'~SrSSKJr SSKJr SSKJr SSKJr SSKJr SSKJ r SSK J r SS K J r SS K Jr S rS rS rSrSrSrSrSrSrSrSrSrSrSrSrSrSrSr Sr!Sr"Sr#S r$S!r%S"r&S#r'S$r(S%r)S&r*S'r+S(r,S)r-S*r.S+r/S,r0S-r1S.r2S/r3S0r4S1r5S2r6S3r7S4r8S5r9S6r:S7r;S8rS;r?S<r@S=rAS>rBS?rCS@rDSArESBrFSCrGSDrHSErISFrJSGrKSHrLSIrMSJrNSKrOSLrPSMrQSNrRSOrSSPrTSQrUSRrVSSrWSTrXSUrYSVrZSWr[SXr\SYr]SZr^S[r_S\r`S]raS^rbS_rcS`rdSaregb)cz!Flags for commands in cloudasset.)absolute_import)division)unicode_literals) arg_parsers)base) yaml_data) common_args) resource_args)concept_parserscURH*nUR(dMURU:XdM(Us $ URU5$)zECreate a new arg group or return existing group with given help text.) argumentsis_grouphelpadd_argument_group)parser help_textargs -lib/googlecloudsdk/command_lib/asset/flags.py_GetOrAddArgGrouprs>   c |||I- j  " "9 --c[US5$)NzThe analysis options.)rrs rGetOrAddOptionGroupr%s 6#: ;;rc&URSSUS9 g)Nz--organizationORGANIZATION_IDmetavarr add_argumentrrs rAddOrganizationArgsr!)s 1 Crc&URSSUS9 g)Nz--folder FOLDER_IDrrr s r AddFolderArgsr$.sj+IFrc&URSSUS9 g)Nz --project PROJECT_IDrrr s rAddProjectArgsr'2sksI44d4C,+,#$#$rcVURS[RRSS9 g)Nz--snapshot-timeagTimestamp to take a snapshot on assets. This can only be a current or past time. If not specified, the current time will be used. Due to delays in resource data collection and indexing, there is a volatile window during which running the same query at different times may return different results. See $ gcloud topic datetimes for information on time formats.typerrrDatetimeParsers rAddSnapshotTimeArgsr=Os.    % % LNrcPURSS[R"5/SS9 g)N --asset-types ASSET_TYPESaA list of asset types (i.e., "compute.googleapis.com/Disk") to take a snapshot. If specified and non-empty, only assets matching the specified types will be returned. See http://cloud.google.com/asset-inventory/docs/supported-asset-types for supported asset types.rr9defaultrrrArgListrs rAddAssetTypesArgsrE[s/     (  *rcPURSS[R"5/SS9 g)N--relationship-typesRELATIONSHIP_TYPESa]A list of relationship types (i.e., "INSTANCE_TO_INSTANCEGROUP") to take a snapshot. This argument will only be honoured if content_type=RELATIONSHIP. If specified and non-empty, only relationships matching the specified types will be returned. See http://cloud.google.com/asset-inventory/docs/supported-asset-types for supported relationship types.rArCrs rAddRelationshipTypesArgsrIis/"     /  1rcNU(aSnOSnUS- nURSU/SQUS9 g)z9--content-type argument for asset export and get-history.zAsset content type.zAsset content type. If specified, only content matching the specified type will be returned. Otherwise, no content but the asset name will be returned.a Specifying `resource` will export resource metadata, specifying `iam-policy` will export the IAM policy for each child asset, specifying `org-policy` will export the Org Policy set on child assets, specifying `access-policy` will export the Access Policy set on child assets, specifying `os-inventory` will export the OS inventory of VM instances, and specifying `relationship` will export relationships of the assets.--content-typeresourcez iam-policyz org-policyz access-policyz os-inventory relationship)r*choicesrNr)rr*rs rAddContentTypeArgsrPxsJ &I ' )  rc TURSSU[R"SS5SS9 g)Nz --output-path OUTPUT_PATH^gs://.