level,
+    run:
 
         $ gcloud alpha access-context-manager cloud-bindings create \
             --group-key=my-group-key \
-            --level=accessPolicies/123/accessLevels/abc
+            --level=accessPolicies/123/accessLevels/abc \
+            --dry-run-level=accessPolicies/123/accessLevels/def
 
 REQUIRED FLAGS
      --group-key=GROUP_KEY
         Google Group id whose members are subject to the restrictions of this
         binding.
 
+OPTIONAL FLAGS
+     --dry-run-level=[DRY_RUN_LEVEL,...]
+        The dry run access level that will bind to the given group. The dry run
+        access level will be evaluated but won't be enforced. Denial on dry run
+        access level will be logged. The input must be the full identifier for
+        access level, such as accessPolicies/123/accessLevels/new-def.
+
      --level=[LEVEL,...]
         The access level that will bind to the given group. The input must be
         the full identifier for the access level, such as
         accessPolicies/123/accessLevels/abc.
 
-OPTIONAL FLAGS
      --organization=ORGANIZATION
         Parent organization for this binding.
 

gcloud/alpha/access-context-manager/cloud-bindings/list

@@ -17,8 +17,8 @@ EXAMPLES
 
     This will print out a list of gcpUserAccessBindings in a tabular form:
 
-        NAME                                                  GROUP_KEY    ACCESS_LEVEL
-        organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N  a3dad        accessPolicies/9522/accessLevels/device_trusted
+        NAME                                                  GROUP_KEY    ACCESS_LEVEL                                     DRY_RUN_ACCESS_LEVEL
+        organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N  a3dad        accessPolicies/9522/accessLevels/device_trusted  accessPolicies/9522/accessLevels/specific_location
 
 FLAGS
      Organization resource - The parent organization of the bindings you want

gcloud/alpha/access-context-manager/cloud-bindings/update

@@ -4,26 +4,29 @@ NAME
 
 SYNOPSIS
     gcloud alpha access-context-manager cloud-bindings update
-        --level=[LEVEL,...] (--binding=BINDING : --organization=ORGANIZATION)
+        (--binding=BINDING : --organization=ORGANIZATION)
+        [--dry-run-level=[DRY_RUN_LEVEL,...]] [--level=[LEVEL,...]]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Update a existing cloud access binding. You can only update the
-    level.
+    (ALPHA) Update an existing cloud access binding. You can only update the
+    level and dry run level. For level and dry run level, you can update one of
+    these two or both. They can't be both empty after update.
 
 EXAMPLES
-    To update a existing cloud access binding, run:
+    To update an existing cloud access binding, run:
 
         $ gcloud alpha access-context-manager cloud-bindings update \
             --binding=my-binding-id \
             --level=accessPolicies/123/accessLevels/new-abc
 
-REQUIRED FLAGS
-     --level=[LEVEL,...]
-        The access level that will replace the existing level for the given
-        binding. The input must be the full identifier for the access level,
-        such as accessPolicies/123/accessLevels/new-abc.
+    To update level to empty and add dry run level, run:
 
+        $ gcloud alpha access-context-manager cloud-bindings update \
+            --binding=my-binding-id --level= \
+            --dry-run-level=accessPolicies/123/accessLevels/new-def
+
+REQUIRED FLAGS
      Cloud access binding resource - The cloud access binding you want to
      update. The arguments in this group can be used to specify the attributes
      of this resource.
@@ -47,6 +50,17 @@ REQUIRED FLAGS
           ▸ provide the argument --organization on the command line;
           ▸ set the property access_context_manager/organization.
 
+OPTIONAL FLAGS
+     --dry-run-level=[DRY_RUN_LEVEL,...]
+        The dry run access level that will replace the dry run existing level
+        for the given binding. The input must be the full identifier for access
+        level, such as accessPolicies/123/accessLevels/new-def.
+
+     --level=[LEVEL,...]
+        The access level that will replace the existing level for the given
+        binding. The input must be the full identifier for the access level,
+        such as accessPolicies/123/accessLevels/new-abc.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,