feat: new iam v3beta client for AccessPolicies (#33878)

* feat: new iam v3beta client for AccessPolicies
docs: Updated comments across various messages, fields, enums, and methods in the IAM v3beta API, including PolicyBinding, PolicyKind, ListPolicyBindingsRequest, and SearchTargetPolicyBindingsRequest to improve clarity

PiperOrigin-RevId: 901360203

Source-Link: googleapis/googleapis@ef57648

Source-Link: googleapis/googleapis-gen@472a016
Copy-Tag: eyJwIjoiZ29vZ2xlLWlhbS12M2JldGEvLk93bEJvdC55YW1sIiwiaCI6IjQ3MmEwMTZiODY5N2NkYzdiZmFjYjFiZDQ3MjczOTE2Njg1ZWNkNDAifQ==

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

---------

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Author: gcf-owl-bot[bot]

google-iam-v3beta/.owlbot-manifest.json

@@ -12,9 +12,22 @@
     "README.md",
     "Rakefile",
     "gapic_metadata.json",
-    "google-iam-v3beta.gemspec",
-    "lib/google-iam-v3beta.rb",
+    "google-cloud-iam-v3beta.gemspec",
+    "lib/google-cloud-iam-v3beta.rb",
+    "lib/google/cloud/iam/v3beta/version.rb",
     "lib/google/iam/v3beta.rb",
+    "lib/google/iam/v3beta/access_policies.rb",
+    "lib/google/iam/v3beta/access_policies/client.rb",
+    "lib/google/iam/v3beta/access_policies/credentials.rb",
+    "lib/google/iam/v3beta/access_policies/operations.rb",
+    "lib/google/iam/v3beta/access_policies/paths.rb",
+    "lib/google/iam/v3beta/access_policies/rest.rb",
+    "lib/google/iam/v3beta/access_policies/rest/client.rb",
+    "lib/google/iam/v3beta/access_policies/rest/operations.rb",
+    "lib/google/iam/v3beta/access_policies/rest/service_stub.rb",
+    "lib/google/iam/v3beta/access_policies_service_pb.rb",
+    "lib/google/iam/v3beta/access_policies_service_services_pb.rb",
+    "lib/google/iam/v3beta/access_policy_resources_pb.rb",
     "lib/google/iam/v3beta/operation_metadata_pb.rb",
     "lib/google/iam/v3beta/policy_binding_resources_pb.rb",
     "lib/google/iam/v3beta/policy_bindings.rb",
@@ -41,13 +54,14 @@
     "lib/google/iam/v3beta/principal_access_boundary_policies_service_services_pb.rb",
     "lib/google/iam/v3beta/principal_access_boundary_policy_resources_pb.rb",
     "lib/google/iam/v3beta/rest.rb",
-    "lib/google/iam/v3beta/version.rb",
     "proto_docs/README.md",
     "proto_docs/google/api/client.rb",
     "proto_docs/google/api/field_behavior.rb",
     "proto_docs/google/api/field_info.rb",
     "proto_docs/google/api/launch_stage.rb",
     "proto_docs/google/api/resource.rb",
+    "proto_docs/google/iam/v3beta/access_policies_service.rb",
+    "proto_docs/google/iam/v3beta/access_policy_resources.rb",
     "proto_docs/google/iam/v3beta/operation_metadata.rb",
     "proto_docs/google/iam/v3beta/policy_binding_resources.rb",
     "proto_docs/google/iam/v3beta/policy_bindings_service.rb",
@@ -62,6 +76,12 @@
     "proto_docs/google/rpc/status.rb",
     "proto_docs/google/type/expr.rb",
     "snippets/Gemfile",
+    "snippets/access_policies/create_access_policy.rb",
+    "snippets/access_policies/delete_access_policy.rb",
+    "snippets/access_policies/get_access_policy.rb",
+    "snippets/access_policies/list_access_policies.rb",
+    "snippets/access_policies/search_access_policy_bindings.rb",
+    "snippets/access_policies/update_access_policy.rb",
     "snippets/policy_bindings/create_policy_binding.rb",
     "snippets/policy_bindings/delete_policy_binding.rb",
     "snippets/policy_bindings/get_policy_binding.rb",
@@ -75,6 +95,10 @@
     "snippets/principal_access_boundary_policies/search_principal_access_boundary_policy_bindings.rb",
     "snippets/principal_access_boundary_policies/update_principal_access_boundary_policy.rb",
     "snippets/snippet_metadata_google.iam.v3beta.json",
+    "test/google/iam/v3beta/access_policies_operations_test.rb",
+    "test/google/iam/v3beta/access_policies_paths_test.rb",
+    "test/google/iam/v3beta/access_policies_rest_test.rb",
+    "test/google/iam/v3beta/access_policies_test.rb",
     "test/google/iam/v3beta/policy_bindings_operations_test.rb",
     "test/google/iam/v3beta/policy_bindings_paths_test.rb",
     "test/google/iam/v3beta/policy_bindings_rest_test.rb",
@@ -86,6 +110,7 @@
     "test/helper.rb"
   ],
   "static": [
-    ".OwlBot.yaml"
+    ".OwlBot.yaml",
+    "lib/google/iam/v3beta/version.rb"
   ]
 }