*zs--output-path must be a Google Cloud Storage URI starting with "gs://". For example, "gs://bucket_name/object_name"z|Google Cloud Storage URI where the results will go. URI must start with "gs://". For example, "gs://bucket_name/object_name"rr*r9rrrRegexpValidatorrr*s rAddOutputPathArgsrXs<  & &  A B Q rcPURS[R"SS5SS9 g)Nz--output-path-prefixz ^gs://.*/.*z--output-path-prefix must be a Google Cloud Storage URI starting with "gs://". For example, "gs://bucket_name/object_name_prefix"a&Google Cloud Storage URI where the results will go. URI must start with "gs://". For example, "gs://bucket_name/object_name_prefix", in which case each exported object uri is in format: "gs://bucket_name/object_name_prefix//" and it only contains assets for that type.r8rUrs rAddOutputPathPrefixArgsrZs5  & &  M N  7 9rc .URSSSS9n[RRS5nUR 5nUSnUHnUSS:XdMSUS'M [ R "S S S SSUS 9/n[R"U5RU5 [R"S SSSSSS9RU5 [R"SSSSSSS9RU5 [R"SSSS/SS9RU5 g)z/Add BigQuery destination args to argument list.Fz.The BigQuery destination for exporting assets.mutexr*rbq.table attributesattribute_namedatasetbigquery-datasetz export tobigquery-tableTverbnamer*prefixes positional resource_dataz--output-bigquery-force store_trueforce_zIf the destination table already exists and this flag is specified, the table will be overwritten by the contents of assets snapshot. If the flag is not specified and the destination table already exists, the export call returns an error.)actiondestrBr*rz--per-asset-type per_type_zIf the flag is specified, the snapshot results will be written to one or more tables, each of which contains results of one asset type.z--partition-keyz read-timez request-timezIf specified. the snapshot results will be written to partitioned table(s) with two additional timestamp columns, readTime and requestTime, one of which will be the partition key.)r*rOhelp_strN) add_grouprResourceYAMLDataFromPathGetDatar GetResourcePresentationSpecr ConceptParserr.rArgumentChoiceArgumentrbigquery_grouprM table_dicr_attr arg_specss rAddOutputPathBigQueryArgsr}s=##  ;$=. ' ' 0 0 <( )&*d *1d //! #) *66~F--   . 01< N0K--    (K7N+ A   ^ $rcfURSSSS9n[USS9 [U5 [U5 g)NTz*The destination path for exporting assets.r\Fr))rprXrZr}rdestination_groups rAddDestinationArgsrs@&&  7'9%6+,-.rcPURSSS[R"5SS9 g)N --asset-names ASSET_NAMESTzA list of full names of the assets to get the history for. For more information, see: https://cloud.google.com/apis/design/resource_names#full_resource_name rTrCrs rAddAssetNamesArgsrs0     T   rcXURSS[RRSS9 g)Nz --start-timeTzStart time of the time window (inclusive) for the asset history. Must be after the current time minus 35 days. See $ gcloud topic datetimes for information on time formats.r*r9rr:rs rAddStartTimeArgsrs/    % % 9 ;rcXURSS[RRSS9 g)Nz --end-timeFzEnd time of the time window (exclusive) for the asset history. Defaults to current time if not specified. See $ gcloud topic datetimes for information on time formats.rr:rs rAddEndTimeArgsrs1    % % L Nrc&URSSSS9 g)NidOPERATION_NAMEz"Name of the operation to describe.rrrs rAddOperationArgsrs $+OQrc.SnURS/SQUS9 g)NzAsset content type. If not specified, no content but the asset name and type will be returned in the feed. For more information, see https://cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds#ContentTyperKrLrOrrr s rAddListContentTypeArgsrs/Z    