gcloud: Thu Apr 6 10:23:36 UTC 2023

gcloud/access-context-manager/cloud-bindings/create

@@ -4,8 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud access-context-manager cloud-bindings create --group-key=GROUP_KEY
-        --level=[LEVEL,...] [--organization=ORGANIZATION]
-        [GCLOUD_WIDE_FLAG ...]
+        [--dry-run-level=[DRY_RUN_LEVEL,...]] [--level=[LEVEL,...]]
+        [--organization=ORGANIZATION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Create a new cloud access binding. The access level will be bound with the
@@ -19,17 +19,30 @@ EXAMPLES
             --group-key=my-group-key \
             --level=accessPolicies/123/accessLevels/abc
 
+    To create a new cloud access binding for the dry run access level, run:
+
+        $ gcloud access-context-manager cloud-bindings create \
+            --group-key=my-group-key \
+            --level=accessPolicies/123/accessLevels/abc \
+            --dry-run-level=accessPolicies/123/accessLevels/def
+
 REQUIRED FLAGS
      --group-key=GROUP_KEY
         Google Group id whose members are subject to the restrictions of this
         binding.
 
+OPTIONAL FLAGS
+     --dry-run-level=[DRY_RUN_LEVEL,...]
+        The dry run access level that binds to the given group. The dry run
+        access level will be evaluated but won't be enforced. Denial on dry run
+        access level will be logged. The input must be the full identifier of
+        an access level, such as accessPolicies/123/accessLevels/new-def.
+
      --level=[LEVEL,...]
-        The access level that will bind to the given group. The input must be
-        the full identifier for the access level, such as
+        The access level that binds to the given group. The input must be the
+        full identifier of an access level, such as
         accessPolicies/123/accessLevels/abc.
 
-OPTIONAL FLAGS
      --organization=ORGANIZATION
         Parent organization for this binding.
 

gcloud/access-context-manager/cloud-bindings/list

@@ -15,10 +15,10 @@ EXAMPLES
 
         $ gcloud access-context-manager cloud-bindings list
 
-    This will print out a list of gcpUserAccessBindings in a tabular form:
+    This command prints a list of gcpUserAccessBindings in a tabular form:
 
-        NAME                                                  GROUP_KEY    ACCESS_LEVEL
-        organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N  a3dad        accessPolicies/9522/accessLevels/device_trusted
+        NAME                                                  GROUP_KEY    ACCESS_LEVEL                                     DRY_RUN_ACCESS_LEVEL
+        organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N  a3dad        accessPolicies/9522/accessLevels/device_trusted  accessPolicies/9522/accessLevels/specific_location
 
 FLAGS
      Organization resource - The parent organization of the bindings you want

gcloud/access-context-manager/cloud-bindings/update

@@ -3,26 +3,29 @@ NAME
         cloud access binding under an organization
 
 SYNOPSIS
-    gcloud access-context-manager cloud-bindings update --level=[LEVEL,...]
+    gcloud access-context-manager cloud-bindings update
         (--binding=BINDING : --organization=ORGANIZATION)
+        [--dry-run-level=[DRY_RUN_LEVEL,...]] [--level=[LEVEL,...]]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Update a existing cloud access binding. You can only update the level.
+    Update an existing cloud access binding. You can update the level, dry run
+    level or both. They can't be both empty after update.
 
 EXAMPLES
-    To update a existing cloud access binding, run:
+    To update an existing cloud access binding, run:
 
         $ gcloud access-context-manager cloud-bindings update \
-        --binding=my-binding-id \
-        --level=accessPolicies/123/accessLevels/new-abc
+            --binding=my-binding-id \
+            --level=accessPolicies/123/accessLevels/new-abc
+
+    To remove level and add dry run level, run:
+
+        $ gcloud access-context-manager cloud-bindings update \
+            --binding=my-binding-id --level= \
+            --dry-run-level=accessPolicies/123/accessLevels/new-def
 
 REQUIRED FLAGS
-     --level=[LEVEL,...]
-        The access level that will replace the existing level for the given
-        binding. The input must be the full identifier for the access level,
-        such as accessPolicies/123/accessLevels/new-abc.
-
      Cloud access binding resource - The cloud access binding you want to
      update. The arguments in this group can be used to specify the attributes
      of this resource.
@@ -46,6 +49,17 @@ REQUIRED FLAGS
           ▸ provide the argument --organization on the command line;
           ▸ set the property access_context_manager/organization.
 
+OPTIONAL FLAGS
+     --dry-run-level=[DRY_RUN_LEVEL,...]
+        The dry run access level that replaces the existing dry run level for
+        the given binding. The input must be the full identifier of an access
+        level, such as accessPolicies/123/accessLevels/new-def.
+
+     --level=[LEVEL,...]
+        The access level that replaces the existing level for the given
+        binding. The input must be the full identifier of an access level, such
+        as accessPolicies/123/accessLevels/new-abc.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,