Bind console users to the appropriate IAP roles upon creation (#2403)

Console users need IAP to inject the necessary OIDC tokens into their request headers and therefore need to be bound to appropriate roles. Note that in environments managed by latchkey, the bindings will need to be present in latchkey config files as well, otherwise the changes made by the nomulus tool will be reverted. TESTED=ran the nomulus command against alpha and verified that the bindings are created/removed upon console user creation/deletion.
2026-01-05 21:15:18 +00:00 · 2024-04-24 11:03:43 -04:00
parent 0765e7b209
commit 6d0a746b76
21 changed files with 465 additions and 70 deletions
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -149,6 +149,7 @@ dependencies {
  implementation deps['com.google.apis:google-api-services-drive']
  implementation deps['com.google.apis:google-api-services-gmail']
  implementation deps['com.google.apis:google-api-services-groupssettings']
+  implementation deps['com.google.apis:google-api-services-iam']
  implementation deps['com.google.apis:google-api-services-monitoring']
  implementation deps['com.google.apis:google-api-services-sheets']
  implementation deps['com.google.apis:google-api-services-storage']
--- a/core/gradle.lockfile
+++ b/core/gradle.lockfile
@@ -86,11 +86,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,depl
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -111,8 +112,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,deploy_jar,nonprodComp
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -360,9 +361,9 @@ org.apache.beam:beam-vendor-guava-32_1_2-jre:0.1=compileClasspath,deploy_jar,non
 org.apache.commons:commons-compress:1.24.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-csv:1.10.0=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-exec:1.3=testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.13.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-lang3:3.14.0=testCompileClasspath,testRuntimeClasspath
 org.apache.commons:commons-lang3:3.9=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath
-org.apache.commons:commons-text:1.11.0=testCompileClasspath,testRuntimeClasspath
+org.apache.commons:commons-text:1.12.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftplet-api:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.ftpserver:ftpserver-core:1.2.0=testCompileClasspath,testRuntimeClasspath
 org.apache.httpcomponents:httpclient:4.5.14=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -372,7 +373,7 @@ org.apache.sshd:sshd-common:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-core:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-scp:2.12.1=testCompileClasspath,testRuntimeClasspath
 org.apache.sshd:sshd-sftp:2.12.1=testCompileClasspath,testRuntimeClasspath
-org.apache.tomcat:tomcat-annotations-api:11.0.0-M18=testCompileClasspath,testRuntimeClasspath
+org.apache.tomcat:tomcat-annotations-api:11.0.0-M19=testCompileClasspath,testRuntimeClasspath
 org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.bouncycastle:bcpg-jdk18on:1.78=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.bouncycastle:bcpkix-jdk18on:1.78=compileClasspath,deploy_jar,nonprodCompileClasspath,nonprodRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -494,7 +495,7 @@ org.seleniumhq.selenium:selenium-safari-driver:3.141.59=testCompileClasspath,tes
 org.seleniumhq.selenium:selenium-support:3.141.59=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jcl-over-slf4j:1.7.32=testCompileClasspath,testRuntimeClasspath
 org.slf4j:jul-to-slf4j:1.7.30=testRuntimeClasspath
-org.slf4j:slf4j-api:2.0.12=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
+org.slf4j:slf4j-api:2.0.13=compileClasspath,nonprodCompileClasspath,nonprodRuntimeClasspath,testCompileClasspath
 org.slf4j:slf4j-api:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.slf4j:slf4j-jdk14:2.1.0-alpha1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.snakeyaml:snakeyaml-engine:2.1=deploy_jar,nonprodRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
--- a/core/src/main/java/google/registry/tools/CreateOrUpdateUserCommand.java
+++ b/core/src/main/java/google/registry/tools/CreateOrUpdateUserCommand.java
@@ -31,7 +31,6 @@ import javax.annotation.Nullable;
 /** Shared base class for commands that create or modify a {@link User}. */
 public abstract class CreateOrUpdateUserCommand extends ConfirmingCommand {

-  @Nullable
  @Parameter(names = "--email", description = "Email address of the user", required = true)
  String email;

@@ -61,7 +60,7 @@ public abstract class CreateOrUpdateUserCommand extends ConfirmingCommand {
  abstract User getExistingUser(String email);