rc&URSSUS9 g)Nquery_idQUERY_IDrr)rquery_id_help_texts rAddSavedQueriesQueryIdr&s*+=?rc(SnURSXS9 g)Nz2Path to JSON or YAML file that contains the query.z--query-file-path)r*rr)r is_requiredquery_file_path_help_texts rAddSavedQueriesQueryFilePathr+s#:KQrc(SnURSUS9 g)NzA string describing the query.z --descriptionrr)rdescription_help_texts rAddSavedQueriesQueryDescriptionr2s & o,ABrc&URSSUS9 g)NfeedFEED_IDrrr s r AddFeedIdArgsr9sfii@rc$URSUS9 g)Nrfrrr s rAddFeedNameArgsr=sf9-rcPURSS[R"5/SS9 g)Nr?r@aOA comma-separated list of types of the assets types to receive updates. For example: `compute.googleapis.com/Disk,compute.googleapis.com/Network`. Regular expressions (https://github.com/google/re2/wiki/Syntax) are also supported. For more information, see: https://cloud.google.com/resource-manager/docs/cloud-asset-inventory/overviewrArCrs rAddFeedAssetTypesArgsrAs0     Z   rcPURSS[R"5/SS9 g)NrGrHaA comma-separated list of the relationship types (i.e., "INSTANCE_TO_INSTANCEGROUP") to receive updates. This argument will only be honoured if content_type=RELATIONSHIP.See http://cloud.google.com/asset-inventory/docs/supported-asset-types for supported relationship types.rArCrs rAddFeedRelationshipTypesArgsrQs/"     /  1rcPURSS[R"5/SS9 g)Nrra A comma-separated list of the full names of the assets to receive updates. For example: `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. For more information, see: https://cloud.google.com/apis/design/resource_names#full_resource_namerArCrs rAddFeedAssetNamesArgsr_s0     o   rcfURSSS9n[U5 [U5 [U5 g)NFT)r]r*)rprrrr5s rAddFeedCriteriaArgsrms/!!!=, % %|,rc*URS/SQUS9 g)NrKrLrrr s rFeedContentTypeArgsrts"  rcSn[X5 g)NzAsset content type. If not specified, no content but the asset name and type will be returned in the feed. For more information, see https://cloud.google.com/resource-manager/docs/cloud-asset-inventory/overview#asset_content_typerr s rAddFeedContentTypeArgsr~i f(rc(URSSUSS9 g)Nz--pubsub-topic PUBSUB_TOPICzName of the Cloud Pub/Sub topic to publish to, of the form `projects/PROJECT_ID/topics/TOPIC_ID`. You can list existing topics with `gcloud pubsub topics list --format="text(name)"`)rr*rrrWs rAddFeedPubSubTopicArgsrs% @ BrcSn[X5 g)NzAsset content type to overwrite the existing one. For more information, see: https://cloud.google.com/resource-manager/docs/cloud-asset-inventory/overview#asset_content_typerr s rAddChangeFeedContentTypeArgsrrrc&URSSSS9 g)Nz--clear-content-typerjzClear any existing content type setting on the feed. Content type will be unspecified, no content but the asset name and type will be returned in the feed.rlrrrs rAddClearFeedContentTypeArgsrs"  EGrcNURSS9n[U5 [U5 gNT)r])rprrr5s rAddUpdateFeedContentTypeArgsrs%!!!-,|,l+rc$URSUS9 g)Nz--condition-expressionrrr s rFeedConditionExpressionArgsrs.Y?rcSn[X5 g)NzFeed condition expression. If not specified, no condition will be applied to feed. For more information, see: https://cloud.google.com/asset-inventory/docs/monitoring-asset-changes#feed_with_conditionrr s rAddFeedConditionExpressionArgsrc f0rcSn[X5 g)NzCondition expression to overwrite the existing one. For more information, see: https://cloud.google.com/asset-inventory/docs/monitoring-asset-changes#feed_with_conditionrr s r$AddChangeFeedConditionExpressionArgsrrrc&URSSSS9 g)Nz--clear-condition-expressionrjzbClear any existing condition expression setting on the feed. No condition will be applied to feed.rrrs r#AddClearFeedConditionExpressionArgsrs $  46rcNURSS9n[U5 [U5 gr)rprrr5s r$AddUpdateFeedConditionExpressionArgsrs%!!!