google-iam-v3beta/.repo-metadata.json

@@ -1,8 +1,8 @@
 {
     "api_id": "iam.googleapis.com",
     "api_shortname": "iam",
-    "client_documentation": "https://cloud.google.com/ruby/docs/reference/google-iam-v3beta/latest",
-    "distribution_name": "google-iam-v3beta",
+    "client_documentation": "https://cloud.google.com/ruby/docs/reference/google-cloud-iam-v3beta/latest",
+    "distribution_name": "google-cloud-iam-v3beta",
     "is_cloud": true,
     "language": "ruby",
     "name": "iam",
@@ -11,7 +11,7 @@
     "release_level": "preview",
     "repo": "googleapis/google-cloud-ruby",
     "requires_billing": true,
-    "ruby-cloud-description": "Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. Note that google-iam-v3beta is a version-specific client library. For most uses, we recommend installing the main client library google-iam instead. See the readme for more details.",
+    "ruby-cloud-description": "Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. Note that google-cloud-iam-v3beta is a version-specific client library. For most uses, we recommend installing the main client library google-cloud-iam instead. See the readme for more details.",
     "ruby-cloud-product-url": "https://cloud.google.com/iam/docs/overview",
     "library_type": "GAPIC_AUTO"
 }

google-iam-v3beta/.rubocop.yml

@@ -3,7 +3,7 @@ inherit_gem:
 
 AllCops:
   Exclude:
-    - "google-iam-v3beta.gemspec"
+    - "google-cloud-iam-v3beta.gemspec"
     - "lib/**/*_pb.rb"
     - "proto_docs/**/*"
     - "test/**/*"
@@ -30,4 +30,4 @@ Naming/AccessorMethodName:
     - "snippets/**/*.rb"
 Naming/FileName:
   Exclude:
-    - "lib/google-iam-v3beta.rb"
+    - "lib/google-cloud-iam-v3beta.rb"

google-iam-v3beta/AUTHENTICATION.md

@@ -1,6 +1,6 @@
 # Authentication
 
-The recommended way to authenticate to the google-iam-v3beta library is to use
+The recommended way to authenticate to the google-cloud-iam-v3beta library is to use
 [Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials).
 To review all of your authentication options, see [Credentials lookup](#credential-lookup).
 