  @Override
-  protected final String execute() throws Exception {
+  protected String execute() throws Exception {
    checkArgumentNotNull(email, "Email must be provided");
    tm().transact(this::executeInTransaction);
    return String.format("Saved user with email %s", email);
--- a/core/src/main/java/google/registry/tools/CreateUserCommand.java
+++ b/core/src/main/java/google/registry/tools/CreateUserCommand.java
@@ -20,15 +20,27 @@ import com.beust.jcommander.Parameters;
 import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
 import javax.annotation.Nullable;
+import javax.inject.Inject;

 /** Command to create a new User. */
@Parameters(separators = " =", commandDescription = "Update a user account")
 public class CreateUserCommand extends CreateOrUpdateUserCommand {

+  static final String IAP_SECURED_WEB_APP_USER_ROLE = "roles/iap.httpsResourceAccessor";
+
+  @Inject IamClient iamClient;
+
  @Nullable
  @Override
  User getExistingUser(String email) {
    checkArgument(UserDao.loadUser(email).isEmpty(), "A user with email %s already exists", email);
    return null;
  }
+
+  @Override
+  protected String execute() throws Exception {
+    String ret = super.execute();
+    iamClient.addBinding(email, IAP_SECURED_WEB_APP_USER_ROLE);
+    return ret;
+  }
 }
--- a/core/src/main/java/google/registry/tools/DeleteUserCommand.java
+++ b/core/src/main/java/google/registry/tools/DeleteUserCommand.java
@@ -15,6 +15,7 @@
 package google.registry.tools;

 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
+import static google.registry.tools.CreateUserCommand.IAP_SECURED_WEB_APP_USER_ROLE;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;

@@ -24,11 +25,14 @@ import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
 import java.util.Optional;
 import javax.annotation.Nullable;
+import javax.inject.Inject;

 /** Deletes a {@link User}. */
@Parameters(separators = " =", commandDescription = "Delete a user account")
 public class DeleteUserCommand extends ConfirmingCommand {

+  @Inject IamClient iamClient;
+
  @Nullable
  @Parameter(names = "--email", description = "Email address of the user", required = true)
  String email;
@@ -48,6 +52,7 @@ public class DeleteUserCommand extends ConfirmingCommand {
              checkArgumentPresent(optionalUser, "Email no longer corresponds to a valid user");
              tm().delete(optionalUser.get());
            });
+    iamClient.removeBinding(email, IAP_SECURED_WEB_APP_USER_ROLE);
    return String.format("Deleted user with email %s", email);
  }
 }
--- a/core/src/main/java/google/registry/tools/IamClient.java
+++ b/core/src/main/java/google/registry/tools/IamClient.java
@@ -0,0 +1,132 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools;
+
+import com.google.api.services.cloudresourcemanager.CloudResourceManager;
+import com.google.api.services.cloudresourcemanager.model.Binding;
+import com.google.api.services.cloudresourcemanager.model.GetIamPolicyRequest;
+import com.google.api.services.cloudresourcemanager.model.Policy;
+import com.google.api.services.cloudresourcemanager.model.SetIamPolicyRequest;
+import com.google.common.base.Ascii;
+import google.registry.config.CredentialModule.LocalCredential;
+import google.registry.config.RegistryConfig.Config;
+import google.registry.util.GoogleCredentialsBundle;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Optional;
+import javax.inject.Inject;
+import javax.inject.Singleton;
+
+@Singleton
+public class IamClient {
+  private static final String MEMBER_FORMAT = "user:%s";
+
+  private final CloudResourceManager resourceManager;
+  private final String projectId;
+
+  @Inject
+  public IamClient(
+      @LocalCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("projectId") String projectId) {
+    this(
+        new CloudResourceManager.Builder(
+                credentialsBundle.getHttpTransport(),
+                credentialsBundle.getJsonFactory(),
+                credentialsBundle.getHttpRequestInitializer())
+            .setApplicationName(projectId)
+            .build(),
+        projectId);
+  }
+
+  protected IamClient(CloudResourceManager resourceManager, String projectId) {
+    this.resourceManager = resourceManager;
+    this.projectId = projectId;
+  }
+
+  /**
+   * Bind the given role to the account.
+   *
+   * <p>No-op if the role is already bound to the account.
+   */
+  public void addBinding(String account, String role) {
+    String member = String.format(MEMBER_FORMAT, account);
+    Policy policy = getPolicy();
+    Binding binding =
+        policy.getBindings().stream()
+            .filter(b -> b.getRole().equals(role))
+            .findFirst()
+            .orElseGet(
+                () -> {
+                  Binding newBinding = new Binding().setRole(role).setMembers(new ArrayList<>());
+                  policy.getBindings().add(newBinding);
+                  return newBinding;
+                });
+    if (findMember(binding, member).isEmpty()) {
+      binding.getMembers().add(member);
+      setPolicy(policy);
+    }
+  }
+
+  /**
+   * Remove the given role to the account.
+   *
+   * <p>No-op if the role is not bound to the account.
+   */
+  public void removeBinding(String account, String role) {
+    String member = String.format(MEMBER_FORMAT, account);
+    Policy policy = getPolicy();
+    policy.getBindings().stream()
+        .filter(b -> b.getRole().equals(role))
+        .findFirst()
+        .ifPresent(
+            b ->
+                findMember(b, member)
+                    .ifPresent(
+                        m -> {
+                          b.getMembers().remove(m);
+                          if (b.getMembers().isEmpty()) {
+                            policy.getBindings().remove(b);
+                          }
+                          setPolicy(policy);
+                        }));
+  }
+
+  protected static Optional<String> findMember(Binding binding, String member) {
+    return binding.getMembers().stream()
+        // Standardize email addresses for comparison.
+        .filter(m -> Ascii.toLowerCase(m).equals(Ascii.toLowerCase(member)))
+        .findFirst();
+  }
+
+  private Policy getPolicy() {
+    try {
+      GetIamPolicyRequest request = new GetIamPolicyRequest();
+      return resourceManager.projects().getIamPolicy(projectId, request).execute();
+    } catch (IOException e) {
+      throw new RuntimeException(String.format("Cannot get policy for project %s", projectId), e);
+    }
+  }
+
+  private void setPolicy(Policy policy) {
+    try {
+      SetIamPolicyRequest request = new SetIamPolicyRequest();
+      request.setPolicy(policy);
+      resourceManager.projects().setIamPolicy(projectId, request).execute();
+    } catch (IOException e) {
+      throw new RuntimeException(
+          String.format("Cannot set policy %s for project %s", policy, projectId), e);
+    }
+  }
+}
--- a/core/src/main/java/google/registry/tools/RegistryToolComponent.java
+++ b/core/src/main/java/google/registry/tools/RegistryToolComponent.java
@@ -101,6 +101,10 @@ interface RegistryToolComponent {