-,&|4%l3rc$URSUS9 g)Nz--condition-titlerrr s rFeedConditionTitleArgsrs) :rcSn[X5 g)Nz0Title of the feed condition. For reference only.rr s rAddFeedConditionTitleArgsrsA)+rcSn[X5 g)Nz.Condition title to overwrite the existing one.rr s rAddChangeFeedConditionTitleArgsrs?)+rc&URSSSS9 g)Nz--clear-condition-titlerjzVClear any existing condition title setting on the feed. Condition title will be empty.rrrs rAddClearFeedConditionTitleArgsrs   -/rcNURSS9n[U5 [U5 gr)rprrr5s rAddUpdateFeedConditionTitleArgsrs%!!!-,!,/ .rc$URSUS9 g)Nz--condition-descriptionrrr s rFeedConditionDescriptionArgsrs/i@rcSn[X5 g)Nz6Description of the feed condition. For reference only.rr s rAddFeedConditionDescriptionArgsrsG)v1rcSn[X5 g)Nz4Condition description to overwrite the existing one.rr s r%AddChangeFeedConditionDescriptionArgsrsE)v1rc&URSSSS9 g)Nz--clear-condition-descriptionrjzbClear any existing condition description setting on the feed. Condition description will be empty.rrrs r$AddClearFeedConditionDescriptionArgsrs %  35rcNURSS9n[U5 [U5 gr)rprrr5s r%AddUpdateFeedConditionDescriptionArgsrs%!!!-,' 5&|4rc$URSSS9 g)Nz--full-resource-namezThe full resource name.rrrs rAddAnalyzerFullResourceNameArgsrs,3LMrc<URSSSS9n[U5 g)NFz>Specifies a resource for analysis. Leaving it empty means ANY.r\)rpr)rresource_selector_groups r AddAnalyzerResourceSelectorGrouprs-",,  K-M""9:rc$URSSS9 g)Nz --identityzKThe identity appearing in the form of principals in the IAM policy binding.rrrs rAddAnalyzerIdentityArgsrs rc<URSSSS9n[U5 g)NFz?Specifies an identity for analysis. Leaving it empty means ANY.r\)rpr)ridentity_selector_groups r AddAnalyzerIdentitySelectorGroupr"s-",,  L-N12rcNURSS[R"5SS9 g)Nz--rolesROLESz"The roles to appear in the result.rr9rrCrs rAddAnalyzerRolesArgsr*s*    / 1rcNURSS[R"5SS9 g)Nz --permissions PERMISSIONSz(The permissions to appear in the result.rrCrs rAddAnalyzerPermissionsArgsr2s*    5 7rcRURSSSS9n[U5 [U5 g)NFzHSpecifies roles or permissions for analysis. Leaving it empty means ANY.r\)rprr)raccess_selector_groups rAddAnalyzerAccessSelectorGroupr:s7 **  + ,-23rcF[U5 [U5 [U5 g)N)rrrrs rAddAnalyzerSelectorsGrouprDs"6*"6* (rcDURSSSS9 URSS9 g)Nz--expand-groupsrjzIf true, the identities section of the result will expand any Google groups appearing in an IAM policy binding. Default is false.rF) expand_groupsr set_defaultsrs rAddAnalyzerExpandGroupsArgsrJs4  P   E*rcDURSSSS9 URSS9 g)Nz--expand-rolesrjzIf true, the access section of result will expand any roles appearing in IAM policy bindings to include their permissions. Default is false.rF) expand_rolesrrs rAddAnalyzerExpandRolesArgsrUs3  "  5)rcDURSSSS9 URSS9 g)Nz--expand-resourcesrjzIf true, the resource section of the result will expand any resource attached to an IAM policy to include resources lower in the resource hierarchy. Default is false.rF)expand_resourcesrrs rAddAnalyzerExpandResourcesArgsr_s3  8:  u-rcDURSSSS9 URSS9 g)Nz--output-resource-edgesrjzlIf true, the result will output the relevant parent/child relationships