@@ -26,7 +26,7 @@ For more information about setting up authentication for a local development env
 
 ## Credential Lookup
 
-The google-iam-v3beta library provides several mechanisms to configure your system.
+The google-cloud-iam-v3beta library provides several mechanisms to configure your system.
 Generally, using Application Default Credentials to facilitate automatic 
 credentials discovery is the easist method. But if you need to explicitly specify
 credentials, there are several methods available to you.
@@ -56,7 +56,7 @@ To configure a credentials file for an individual client initialization:
 ```ruby
 require "google/iam/v3beta"
 
-client = ::Google::Iam::V3beta::PolicyBindings::Client.new do |config|
+client = ::Google::Iam::V3beta::AccessPolicies::Client.new do |config|
   config.credentials = "path/to/credentialfile.json"
 end
 ```
@@ -66,11 +66,11 @@ To configure a credentials file globally for all clients:
 ```ruby
 require "google/iam/v3beta"
 
-::Google::Iam::V3beta::PolicyBindings::Client.configure do |config|
+::Google::Iam::V3beta::AccessPolicies::Client.configure do |config|
   config.credentials = "path/to/credentialfile.json"
 end
 
-client = ::Google::Iam::V3beta::PolicyBindings::Client.new
+client = ::Google::Iam::V3beta::AccessPolicies::Client.new
 ```
 
 ### Environment Variables
@@ -89,7 +89,7 @@ Note: Service account keys are a security risk if not managed correctly. You sho
 [choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
 whenever possible.
 
-The environment variables that google-iam-v3beta
+The environment variables that google-cloud-iam-v3beta
 checks for credentials are:
 
 * `GOOGLE_CLOUD_CREDENTIALS` - Path to JSON file, or JSON contents
@@ -100,7 +100,7 @@ require "google/iam/v3beta"
 
 ENV["GOOGLE_APPLICATION_CREDENTIALS"] = "path/to/credentialfile.json"
 
-client = ::Google::Iam::V3beta::PolicyBindings::Client.new
+client = ::Google::Iam::V3beta::AccessPolicies::Client.new
 ```
 
 ### Local ADC file

google-iam-v3beta/README.md

@@ -9,13 +9,13 @@ https://github.com/googleapis/google-cloud-ruby
 This gem is a _versioned_ client. It provides basic client classes for a
 specific version of the Identity and Access Management (IAM) V3BETA API. Most users should consider using
 the main client gem,
-[google-iam](https://rubygems.org/gems/google-iam).
+[google-cloud-iam](https://rubygems.org/gems/google-cloud-iam).
 See the section below titled *Which client should I use?* for more information.
 
 ## Installation
 
 ```
-$ gem install google-iam-v3beta
+$ gem install google-cloud-iam-v3beta
 ```
 
 ## Before You Begin
@@ -32,12 +32,12 @@ In order to use this library, you first need to go through the following steps:
 ```ruby
 require "google/iam/v3beta"
 
-client = ::Google::Iam::V3beta::PolicyBindings::Client.new
-request = ::Google::Iam::V3beta::CreatePolicyBindingRequest.new # (request fields as keyword arguments...)
-response = client.create_policy_binding request
+client = ::Google::Iam::V3beta::AccessPolicies::Client.new
+request = ::Google::Iam::V3beta::CreateAccessPolicyRequest.new # (request fields as keyword arguments...)
+response = client.create_access_policy request
 ```
 
-View the [Client Library Documentation](https://cloud.google.com/ruby/docs/reference/google-iam-v3beta/latest)
+View the [Client Library Documentation](https://cloud.google.com/ruby/docs/reference/google-cloud-iam-v3beta/latest)
 for class and method documentation.
 
 See also the [Product Documentation](https://cloud.google.com/iam/docs/overview)
@@ -75,7 +75,7 @@ constructing a client object. For example:
 require "google/iam/v3beta"
 require "logger"
 
-client = ::Google::Iam::V3beta::PolicyBindings::Client.new do |config|
+client = ::Google::Iam::V3beta::AccessPolicies::Client.new do |config|
   config.logger = Logger.new "my-app.log"
 end
 ```
@@ -98,9 +98,9 @@ support schedule.
 ## Which client should I use?
 