  void inject(CreateRegistrarCommand command);

+  void inject(CreateUserCommand command);
+
+  void inject(DeleteUserCommand command);
+
  void inject(EncryptEscrowDepositCommand command);

  void inject(EnqueuePollMessageCommand command);
--- a/core/src/test/java/google/registry/tools/CreateUserCommandTest.java
+++ b/core/src/test/java/google/registry/tools/CreateUserCommandTest.java
@@ -15,7 +15,11 @@
 package google.registry.tools;

 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.tools.CreateUserCommand.IAP_SECURED_WEB_APP_USER_ROLE;
 import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;

 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
@@ -24,11 +28,19 @@ import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
 import google.registry.testing.DatabaseHelper;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

 /** Tests for {@link CreateUserCommand}. */
 public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {

+  private final IamClient iamClient = mock(IamClient.class);
+
+  @BeforeEach
+  void beforeEach() {
+    command.iamClient = iamClient;
+  }
+
  @Test
  void testSuccess() throws Exception {
    runCommandForced("--email", "user@example.test");
@@ -37,12 +49,16 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
    assertThat(onlyUser.getUserRoles().isAdmin()).isFalse();
    assertThat(onlyUser.getUserRoles().getGlobalRole()).isEqualTo(GlobalRole.NONE);
    assertThat(onlyUser.getUserRoles().getRegistrarRoles()).isEmpty();
+    verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
+    verifyNoMoreInteractions(iamClient);
  }

  @Test
  void testSuccess_admin() throws Exception {
    runCommandForced("--email", "user@example.test", "--admin", "true");
    assertThat(UserDao.loadUser("user@example.test").get().getUserRoles().isAdmin()).isTrue();
+    verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
+    verifyNoMoreInteractions(iamClient);
  }

  @Test
@@ -50,6 +66,8 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
    runCommandForced("--email", "user@example.test", "--global_role", "FTE");
    assertThat(UserDao.loadUser("user@example.test").get().getUserRoles().getGlobalRole())
        .isEqualTo(GlobalRole.FTE);
+    verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
+    verifyNoMoreInteractions(iamClient);
  }