between resources. Default is false.rF)output_resource_edgesrrs r"AddAnalyzerOutputResourceEdgesArgsris3  "  E2rcDURSSSS9 URSS9 g)Nz--output-group-edgesrjzgIf true, the result will output the relevant membership relationships between groups. Default is false.rF)output_group_edgesrrs rAddAnalyzerOutputGroupEdgesArgsrss3  "  /rcLURS[R"5SS9 g)Nz--execution-timeoutzThe amount of time the executable has to complete. See JSON representation of [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json). Deafult is empty. r8rrDurationrs rAddAnalyzerExecutionTimeoutr }s)    !  !rcDURSSSS9 URSS9 g)Nz--show-responserjzAIf true, the response will be showed as-is in the command output.rF) show_responserrs r#AddAnalyzerShowAccessControlEntriesr s2  M P  E*rcDURSSSS9 URSS9 g)z`Adds analyze service account impersonation arg into options. Args: parser: the option group. z'--analyze-service-account-impersonationrjaIf true, the response will include access analysis from identities to resources via service account impersonation. This is a very expensive operation, because many derived queries will be executed. We highly recommend you use AnalyzeIamPolicyLongrunning rpc instead. Default is false.rF)%analyze_service_account_impersonationNrrs r1AddAnalyzerAnalyzeServiceAccountImpersonationArgsrs5 /   ! EBrcDURSSSS9 URSS9 g)zWAdds include deny policy analysis arg into options. Args: parser: the option group. z--include-deny-policy-analysisrjzIf true, the response will include analysis for deny policies.This is a very expensive operation, because many derived queries will be executed.rF)include_deny_policy_analysisNrrs r(AddAnalyzerIncludeDenyPolicyAnalysisArgsrs5 &    59rc[U5n[U5 [U5 [U5 [ U5 [ U5 [ U5 U(a[U5 [U5 gg)Adds a group of options.N) rrrrrrrr r )ris_sync options_groups rAddAnalyzerOptionsGrouprsT%f--m,]+ /$]3!-03MB  .' 6 rcVURS[RRSS9 g)Nz --access-timez=The hypothetical access timestamp to evaluate IAM conditions.r8r:rs rAddAnalyzerAccessTimeArgsrs+    % % KNrcJURSSSS9nSnURSUS9 g)zAdds a saved analysis query.Fz-Specifies the name of a saved analysis query.r\aThe name of a saved query. When a `saved_analysis_query` is provided, its query content will be used as the base query. Other flags' values will override the base query to compose the final query to run. IDs might be in one of the following formats: * projects/project_number/savedQueries/saved_query_id* folders/folder_number/savedQueries/saved_query_id* organizations/organization_number/savedQueries/saved_query_idz--saved-analysis-queryrN)rpr)rrtexts r!AddAnalyzerSavedAnalysisQueryArgsrsB",,  :-< H&&'?d&Krc<URSSSS9n[U5 g)rFz4The hypothetical context to evaluate IAM conditions.r\N)rpr)rcondition_context_groups r AddAnalyzerConditionContextGroupr s-",,  A-C34rc$URSSS9 g)zAdds the sql statement.z --statementaA BigQuery Standard SQL compatible statement. If the query execution finishes within timeout and there is no pagination, the full query results will be returned. Otherwise, pass job_reference from previous call as `--job-reference` to obtain the full results.rNrrs rAddStatementArgsr"s KMrc$URSSS9 g)z Adds the previous job reference.z--job-referencezrTs(&'/(:<>D.<C GI0$" N * 16  9 3%l/  ;NQ ? QCA.  1  -)B)G, @1164 ;, , // A2 2 55 N;3174) +*.30!+C&:& 7NL$5MM# J  $$& R1" >&$  r