IAM policy should return an empty set of the bindings do not exist #3346

Activity

1. theacodes

   added

   blocks-docs-samples

   api: core

   type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.

   on May 1, 2017
2. dhermes commented on May 1, 2017

   

   dhermes

   on May 1, 2017

   Contributor

   More actions

   Current behavior leads to KeyError, yes?
3. theacodes commented on May 1, 2017

   

   theacodes

   on May 1, 2017

   ContributorAuthor

   More actions

   ya, I'd like to be able to do:

   policy = something.get_iam_policy()
   policy['roles/editor'].add('whatever')
   something.set_iam_policy(policy)

   and it'll work regardless of if any editors had been previously set.
4. dhermes commented on May 1, 2017

   

   dhermes

   on May 1, 2017

   Contributor

   More actions

   @jonparrott ISTM like you want a collections.defaultdict(set)?

   In #3325 a similar snippet was failing because policy.owners returned a frozenset. In the __getitem__ case, the raw binding will be returned, which we guarantee is a set. Is it a bad thing that the two different means of access produce different behavior?
5. theacodes commented on May 1, 2017

   

   theacodes

   on May 1, 2017

   ContributorAuthor

   More actions

   Defaultdict is pretty much what I'm after, in terms of behavior.
   I'm fine with the old/deprecated methods returning a frozenset.
6. tseaver

   added

   auth

   on May 16, 2017
7. tseaver

   closed this as completedin #3424on May 16, 2017
8. JustinBeckwith

   assigned

   tseaver

   on Feb 1, 2021
9. parthea

   added a commit that references this issue on Nov 24, 2025

   iam.Policy: return empty set on missing key.

   ...

   This issue will close once commit 624ecbf is merged into the 'main' branch.

   624ecbf