  @Test
@@ -66,16 +84,21 @@ public class CreateUserCommandTest extends CommandTestCase<CreateUserCommand> {
                RegistrarRole.ACCOUNT_MANAGER,
                "NewRegistrar",
                RegistrarRole.PRIMARY_CONTACT));
+    verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
+    verifyNoMoreInteractions(iamClient);
  }

  @Test
  void testFailure_alreadyExists() throws Exception {
    runCommandForced("--email", "user@example.test");
+    verify(iamClient).addBinding("user@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
+    verifyNoMoreInteractions(iamClient);
    assertThat(
            assertThrows(
                IllegalArgumentException.class,
                () -> runCommandForced("--email", "user@example.test")))
        .hasMessageThat()
        .isEqualTo("A user with email user@example.test already exists");
+    verifyNoMoreInteractions(iamClient);
  }
 }
--- a/core/src/test/java/google/registry/tools/DeleteUserCommandTest.java
+++ b/core/src/test/java/google/registry/tools/DeleteUserCommandTest.java
@@ -15,17 +15,30 @@
 package google.registry.tools;

 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.tools.CreateUserCommand.IAP_SECURED_WEB_APP_USER_ROLE;
 import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.verifyNoMoreInteractions;

 import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserDao;
 import google.registry.model.console.UserRoles;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

 /** Tests for {@link DeleteUserCommand}. */
 public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {

+  private final IamClient iamClient = mock(IamClient.class);
+
+  @BeforeEach
+  void beforeEach() {
+    command.iamClient = iamClient;
+  }
+
  @Test
  void testSuccess_deletesUser() throws Exception {
    User user =
@@ -38,6 +51,8 @@ public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
    assertThat(UserDao.loadUser("email@example.test")).isPresent();
    runCommandForced("--email", "email@example.test");
    assertThat(UserDao.loadUser("email@example.test")).isEmpty();
+    verify(iamClient).removeBinding("email@example.test", IAP_SECURED_WEB_APP_USER_ROLE);
+    verifyNoMoreInteractions(iamClient);
  }