 Most modern Ruby client libraries for Google APIs come in two flavors: the main
-client library with a name such as `google-iam`,
+client library with a name such as `google-cloud-iam`,
 and lower-level _versioned_ client libraries with names such as
-`google-iam-v3beta`.
+`google-cloud-iam-v3beta`.
 _In most cases, you should install the main client._
 
 ### What's the difference between the main client and a versioned client?
@@ -125,7 +125,7 @@ service version.
 
 We recommend that most users install the main client gem for a service. You can
 identify this gem as the one _without_ a version in its name, e.g.
-`google-iam`.
+`google-cloud-iam`.
 The main client is recommended because it will embody the best practices for
 accessing the service, and may also provide more convenient interfaces or
 tighter integration into frameworks and third-party libraries. In addition, the
@@ -138,7 +138,7 @@ You can use a versioned client if you are content with a possibly lower-level
 class interface, you explicitly want to avoid features provided by the main
 client, or you want to access a specific service version not be covered by the
 main client. You can identify versioned client gems because the service version
-is part of the name, e.g. `google-iam-v3beta`.
+is part of the name, e.g. `google-cloud-iam-v3beta`.
 
 ### What about the google-apis-<name> clients?
 

google-iam-v3beta/Rakefile

@@ -37,7 +37,7 @@ Rake::TestTask.new :smoke_test do |t|
 end
 
 # Acceptance tests
-desc "Run the google-iam-v3beta acceptance tests."
+desc "Run the google-cloud-iam-v3beta acceptance tests."
 task :acceptance, :project, :keyfile do |t, args|
   project = args[:project]
   project ||=
@@ -57,8 +57,8 @@ task :acceptance, :project, :keyfile do |t, args|
   if project.nil? || keyfile.nil?
     fail "You must provide a project and keyfile. e.g. rake acceptance[test123, /path/to/keyfile.json] or GOOGLE_CLOUD_TEST_PROJECT=test123 GOOGLE_CLOUD_TEST_KEYFILE=/path/to/keyfile.json rake acceptance"
   end
-  require "google/iam/v3beta/policy_bindings/credentials"
-  ::Google::Iam::V3beta::PolicyBindings::Credentials.env_vars.each do |path|
+  require "google/iam/v3beta/access_policies/credentials"
+  ::Google::Iam::V3beta::AccessPolicies::Credentials.env_vars.each do |path|
     ENV[path] = nil
   end
   ENV["GOOGLE_CLOUD_PROJECT"] = project
@@ -73,7 +73,7 @@ namespace :acceptance do
     if File.directory? "acceptance"
       Rake::Task[:smoke_test].invoke
     else
-      puts "The google-iam-v3beta gem has no acceptance tests."
+      puts "The google-cloud-iam-v3beta gem has no acceptance tests."
     end
   end
 
@@ -97,7 +97,7 @@ namespace :samples do
         end
       end
     else
-      puts "The google-iam-v3beta gem has no samples to test."
+      puts "The google-cloud-iam-v3beta gem has no samples to test."
     end
   end
 
@@ -111,7 +111,7 @@ namespace :samples do
         end
       end
     else
-      puts "The google-iam-v3beta gem has no samples to test."
+      puts "The google-cloud-iam-v3beta gem has no samples to test."
     end
   end
 end
@@ -124,31 +124,31 @@ end
 
 desc "Run yard-doctest example tests."
 task :doctest do
-  puts "The google-iam-v3beta gem does not have doctest tests."
+  puts "The google-cloud-iam-v3beta gem does not have doctest tests."
 end
 
 desc "Run the CI build"
 task :ci do
-  header "BUILDING google-iam-v3beta"
-  header "google-iam-v3beta rubocop", "*"
+  header "BUILDING google-cloud-iam-v3beta"
+  header "google-cloud-iam-v3beta rubocop", "*"
   Rake::Task[:rubocop].invoke
-  header "google-iam-v3beta yard", "*"
+  header "google-cloud-iam-v3beta yard", "*"
   Rake::Task[:yard].invoke
-  header "google-iam-v3beta test", "*"
+  header "google-cloud-iam-v3beta test", "*"
   Rake::Task[:test].invoke
 end
 