  @Test
@@ -48,5 +63,6 @@ public class DeleteUserCommandTest extends CommandTestCase<DeleteUserCommand> {
                () -> runCommandForced("--email", "nonexistent@example.test")))
        .hasMessageThat()
        .isEqualTo("Email does not correspond to a valid user");
+    verifyNoInteractions(iamClient);
  }
 }
--- a/core/src/test/java/google/registry/tools/IamClientTest.java
+++ b/core/src/test/java/google/registry/tools/IamClientTest.java
@@ -0,0 +1,195 @@
+// Copyright 2024 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.tools;
+
+import static com.google.common.truth.Truth.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.google.api.services.cloudresourcemanager.CloudResourceManager;
+import com.google.api.services.cloudresourcemanager.CloudResourceManager.Projects;
+import com.google.api.services.cloudresourcemanager.CloudResourceManager.Projects.GetIamPolicy;
+import com.google.api.services.cloudresourcemanager.CloudResourceManager.Projects.SetIamPolicy;
+import com.google.api.services.cloudresourcemanager.model.Binding;
+import com.google.api.services.cloudresourcemanager.model.GetIamPolicyRequest;
+import com.google.api.services.cloudresourcemanager.model.Policy;
+import com.google.api.services.cloudresourcemanager.model.SetIamPolicyRequest;
+import java.util.ArrayList;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+
+/** Unit tests for {@link IamClient}. */
+public class IamClientTest {
+  private final CloudResourceManager resourceManager = mock(CloudResourceManager.class);
+  private final String projectId = "my-project";
+  private final String account = "test@example.test";
+  private final String role = "roles/fakeRole";
+  private final IamClient client = new IamClient(resourceManager, projectId);
+  private final Projects projects = mock(Projects.class);
+  private final List<Binding> bindings = new ArrayList<>();
+
+  void setupRequests() throws Exception {
+    when(resourceManager.projects()).thenReturn(projects);
+    // Set up getPolicy()
+    GetIamPolicy getIamPolicy = mock(GetIamPolicy.class);
+    when(projects.getIamPolicy(eq(projectId), any(GetIamPolicyRequest.class)))
+        .thenReturn(getIamPolicy);
+    Policy policy = mock(Policy.class);
+    when(getIamPolicy.execute()).thenReturn(policy);
+    Binding nonMatchedBinding = mock(Binding.class);
+    when(nonMatchedBinding.getRole()).thenReturn("roles/nonRelatedRole");
+    bindings.add(nonMatchedBinding);
+    when(policy.getBindings()).thenReturn(bindings);
+
+    // Set up setPolicy()
+    SetIamPolicy setIamPolicy = mock(SetIamPolicy.class);
+    when(projects.setIamPolicy(eq(projectId), any(SetIamPolicyRequest.class)))
+        .thenReturn(setIamPolicy);
+  }
+
+  void verifySetPolicyRequest() throws Exception {
+    ArgumentCaptor<SetIamPolicyRequest> setPolicyRequest =
+        ArgumentCaptor.forClass(SetIamPolicyRequest.class);
+    verify(projects).setIamPolicy(eq(projectId), setPolicyRequest.capture());
+    assertThat(setPolicyRequest.getValue().getPolicy().getBindings()).isEqualTo(bindings);
+  }
+
+  @Test
+  void testSuccess_findUser() {
+    Binding binding = mock(Binding.class);
+    List<String> members = new ArrayList<>();
+    when(binding.getMembers()).thenReturn(members);
+    members.add("user:" + account);
+    members.add("serviceAccount:service@example.test");
+    assertThat(IamClient.findMember(binding, "user:" + account)).hasValue("user:" + account);
+    assertThat(IamClient.findMember(binding, "serviceAccount:" + account)).isEmpty();
+    // Make sure that the match is case-insensitive.
+    assertThat(IamClient.findMember(binding, "serviceAccount:SERVICE@example.test"))
+        .hasValue("serviceAccount:service@example.test");
+  }
+
+  @Test
+  void testSuccess_addBinding_noMatchedBindingExists() throws Exception {
+    setupRequests();
+    assertThat(bindings.size()).isEqualTo(1);
+    client.addBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(2);
+    Binding binding = bindings.get(1);
+    assertThat(binding.getRole()).isEqualTo(role);
+    assertThat(binding.getMembers()).containsExactly("user:" + account);
+    verifySetPolicyRequest();
+  }
+
+  @Test
+  void testSuccess_addBinding_matchBindingExists() throws Exception {
+    setupRequests();
+    Binding matchedBinding = mock(Binding.class);
+    when(matchedBinding.getRole()).thenReturn(role);
+    List<String> existingMembers = new ArrayList<>();
+    existingMembers.add("serviceAccount:service@example.test");
+    when(matchedBinding.getMembers()).thenReturn(existingMembers);
+    bindings.add(matchedBinding);
+    assertThat(bindings.size()).isEqualTo(2);
+    client.addBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(2);
+    assertThat(existingMembers)
+        .containsExactly("serviceAccount:service@example.test", "user:" + account);
+    verifySetPolicyRequest();
+  }
+
+  @Test
+  void testSuccess_addBinding_matchedBindingExists_memberExists() throws Exception {
+    setupRequests();
+    Binding matchedBinding = mock(Binding.class);
+    when(matchedBinding.getRole()).thenReturn(role);
+    List<String> existingMembers = new ArrayList<>();
+    existingMembers.add("serviceAccount:service@example.test");
+    existingMembers.add("user:" + account);
+    when(matchedBinding.getMembers()).thenReturn(existingMembers);
+    bindings.add(matchedBinding);
+    assertThat(bindings.size()).isEqualTo(2);
+    client.addBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(2);
+    assertThat(existingMembers)
+        .containsExactly("serviceAccount:service@example.test", "user:" + account);
+    verify(projects, never()).setIamPolicy(any(), any());
+  }
+
+  @Test
+  void testSuccess_removeBinding_noMatchedBindingExists() throws Exception {
+    setupRequests();
+    assertThat(bindings.size()).isEqualTo(1);
+    client.removeBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(1);
+    Binding binding = bindings.get(0);
+    assertThat(binding.getRole()).isEqualTo("roles/nonRelatedRole");