 namespace :ci do
   desc "Run the CI build, with smoke tests."
   task :smoke_test do
     Rake::Task[:ci].invoke
-    header "google-iam-v3beta smoke_test", "*"
+    header "google-cloud-iam-v3beta smoke_test", "*"
     Rake::Task[:smoke_test].invoke
   end
   desc "Run the CI build, with acceptance tests."
   task :acceptance do
     Rake::Task[:ci].invoke
-    header "google-iam-v3beta acceptance", "*"
+    header "google-cloud-iam-v3beta acceptance", "*"
     Rake::Task[:acceptance].invoke
   end
   task :a do

google-iam-v3beta/gapic_metadata.json

@@ -5,6 +5,45 @@
   "protoPackage": "google.iam.v3beta",
   "libraryPackage": "::Google::Iam::V3beta",
   "services": {
+    "AccessPolicies": {
+      "clients": {
+        "grpc": {
+          "libraryClient": "::Google::Iam::V3beta::AccessPolicies::Client",
+          "rpcs": {
+            "CreateAccessPolicy": {
+              "methods": [
+                "create_access_policy"
+              ]
+            },
+            "GetAccessPolicy": {
+              "methods": [
+                "get_access_policy"
+              ]
+            },
+            "UpdateAccessPolicy": {
+              "methods": [
+                "update_access_policy"
+              ]
+            },
+            "DeleteAccessPolicy": {
+              "methods": [
+                "delete_access_policy"
+              ]
+            },
+            "ListAccessPolicies": {
+              "methods": [
+                "list_access_policies"
+              ]
+            },
+            "SearchAccessPolicyBindings": {
+              "methods": [
+                "search_access_policy_bindings"
+              ]
+            }
+          }
+        }
+      }
+    },
     "PolicyBindings": {
       "clients": {
         "grpc": {

…gle-iam-v3beta/google-iam-v3beta.gemspec …m-v3beta/google-cloud-iam-v3beta.gemspecgoogle-iam-v3beta/google-iam-v3beta.gemspec renamed to google-iam-v3beta/google-cloud-iam-v3beta.gemspec google-iam-v3beta/google-iam-v3beta.gemspec renamed to google-iam-v3beta/google-cloud-iam-v3beta.gemspec

@@ -1,15 +1,15 @@
 # -*- ruby -*-
 # encoding: utf-8
 
-require File.expand_path("lib/google/iam/v3beta/version", __dir__)
+require File.expand_path("lib/google/cloud/iam/v3beta/version", __dir__)
 
 Gem::Specification.new do |gem|
-  gem.name          = "google-iam-v3beta"
-  gem.version       = Google::Iam::V3beta::VERSION
+  gem.name          = "google-cloud-iam-v3beta"
+  gem.version       = Google::Cloud::Iam::V3beta::VERSION
 
   gem.authors       = ["Google LLC"]
   gem.email         = "googleapis-packages@google.com"
-  gem.description   = "Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. Note that google-iam-v3beta is a version-specific client library. For most uses, we recommend installing the main client library google-iam instead. See the readme for more details."
+  gem.description   = "Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. Note that google-cloud-iam-v3beta is a version-specific client library. For most uses, we recommend installing the main client library google-cloud-iam instead. See the readme for more details."
   gem.summary       = "Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API."
   gem.homepage      = "https://github.com/googleapis/google-cloud-ruby"
   gem.license       = "Apache-2.0"

…ogle-iam-v3beta/lib/google-iam-v3beta.rb …am-v3beta/lib/google-cloud-iam-v3beta.rbgoogle-iam-v3beta/lib/google-iam-v3beta.rb renamed to google-iam-v3beta/lib/google-cloud-iam-v3beta.rb google-iam-v3beta/lib/google-iam-v3beta.rb renamed to google-iam-v3beta/lib/google-cloud-iam-v3beta.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# Copyright 2025 Google LLC
+# Copyright 2026 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.