+    verify(projects, never()).setIamPolicy(any(), any());
+  }
+
+  @Test
+  void testSuccess_removeBinding_matchedBindingExists() throws Exception {
+    setupRequests();
+    Binding matchedBinding = mock(Binding.class);
+    when(matchedBinding.getRole()).thenReturn(role);
+    List<String> existingMembers = new ArrayList<>();
+    existingMembers.add("serviceAccount:service@example.test");
+    when(matchedBinding.getMembers()).thenReturn(existingMembers);
+    bindings.add(matchedBinding);
+    assertThat(bindings.size()).isEqualTo(2);
+    client.removeBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(2);
+    assertThat(existingMembers).containsExactly("serviceAccount:service@example.test");
+    verify(projects, never()).setIamPolicy(any(), any());
+  }
+
+  @Test
+  void testSuccess_removeBinding_matchedBindingExists_memberExisits() throws Exception {
+    setupRequests();
+    Binding matchedBinding = mock(Binding.class);
+    when(matchedBinding.getRole()).thenReturn(role);
+    List<String> existingMembers = new ArrayList<>();
+    existingMembers.add("serviceAccount:service@example.test");
+    existingMembers.add("user:" + account);
+    when(matchedBinding.getMembers()).thenReturn(existingMembers);
+    bindings.add(matchedBinding);
+    assertThat(bindings.size()).isEqualTo(2);
+    client.removeBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(2);
+    assertThat(existingMembers).containsExactly("serviceAccount:service@example.test");
+    verifySetPolicyRequest();
+  }
+
+  @Test
+  void testSuccess_removeBinding_matchedBindingExists_onlyMemberExisits() throws Exception {
+    setupRequests();
+    Binding matchedBinding = mock(Binding.class);
+    when(matchedBinding.getRole()).thenReturn(role);
+    List<String> existingMembers = new ArrayList<>();
+    existingMembers.add("user:" + account);
+    when(matchedBinding.getMembers()).thenReturn(existingMembers);
+    bindings.add(matchedBinding);
+    assertThat(bindings.size()).isEqualTo(2);
+    client.removeBinding(account, role);
+    assertThat(bindings.size()).isEqualTo(1);
+    assertThat(existingMembers).isEmpty();
+    assertThat(bindings.get(0).getRole()).isEqualTo("roles/nonRelatedRole");
+    verifySetPolicyRequest();
+  }
+}
--- a/db/gradle.lockfile
+++ b/db/gradle.lockfile
@@ -23,15 +23,15 @@ com.github.jnr:jnr-x86asm:1.0.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.api-client:google-api-client:2.4.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.api:gax:2.46.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-credentials:1.23.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auth:google-auth-library-oauth2-http:1.23.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.10.4=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.auto.value:auto-value-annotations:1.9=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto:auto-common:1.2.1=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.code.findbugs:jsr305:3.0.2=annotationProcessor,checkstyle,deploy_jar,errorprone,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.code.gson:gson:2.10.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.errorprone:error_prone_annotation:2.23.0=annotationProcessor,errorprone,testAnnotationProcessor
@@ -118,7 +118,7 @@ org.postgresql:postgresql:42.7.3=deploy_jar,runtimeClasspath,testRuntimeClasspat
 org.reflections:reflections:0.10.2=checkstyle
 org.rnorth.duct-tape:duct-tape:1.0.8=testCompileClasspath,testRuntimeClasspath
 org.slf4j:slf4j-api:1.7.36=testCompileClasspath
-org.slf4j:slf4j-api:2.0.12=deploy_jar,runtimeClasspath,testRuntimeClasspath
+org.slf4j:slf4j-api:2.0.13=deploy_jar,runtimeClasspath,testRuntimeClasspath
 org.testcontainers:database-commons:1.19.7=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:jdbc:1.19.7=testCompileClasspath,testRuntimeClasspath
 org.testcontainers:junit-jupiter:1.19.7=testCompileClasspath,testRuntimeClasspath
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -121,6 +121,7 @@ ext {
      'com.google.apis:google-api-services-dataflow:[v1b3-rev302-1.25.0,)',
      'com.google.apis:google-api-services-gmail:[v1-rev20220404-2.0.0,)',
      'com.google.apis:google-api-services-groupssettings:[v1-rev82-1.25.0,)',
+      'com.google.apis:google-api-services-iam:[v1-rev20240118-2.0.0,0)',
      'com.google.apis:google-api-services-monitoring:[v3-rev540-1.25.0,)',
      'com.google.apis:google-api-services-sheets:[v4-rev612-1.25.0,)',
      'com.google.apis:google-api-services-storage:[v1-rev20210127-1.31.0,)',
--- a/jetty/gradle.lockfile
+++ b/jetty/gradle.lockfile
@@ -82,11 +82,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=deploy_jar,runtimeCla
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -105,8 +106,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=deploy_jar,runtimeClasspath,testRuntime
 com.google.cloud.bigdataoss:util:2.2.16=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/networking/gradle.lockfile
+++ b/networking/gradle.lockfile
@@ -97,16 +97,16 @@ io.grpc:grpc-services:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-util:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-xds:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.65.Final=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.65.Final=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/prober/gradle.lockfile
+++ b/prober/gradle.lockfile
@@ -100,16 +100,16 @@ io.grpc:grpc-services:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-util:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-xds:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.65.Final=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.65.Final=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/proxy/gradle.lockfile
+++ b/proxy/gradle.lockfile
@@ -26,7 +26,7 @@ com.google.api:gax-grpc:2.46.1=compileClasspath,deploy_jar,runtimeClasspath,test
 com.google.api:gax-httpjson:2.46.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.api:gax:2.46.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-cloudkms:v1-rev20240314-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240311-2.0.0=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=deploy_jar,runtimeClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=deploy_jar,runtimeClasspath,testRuntimeClasspath
@@ -116,16 +116,16 @@ io.grpc:grpc-services:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-stub:1.62.2=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.grpc:grpc-util:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
 io.grpc:grpc-xds:1.62.2=deploy_jar,runtimeClasspath,testRuntimeClasspath
-io.netty:netty-buffer:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec-http:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-codec:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-common:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-handler:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-resolver:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-buffer:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec-http:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-codec:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-common:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-handler:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-resolver:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-boringssl-static:2.0.65.Final=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.netty:netty-tcnative-classes:2.0.65.Final=deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport-native-unix-common:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.netty:netty-transport:4.1.108.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+io.netty:netty-transport:4.1.109.Final=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-api:0.31.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-contrib-http-util:0.31.1=compileClasspath,deploy_jar,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.opencensus:opencensus-proto:0.2.0=deploy_jar,runtimeClasspath,testRuntimeClasspath
--- a/services/backend/gradle.lockfile
+++ b/services/backend/gradle.lockfile
@@ -81,11 +81,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,runt
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=runtimeClasspath,testRuntimeClasspath
@@ -101,8 +102,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,runtimeClasspath,testC
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/bsa/gradle.lockfile
+++ b/services/bsa/gradle.lockfile
@@ -81,11 +81,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,runt
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=runtimeClasspath,testRuntimeClasspath
@@ -101,8 +102,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,runtimeClasspath,testC
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/default/gradle.lockfile
+++ b/services/default/gradle.lockfile
@@ -81,11 +81,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,runt
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=runtimeClasspath,testRuntimeClasspath
@@ -101,8 +102,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,runtimeClasspath,testC
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/pubapi/gradle.lockfile
+++ b/services/pubapi/gradle.lockfile
@@ -81,11 +81,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,runt
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=runtimeClasspath,testRuntimeClasspath
@@ -101,8 +102,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,runtimeClasspath,testC
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
--- a/services/tools/gradle.lockfile
+++ b/services/tools/gradle.lockfile
@@ -81,11 +81,12 @@ com.google.apis:google-api-services-drive:v2-rev393-1.25.0=compileClasspath,runt
 com.google.apis:google-api-services-gmail:v1-rev20231218-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-groupssettings:v1-rev20210624-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-healthcare:v1-rev20240130-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-iam:v2-rev20240314-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-iamcredentials:v1-rev20211203-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-monitoring:v3-rev20240303-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-monitoring:v3-rev20240414-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-pubsub:v1-rev20220904-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sheets:v4-rev20240319-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.apis:google-api-services-sqladmin:v1beta4-rev20240304-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sheets:v4-rev20240402-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.apis:google-api-services-sqladmin:v1beta4-rev20240324-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.apis:google-api-services-storage:v1-rev20240205-2.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-1.0-sdk:2.0.26=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.appengine:appengine-api-stubs:2.0.26=runtimeClasspath,testRuntimeClasspath
@@ -101,8 +102,8 @@ com.google.cloud.bigdataoss:gcsio:2.2.16=compileClasspath,runtimeClasspath,testC
 com.google.cloud.bigdataoss:util:2.2.16=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.bigtable:bigtable-client-core-config:1.28.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud.datastore:datastore-v1-proto-client:2.18.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:jdbc-socket-factory-core:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.cloud.sql:postgres-socket-factory:1.17.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:jdbc-socket-factory-core:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.cloud.sql:postgres-socket-factory:1.18.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigquerystorage:3.1.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable-stats:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.google.cloud:google-cloud-bigtable:2.33.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath