S r SSKJr SSKJr SSKJr SSKJr Sr " S S\R 5 r " S S
\R 5 r " S S \R 5 r
" S
S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S\R 5 r " S S \R 5 r " S S \R 5 r " S S \R 5 r " S! S"\R 5 r " S# S$\R 5 r " S% S&\R 5 r " S' S(\R 5 r " S) S*\R 5 r " S+ S,\R 5 r " S- S.\R 5 r " S/ S0\R 5 r " S1 S2\R 5 r " S3 S4\R 5 r! " S5 S6\R 5 r" " S7 S8\R 5 r# " S9 S:\R 5 r$ " S; S<\R 5 r% " S= S>\R 5 r& " S? S@\R 5 r' " SA SB\R 5 r( " SC SD\R 5 r) " SE SF\R 5 r* " SG SH\R 5 r+ " SI SJ\R 5 r, " SK SL\R 5 r- " SM SN\R 5 r. " SO SP\R 5 r/ " SQ SR\R 5 r0 " SS ST\R 5 r1 " SU SV\R 5 r2 " SW SX\R 5 r3 " SY SZ\R 5 r4 " S[ S\\R 5 r5 " S] S^\R 5 r6 " S_ S`\R 5 r7 " Sa Sb\R 5 r8 " Sc Sd\R 5 r9 " Se Sf\R 5 r: " Sg Sh\R 5 r; " Si Sj\R 5 r< " Sk Sl\R 5 r= " Sm Sn\R 5 r> " So Sp\R 5 r? " Sq Sr\R 5 r@ " Ss St\R 5 rA " Su Sv\R 5 rB " Sw Sx\R 5 rC " Sy Sz\R 5 rD " S{ S|\R 5 rE " S} S~\R 5 rF " S S\R 5 rG " S S\R 5 rH " S S\R 5 rI " S S\R 5 rJ " S S\R 5 rK " S S\R 5 rL " S S\R 5 rM " S S\R 5 rN " S S\R 5 rO " S S\R 5 rP " S S\R 5 rQ " S S\R 5 rR " S S\R 5 rS " S S\R 5 rT " S S\R 5 rU " S S\R 5 rV " S S\R 5 rW " S S\R 5 rX " S S\R 5 rY " S S\R 5 rZ " S S\R 5 r[ " S S\R 5 r\ " S S\R 5 r] " S S\R 5 r^ " S S\R 5 r_ " S S\R 5 r` " S S\R 5 ra " S S\R 5 rb " S S\R 5 rc " S S\R 5 rd " S S\R 5 re " S S\R 5 rf " S S\R 5 rg " S S\R 5 rh " S S\R 5 ri " S S\R 5 rj " S S\R 5 rk " S S\R 5 rl " S S\R 5 rm " S S\R 5 rn " S S\R 5 ro " S S\R 5 rp " S S\R 5 rq\R " \hSS5 \R " \hR SS5 \R " \hR SS5 g)a Generated message classes for accesscontextmanager version v1alpha.
An API for setting attribute based access control to requests to Google Cloud
services. *Warning:* Do not mix *v1alpha* and *v1* API usage in the same
access policy. The v1alpha API supports new Access Context Manager features,
which may have different attributes or behaviors that are not supported by v1.
The practice of mixed API usage within a policy may result in the inability to
update that policy, including any access levels or service perimeters
belonging to it. It is not recommended to use both v1 and v1alpha for
modifying policies with critical service perimeters. Modifications using
v1alpha should be limited to policies with non-production/non-critical service
perimeters.
)absolute_import)messages)encoding) extra_typesaccesscontextmanagerc \ rS rSrSrSrg)%AccessContextManagerOperationMetadata z=Metadata of Access Context Manager's Long Running Operations. N)__name__
__module__ __qualname____firstlineno____doc____static_attributes__r olib/googlecloudsdk/generated_clients/apis/accesscontextmanager/v1alpha/accesscontextmanager_v1alpha_messages.pyr r s Fr r c \ rS rSrSr\R " SS5 r\R " SS5 r\R " SS5 r \R " S 5 r \R " S
5 r \R " S 5 r
S rg
) AccessLevel a An `AccessLevel` is a label that can be applied to requests to Google
Cloud services, along with a list of requirements necessary for the label to
be applied.
Fields:
accessLevelFeatures: Output only. Access level features that are used to
determine the behavior of the access level.
basic: A `BasicLevel` composed of `Conditions`.
custom: A `CustomLevel` written in the Common Expression Language.
description: Description of the `AccessLevel` and its use. Does not affect
behavior.
name: Identifier. Resource name for the `AccessLevel`. Format:
`accessPolicies/{access_policy}/accessLevels/{access_level}`. The
`access_level` component must begin with a letter, followed by
alphanumeric characters or `_`. Its maximum length is 50 characters.
After you create an `AccessLevel`, you cannot change its `name`.
title: Human readable title. Must be unique within the Policy.
AccessLevelFeatures
BasicLevel CustomLevel r N)r r
r r r _messages MessageFieldaccessLevelFeaturesbasiccustom StringField descriptionnametitler r r r r r sq & "../DaH
q
1% ! !- 3&%%a(+ q !$
"%r r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r : a Fields capturing features about the access level. Output only.
Fields:
canBeNested: Output only. Indicates that the access level is able to be
nested in other access levels.
hasAmendableConditions: Output only. Indicates whether there is a
amendable response defined within access level conditions. Set to false
if deny is the only configured result for all conditions.
r r r N)
r r
r r r r BooleanField canBeNestedhasAmendableConditionsr r r r r r : s* &&q)+$11!4r r c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " SSS9r
\R " S 5 r S
r g ) AccessPolicyI a `AccessPolicy` is a container for `AccessLevels` (which define the
necessary attributes to use Google Cloud services) and `ServicePerimeters`
(which define regions of services able to freely pass data within a
perimeter). An access policy is globally visible within an organization, and
the restrictions it specifies apply to all projects within an organization.
Fields:
etag: Output only. An opaque identifier for the current version of the
`AccessPolicy`. This will always be a strongly validated etag, meaning
that two Access Policies will be identical if and only if their etags
are identical. Clients should not expect this to be in any specific
format.
name: Identifier. Resource name of the `AccessPolicy`. Format:
`accessPolicies/{access_policy}`
parent: Immutable. The parent of this `AccessPolicy` in the Cloud Resource
Hierarchy Format: `organizations/{organization_id}`
scopes: The scopes of the AccessPolicy. Scopes define which resources a
policy can restrict and where its resources can be referenced. For
example, policy A with `scopes=["folders/123"]` has the following
behavior: - ServicePerimeter can only restrict projects within
`folders/123`. - ServicePerimeter within policy A can only reference
access levels defined within policy A. - Only one policy can include a
given scope; thus, attempting to create a second policy which includes
`folders/123` will result in an error. If no scopes are provided, then
any resource within the organization can be restricted. Scopes cannot be
modified after a policy is created. Policies can only have a single
scope. Format: list of `folders/{folder_number}` or
`projects/{project_number}`
title: Required. Human readable title. Does not affect behavior.
r r r r Trepeatedr r N)
r r
r r r r r% etagr' parentscopesr( r r r r r/ r/ I s[ >
q !$ q !$ #& T 2&
"%r r/ c > \ rS rSrSr\R " SS5 rSrg) AccessScopep zAccess scope represents the client scope, etc. to which the settings
will be applied to.
Fields:
clientScope: Optional. Client scope for this access scope.
ClientScoper r N) r r
r r r r r! clientScoper r r r r7 r7 p s &&}a8+r r7 c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
AccessSettings{ a Access settings represent the set of conditions that must be met for
access to be granted. At least one of the fields must be set.
Fields:
accessLevels: Optional. Access level that a user must have to be granted
access. Only one access level is supported, not multiple. This repeated
field must have exactly one element. Example:
"accessPolicies/9522/accessLevels/device_trusted"
sessionSettings: Optional. Session settings applied to user access on a
given AccessScope.
r Tr1 SessionSettingsr r N) r r
r r r r r% accessLevelsr! sessionSettingsr r r r r< r< { s.
&&q48, **+ A AccesscontextmanagerAccessPoliciesAccessLevelsReplaceAllRequest
object.
Fields:
parent: Required. Resource name for the access policy which owns these
Access Levels. Format: `accessPolicies/{policy_id}`
replaceAccessLevelsRequest: A ReplaceAccessLevelsRequest resource to be
passed as the request body.
r TrD ReplaceAccessLevelsRequestr r N) r r
r r r r r% r4 r! replaceAccessLevelsRequestr r r r rl rl s0 T 2& ( 5 56RTU V r rl c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
GAccesscontextmanagerAccessPoliciesAccessLevelsTestIamPermissionsRequesti a A
AccesscontextmanagerAccessPoliciesAccessLevelsTestIamPermissionsRequest
object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r TrD TestIamPermissionsRequestr r N r r
r r r r r% resourcer! testIamPermissionsRequestr r r r rp rp 0
"
"1t
4( ' 4 45PRS Tr rp c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
BAccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsCreateRequesti/ a7 A AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsCreateRequest
object.
Fields:
authorizedOrgsDesc: A AuthorizedOrgsDesc resource to be passed as the
request body.
parent: Required. Resource name for the access policy which owns this
Authorized Orgs Desc. Format: `accessPolicies/{policy_id}`
AuthorizedOrgsDescr r TrD r N) r r
r r r r r! authorizedOrgsDescr% r4 r r r r rw rw / s/ !--.BAF T 2&r rw c : \ rS rSrSr\R " SSS9rSrg)BAccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsDeleteRequesti> zA AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsDeleteRequest
object.
Fields:
name: Required. Resource name for the Authorized Orgs Desc. Format:
`accessPolicies/{policy_id}/authorizedOrgsDesc/{authorized_orgs_desc_id}
`
r TrD r NrJ r r r r{ r{ > s
q4 0$r r{ c : \ rS rSrSr\R " SSS9rSrg)?AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsGetRequestiK zA AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsGetRequest
object.
Fields:
name: Required. Resource name for the Authorized Orgs Desc. Format: `acces
sPolicies/{policy_id}/authorizedOrgsDescs/{authorized_orgs_descs_id}`
r TrD r NrJ r r r r} r} K
q4 0$r r} c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) @AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsListRequestiW a A AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsListRequest
object.
Fields:
pageSize: Number of Authorized Orgs Descs to include in the list. Default
100.
pageToken: Next page token for the next batch of Authorized Orgs Desc
instances. Defaults to the first page of results.
parent: Required. Resource name for the access policy to list Authorized
Orgs Desc from. Format: `accessPolicies/{policy_id}`
r r` r r TrD r Nr r
r r r r rb rc rd re r% rf r4 r r r r r r W sI
#
#Ay/@/@/F/F
G(##A&) T 2&r r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) AAccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsPatchRequestii aa A AccesscontextmanagerAccessPoliciesAuthorizedOrgsDescsPatchRequest
object.
Fields:
authorizedOrgsDesc: A AuthorizedOrgsDesc resource to be passed as the
request body.
name: Identifier. Resource name for the `AuthorizedOrgsDesc`. Format: `acc
essPolicies/{access_policy}/authorizedOrgsDescs/{authorized_orgs_desc}`.
The `authorized_orgs_desc` component must begin with a letter, followed
by alphanumeric characters or `_`. After you create an
`AuthorizedOrgsDesc`, you cannot change its `name`.
updateMask: Required. Mask to control which fields get updated. Must be
non-empty.
rx r r TrD r r N) r r
r r r r r! ry r% r' rj r r r r r r i s?
!--.BAF q4 0$$$Q'*r r c : \ rS rSrSr\R " SSS9rSrg)/AccesscontextmanagerAccessPoliciesDeleteRequesti~ zA AccesscontextmanagerAccessPoliciesDeleteRequest object.
Fields:
name: Required. Resource name for the access policy to delete. Format
`accessPolicies/{policy_id}`
r TrD r NrJ r r r r r ~ rK r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
5AccesscontextmanagerAccessPoliciesGetIamPolicyRequesti aq A AccesscontextmanagerAccessPoliciesGetIamPolicyRequest object.
Fields:
getIamPolicyRequest: A GetIamPolicyRequest resource to be passed as the
request body.
resource: REQUIRED: The resource for which the policy is being requested.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
GetIamPolicyRequestr r TrD r N) r r
r r r r r! getIamPolicyRequestr% rs r r r r r r s/ "../DaH
"
"1t
4(r r c : \ rS rSrSr\R " SSS9rSrg),AccesscontextmanagerAccessPoliciesGetRequesti zA AccesscontextmanagerAccessPoliciesGetRequest object.
Fields:
name: Required. Resource name for the access policy to get. Format
`accessPolicies/{policy_id}`
r TrD r NrJ r r r r r rK r r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " S5 r Sr
g) -AccesscontextmanagerAccessPoliciesListRequesti a A AccesscontextmanagerAccessPoliciesListRequest object.
Fields:
pageSize: Number of AccessPolicy instances to include in the list. Default
100.
pageToken: Next page token for the next batch of AccessPolicy instances.
Defaults to the first page of results.
parent: Required. Resource name for the container to list AccessPolicy
instances from. Format: `organizations/{org_id}`
r r` r r r Nr r r r r r sG
#
#Ay/@/@/F/F
G(##A&) #&r r c \ rS rSrSr\R " SS5 r\R " SSS9r \R " S5 r
S r g
) .AccesscontextmanagerAccessPoliciesPatchRequesti aK A AccesscontextmanagerAccessPoliciesPatchRequest object.
Fields:
accessPolicy: A AccessPolicy resource to be passed as the request body.
name: Identifier. Resource name of the `AccessPolicy`. Format:
`accessPolicies/{access_policy}`
updateMask: Required. Mask to control which fields get updated. Must be
non-empty.
r/ r r TrD r r N) r r
r r r r r! accessPolicyr% r' rj r r r r r r s= '':, q4 0$$$Q'*r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
@AccesscontextmanagerAccessPoliciesServicePerimetersCommitRequesti aw A AccesscontextmanagerAccessPoliciesServicePerimetersCommitRequest
object.
Fields:
commitServicePerimetersRequest: A CommitServicePerimetersRequest resource
to be passed as the request body.
parent: Required. Resource name for the parent Access Policy which owns
all Service Perimeters in scope for the commit operation. Format:
`accessPolicies/{policy_id}`
CommitServicePerimetersRequestr r TrD r N) r r
r r r r r! commitServicePerimetersRequestr% r4 r r r r r r s0 $-#9#9:Z\]#^ T 2&r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
@AccesscontextmanagerAccessPoliciesServicePerimetersCreateRequesti a. A AccesscontextmanagerAccessPoliciesServicePerimetersCreateRequest
object.
Fields:
parent: Required. Resource name for the access policy which owns this
Service Perimeter. Format: `accessPolicies/{policy_id}`
servicePerimeter: A ServicePerimeter resource to be passed as the request
body.
r TrD ServicePerimeterr r N) r r
r r r r r% r4 r! servicePerimeterr r r r r r s/ T 2& ++,>Br r c : \ rS rSrSr\R " SSS9rSrg)@AccesscontextmanagerAccessPoliciesServicePerimetersDeleteRequesti zA AccesscontextmanagerAccessPoliciesServicePerimetersDeleteRequest
object.
Fields:
name: Required. Resource name for the Service Perimeter. Format:
`accessPolicies/{policy_id}/servicePerimeters/{service_perimeter_id}`
r TrD r NrJ r r r r r r~ r r c : \ rS rSrSr\R " SSS9rSrg)=AccesscontextmanagerAccessPoliciesServicePerimetersGetRequesti zA AccesscontextmanagerAccessPoliciesServicePerimetersGetRequest object.
Fields:
name: Required. Resource name for the Service Perimeter. Format:
`accessPolicies/{policy_id}/servicePerimeters/{service_perimeters_id}`
r TrD r NrJ r r r r r rK r r c \ rS rSrSr\R " S\R R S9r \R " S5 r \R " SSS9r S r
g
) >AccesscontextmanagerAccessPoliciesServicePerimetersListRequesti a A AccesscontextmanagerAccessPoliciesServicePerimetersListRequest object.
Fields:
pageSize: Number of Service Perimeters to include in the list. Default
100.
pageToken: Next page token for the next batch of Service Perimeter
instances. Defaults to the first page of results.
parent: Required. Resource name for the access policy to list Service
Perimeters from. Format: `accessPolicies/{policy_id}`
r r` r r TrD r Nr r r r r r sI
#
#Ay/@/@/F/F
G(##A&) T 2&r r c \ rS rSrSr\R " SSS9r\R " SS5 r \R " S5 r
S r g
) ?AccesscontextmanagerAccessPoliciesServicePerimetersPatchRequesti aM A AccesscontextmanagerAccessPoliciesServicePerimetersPatchRequest
object.
Fields:
name: Identifier. Resource name for the `ServicePerimeter`. Format:
`accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`.
The `service_perimeter` component must begin with a letter, followed by
alphanumeric characters or `_`. After you create a `ServicePerimeter`,
you cannot change its `name`.
servicePerimeter: A ServicePerimeter resource to be passed as the request
body.
updateMask: Required. Mask to control which fields get updated. Must be
non-empty.
r TrD r r r r N) r r
r r r r r% r' r! r rj r r r r r r s?
q4 0$ ++,>B$$Q'*r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
DAccesscontextmanagerAccessPoliciesServicePerimetersReplaceAllRequesti! aR A AccesscontextmanagerAccessPoliciesServicePerimetersReplaceAllRequest
object.
Fields:
parent: Required. Resource name for the access policy which owns these
Service Perimeters. Format: `accessPolicies/{policy_id}`
replaceServicePerimetersRequest: A ReplaceServicePerimetersRequest
resource to be passed as the request body.
r TrD ReplaceServicePerimetersRequestr r N) r r
r r r r r% r4 r! replaceServicePerimetersRequestr r r r r r ! s0 T 2&$-$:$:;\^_$`!r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
LAccesscontextmanagerAccessPoliciesServicePerimetersTestIamPermissionsRequesti0 a A
AccesscontextmanagerAccessPoliciesServicePerimetersTestIamPermissionsRequest
object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r TrD rq r r Nrr r r r r r 0 ru r r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
5AccesscontextmanagerAccessPoliciesSetIamPolicyRequestiB aq A AccesscontextmanagerAccessPoliciesSetIamPolicyRequest object.
Fields:
resource: REQUIRED: The resource for which the policy is being specified.
See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
setIamPolicyRequest: A SetIamPolicyRequest resource to be passed as the
request body.
r TrD SetIamPolicyRequestr r N) r r
r r r r r% rs r! setIamPolicyRequestr r r r r r B s/
"
"1t
4(!../DaHr r c ` \ rS rSrSr\R " SSS9r\R " SS5 r Sr
g )
;AccesscontextmanagerAccessPoliciesTestIamPermissionsRequestiR a A AccesscontextmanagerAccessPoliciesTestIamPermissionsRequest object.
Fields:
resource: REQUIRED: The resource for which the policy detail is being
requested. See [Resource
names](https://cloud.google.com/apis/design/resource_names) for the
appropriate value for this field.
testIamPermissionsRequest: A TestIamPermissionsRequest resource to be
passed as the request body.
r TrD rq r r Nrr r r r r r R s0
"
"1t
4( ' 4 45PRS Tr r c : \ rS rSrSr\R " SSS9rSrg)(AccesscontextmanagerOperationsGetRequestib zhA AccesscontextmanagerOperationsGetRequest object.
Fields:
name: The name of the operation resource.
r TrD r NrJ r r r r r b s
q4 0$r r c ` \ rS rSrSr\R " SS5 r\R " SSS9r Sr
g )
CAccesscontextmanagerOrganizationsGcpUserAccessBindingsCreateRequestil zA AccesscontextmanagerOrganizationsGcpUserAccessBindingsCreateRequest
object.
Fields:
gcpUserAccessBinding: A GcpUserAccessBinding resource to be passed as the
request body.
parent: Required. Example: "organizations/256"
GcpUserAccessBindingr r TrD r N) r r
r r r r r! gcpUserAccessBindingr% r4 r r r r r r l s/ #//0FJ T 2&r r c : \ rS rSrSr\R " SSS9rSrg)CAccesscontextmanagerOrganizationsGcpUserAccessBindingsDeleteRequestiz zA AccesscontextmanagerOrganizationsGcpUserAccessBindingsDeleteRequest
object.
Fields:
name: Required. Example:
"organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
r TrD r NrJ r r r r r z r~ r r c : \ rS rSrSr\R " SSS9rSrg)@AccesscontextmanagerOrganizationsGcpUserAccessBindingsGetRequesti zA AccesscontextmanagerOrganizationsGcpUserAccessBindingsGetRequest
object.
Fields:
name: Required. Example:
"organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
r TrD r NrJ r r r r r r~ r r c \ rS rSrSr\R " S5 r\R " S\R R S9r \R " S5 r \R " SSS 9r
S
rg ) AAccesscontextmanagerOrganizationsGcpUserAccessBindingsListRequesti a A AccesscontextmanagerOrganizationsGcpUserAccessBindingsListRequest
object.
Fields:
filter: Optional. The literal filter pipelines to be returned. See
https://google.aip.dev/160 for more details. Accepts values: *
principal:group_key * principal:service_account OR
principal:service_account_project_number. If this field is empty or not
one of the above, the default value is "principal:group_key".
pageSize: Optional. Maximum number of items to return. The server may
return fewer items. If left blank, the server may return any number of
items.
pageToken: Optional. If left blank, returns the first page. To enumerate
all items, use the next_page_token from your previous list operation.
parent: Required. Example: "organizations/256"
r r r` r r TrD r N)r r
r r r r r% filterrb rc rd re rf r4 r r r r r r sY " #&
#
#Ay/@/@/F/F
G(##A&) T 2&r r c \ rS rSrSr\R " S5 r\R " SS5 r \R " SSS9r \R " S 5 r S
r
g ) BAccesscontextmanagerOrganizationsGcpUserAccessBindingsPatchRequesti a4 A AccesscontextmanagerOrganizationsGcpUserAccessBindingsPatchRequest
object.
Fields:
append: Optional. This field controls whether or not certain repeated
settings in the update request overwrite or append to existing settings
on the binding. If true, then append. Otherwise overwrite. So far, only
scoped_access_settings with session_settings supports appending. Global
access_levels, access_levels in scoped_access_settings,
dry_run_access_levels, and session_settings are not compatible with
append functionality, and the request will return an error if
append=true when these settings are in the update_mask. The request will
also return an error if append=true when "scoped_access_settings" is not
set in the update_mask.
gcpUserAccessBinding: A GcpUserAccessBinding resource to be passed as the
request body.
name: Immutable. Identifier. Assigned by the server during creation. The
last segment has an arbitrary length and has only URI unreserved
characters (as defined by [RFC 3986 Section
2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be
specified by the client during creation. Example:
"organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
updateMask: Required. Only the fields specified in this mask are updated.
Because name and group_key cannot be changed, update_mask is required
and may only contain the following fields: `access_levels`,
`dry_run_access_levels`, `session_settings`, and
`scoped_access_settings`. Example: update_mask { paths: "access_levels"
}
r r r r TrD r r N)r r
r r r r r+ appendr! r r% r' rj r r r r r r sO < ! !! $&"//0FJ q4 0$$$Q'*r r c \ rS rSrSr\R " S\R R S9r \R " S5 r Sr g)*AccesscontextmanagerPermissionsListRequesti a A AccesscontextmanagerPermissionsListRequest object.
Fields:
pageSize: Optional. This flag specifies the maximum number of services to
return per page. Default is 100.
pageToken: Optional. Token to start on a later page. Default is the first
page.
r r` r r N
r r
r r r r rb rc rd re r% rf r r r r r r s7
#
#Ay/@/@/F/F
G(##A&)r r c : \ rS rSrSr\R " SSS9rSrg)&AccesscontextmanagerServicesGetRequesti zA AccesscontextmanagerServicesGetRequest object.
Fields:
name: The name of the service to get information about. The names must be
in the same format as used in defining a service perimeter, for example,
`storage.googleapis.com`.
r TrD r NrJ r r r r r r~ r r c \ rS rSrSr\R " S\R R S9r \R " S5 r Sr g)'AccesscontextmanagerServicesListRequesti zA AccesscontextmanagerServicesListRequest object.
Fields:
pageSize: This flag specifies the maximum number of services to return per
page. Default is 100.
pageToken: Token to start on a later page. Default is the first page.
r r` r r Nr r r r r r s7
#
#Ay/@/@/F/F
G(##A&)r r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)AddRequestHeaderi z_Adds a request header to the API.
Fields:
key: HTTP header key.
value: HTTP header value.
r r r N)
r r
r r r r r% keyvaluer r r r r r s) a #
"%r r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ApiOperationi aV Identification for an API Operation.
Fields:
methodSelectors: API methods or permissions to allow. Method or permission
must belong to the service specified by `service_name` field. A single
MethodSelector entry with `*` specified for the `method` field will
allow all methods AND permissions for the service specified in
`service_name`.
serviceName: The name of the API whose methods or permissions the
IngressPolicy or EgressPolicy want to allow. A single ApiOperation with
`service_name` field set to `*` will allow all methods AND permissions
for all services.
MethodSelectorr Tr1 r r N) r r
r r r r r! methodSelectorsr% serviceNamer r r r r r s. **+;QN/%%a(+r r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g) Applicationi zAn application that accesses Google Cloud APIs.
Fields:
clientId: The OAuth client ID of the application.
name: The name of the application. Example: "Cloud Console"
r r r N)
r r
r r r r r% clientIdr' r r r r r r s)
"
"1
%( q !$r r c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
AuditConfigi! aw Specifies the audit configuration for a service. The configuration
determines which permission types are logged, and what identities, if any,
are exempted from logging. An AuditConfig must have one or more
AuditLogConfigs. If there are AuditConfigs for both `allServices` and a
specific service, the union of the two AuditConfigs is used for that
service: the log_types specified in each AuditConfig are enabled, and the
exempted_members in each AuditLogConfig are exempted. Example Policy with
multiple AuditConfigs: { "audit_configs": [ { "service": "allServices",
"audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
"user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type":
"ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com",
"audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type":
"DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For
sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
logging. It also exempts `jose@example.com` from DATA_READ logging, and
`aliya@example.com` from DATA_WRITE logging.
Fields:
auditLogConfigs: The configuration for logging of each type of permission.
service: Specifies a service that will be enabled for audit logging. For
example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
`allServices` is a special value that covers all services.
AuditLogConfigr Tr1 r r N) r r
r r r r r! auditLogConfigsr% servicer r r r r r ! s. 0 **+;QN/ ! !! $'r r c \ rS rSrSr " S S\R 5 r\R " SSS9r \R " SS5 r S r g
) r i> aR Provides the configuration for logging a type of permissions. Example: {
"audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
"user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables
'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from
DATA_READ logging.
Enums:
LogTypeValueValuesEnum: The log type that this config enables.
Fields:
exemptedMembers: Specifies the identities that do not cause logging for
this type of permission. Follows the same format of Binding.members.
logType: The log type that this config enables.
c ( \ rS rSrSrSrSrSrSrSr g) %AuditLogConfig.LogTypeValueValuesEnumiN a The log type that this config enables.
Values:
LOG_TYPE_UNSPECIFIED: Default case. Should never be this.
ADMIN_READ: Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE: Data writes. Example: CloudSQL Users create
DATA_READ: Data reads. Example: CloudSQL Users list
r r r r r N)
r r
r r r LOG_TYPE_UNSPECIFIED
ADMIN_READ
DATA_WRITE DATA_READr r r r LogTypeValueValuesEnumr N s JJIr r r Tr1 r r N)
r r
r r r r rW r r% exemptedMembersrX logTyper r r r r r > s>
y~~ ))!d;/ 8! <'r r c N \ rS rSrSr " S S\R 5 r " S S\R 5 r " S S\R 5 r \R " SS 5 r \R " SS
5 r \R " SS 5 r
\R " S 5 r\R " S
SS9rSrg)rx i` a `AuthorizedOrgsDesc` contains data for an organization's authorization
policy.
Enums:
AssetTypeValueValuesEnum: The asset type of this authorized orgs desc.
Valid values are `ASSET_TYPE_DEVICE`, and
`ASSET_TYPE_CREDENTIAL_STRENGTH`.
AuthorizationDirectionValueValuesEnum: The direction of the authorization
relationship between this organization and the organizations listed in
the `orgs` field. The valid values for this field include the following:
`AUTHORIZATION_DIRECTION_FROM`: Allows this organization to evaluate
traffic in the organizations listed in the `orgs` field.
`AUTHORIZATION_DIRECTION_TO`: Allows the organizations listed in the
`orgs` field to evaluate the traffic in this organization. For the
authorization relationship to take effect, all of the organizations must
authorize and specify the appropriate relationship direction. For
example, if organization A authorized organization B and C to evaluate
its traffic, by specifying `AUTHORIZATION_DIRECTION_TO` as the
authorization direction, organizations B and C must specify
`AUTHORIZATION_DIRECTION_FROM` as the authorization direction in their
`AuthorizedOrgsDesc` resource.
AuthorizationTypeValueValuesEnum: A granular control type for
authorization levels. Valid value is `AUTHORIZATION_TYPE_TRUST`.
Fields:
assetType: The asset type of this authorized orgs desc. Valid values are
`ASSET_TYPE_DEVICE`, and `ASSET_TYPE_CREDENTIAL_STRENGTH`.
authorizationDirection: The direction of the authorization relationship
between this organization and the organizations listed in the `orgs`
field. The valid values for this field include the following:
`AUTHORIZATION_DIRECTION_FROM`: Allows this organization to evaluate
traffic in the organizations listed in the `orgs` field.
`AUTHORIZATION_DIRECTION_TO`: Allows the organizations listed in the
`orgs` field to evaluate the traffic in this organization. For the
authorization relationship to take effect, all of the organizations must
authorize and specify the appropriate relationship direction. For
example, if organization A authorized organization B and C to evaluate
its traffic, by specifying `AUTHORIZATION_DIRECTION_TO` as the
authorization direction, organizations B and C must specify
`AUTHORIZATION_DIRECTION_FROM` as the authorization direction in their
`AuthorizedOrgsDesc` resource.
authorizationType: A granular control type for authorization levels. Valid
value is `AUTHORIZATION_TYPE_TRUST`.
name: Identifier. Resource name for the `AuthorizedOrgsDesc`. Format: `acc
essPolicies/{access_policy}/authorizedOrgsDescs/{authorized_orgs_desc}`.
The `authorized_orgs_desc` component must begin with a letter, followed
by alphanumeric characters or `_`. After you create an
`AuthorizedOrgsDesc`, you cannot change its `name`.
orgs: The list of organization ids in this AuthorizedOrgsDesc. Format:
`organizations/` Example: `organizations/123456`
c $ \ rS rSrSrSrSrSrSrg)+AuthorizedOrgsDesc.AssetTypeValueValuesEnumi a The asset type of this authorized orgs desc. Valid values are
`ASSET_TYPE_DEVICE`, and `ASSET_TYPE_CREDENTIAL_STRENGTH`.
Values:
ASSET_TYPE_UNSPECIFIED: No asset type specified.
ASSET_TYPE_DEVICE: Device asset type.
ASSET_TYPE_CREDENTIAL_STRENGTH: Credential strength asset type.
r r r r N) r r
r r r ASSET_TYPE_UNSPECIFIEDASSET_TYPE_DEVICE ASSET_TYPE_CREDENTIAL_STRENGTHr r r r AssetTypeValueValuesEnumr s %&"r r c $ \ rS rSrSrSrSrSrSrg)8AuthorizedOrgsDesc.AuthorizationDirectionValueValuesEnumi aC The direction of the authorization relationship between this
organization and the organizations listed in the `orgs` field. The valid
values for this field include the following:
`AUTHORIZATION_DIRECTION_FROM`: Allows this organization to evaluate
traffic in the organizations listed in the `orgs` field.
`AUTHORIZATION_DIRECTION_TO`: Allows the organizations listed in the
`orgs` field to evaluate the traffic in this organization. For the
authorization relationship to take effect, all of the organizations must
authorize and specify the appropriate relationship direction. For example,
if organization A authorized organization B and C to evaluate its traffic,
by specifying `AUTHORIZATION_DIRECTION_TO` as the authorization direction,
organizations B and C must specify `AUTHORIZATION_DIRECTION_FROM` as the
authorization direction in their `AuthorizedOrgsDesc` resource.
Values:
AUTHORIZATION_DIRECTION_UNSPECIFIED: No direction specified.
AUTHORIZATION_DIRECTION_TO: Specified orgs will evaluate traffic.
AUTHORIZATION_DIRECTION_FROM: Specified orgs' traffic will be evaluated.
r r r r N) r r
r r r #AUTHORIZATION_DIRECTION_UNSPECIFIEDAUTHORIZATION_DIRECTION_TO AUTHORIZATION_DIRECTION_FROMr r r r %AuthorizationDirectionValueValuesEnumr s & +,'!" #$ r r c \ rS rSrSrSrSrSrg)3AuthorizedOrgsDesc.AuthorizationTypeValueValuesEnumi zA granular control type for authorization levels. Valid value is
`AUTHORIZATION_TYPE_TRUST`.
Values:
AUTHORIZATION_TYPE_UNSPECIFIED: No authorization type specified.
AUTHORIZATION_TYPE_TRUST: This authorization relationship is "trust".
r r r N)r r
r r r AUTHORIZATION_TYPE_UNSPECIFIEDAUTHORIZATION_TYPE_TRUSTr r r r AuthorizationTypeValueValuesEnumr s &'" r r r r r r r Tr1 r N)r r
r r r r rW r r r rX assetTypeauthorizationDirectionauthorizationTyper% r' orgsr r r r rx rx ` s 2h ' '%inn %0 ! ! !!" \ rS rSrSr\R " SS5 rSrg)r9 iK zClient scope represents the application, etc. subject to this binding's
restrictions.
Fields:
restrictedClientApplication: Optional. The application that is subject to
this binding's scope.
r r r N) r r
r r r r r! restrictedClientApplicationr r r r r9 r9 K s !* 6 6}a H r r9 c < \ rS rSrSr\R " S5 rSrg)r iW a, A request to commit dry-run specs in all Service Perimeters belonging to
an Access Policy.
Fields:
etag: Optional. The etag for the version of the Access Policy that this
commit operation is to be performed on. If, at the time of commit, the
etag for the Access Policy stored in Access Context Manager is different
from the specified etag, then the commit operation will not be performed
and the call will fail. This field is not required. If etag is not
provided, the operation will be performed as if a valid etag is
provided.
r r N) r r
r r r r r% r3 r r r r r r W s
q !$r r c < \ rS rSrSr\R " SSSS9rSrg) CommitServicePerimetersResponseih zA response to CommitServicePerimetersRequest. This will be put inside of
Operation.response field.
Fields:
servicePerimeters: List of all the Service Perimeter instances in the
Access Policy.
r r Tr1 r N r r
r r r r r! servicePerimetersr r r r r r h s ,,-?TRr r c Z \ rS rSrSr\R " SS5 r\R " SSS9r \R " SSS9r
\R " S 5 r \R " S
SS9r
\R " S SS9r\R " S S
5 r\R " SS5 r\R " SSSS9rSrg)r it a>
A condition necessary for an `AccessLevel` to be granted. The Condition
is an AND over its fields. So a Condition is true if: 1) the request IP is
from one of the listed subnetworks AND 2) the originating device complies
with the listed device policy AND 3) all listed access levels are granted
AND 4) the request was sent at a time allowed by the DateTimeRestriction AND
5) the request was sent from one of the specified vpc_network_sources.
Fields:
devicePolicy: Device specific restrictions, all restrictions must hold for
the Condition to be true. If not specified, all devices are allowed.
ipSubnetworks: CIDR block IP subnetwork specification. May be IPv4 or
IPv6. Note that for a CIDR IP address block, the specified IP address
portion must be properly truncated (i.e. all the host bits must be zero)
or the input is considered malformed. For example, "192.0.2.0/24" is
accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32"
is accepted whereas "2001:db8::1/32" is not. The originating IP of a
request must be in one of the listed subnets in order for this Condition
to be true. If this field is empty, all IP addresses are allowed.
members: The request must be made by one of the provided user or service
accounts. Groups are not supported. Syntax: `user:{emailid}`
`serviceAccount:{emailid}` If not specified, a request may come from any
user.
negate: Whether to negate the Condition. If true, the Condition becomes a
NAND over its non-empty fields. Any non-empty field criteria evaluating
to false will result in the Condition to be satisfied. Defaults to
false.
regions: The request must originate from one of the provided
countries/regions. Must be valid ISO 3166-1 alpha-2 codes.
requiredAccessLevels: A list of other access levels defined in the same
`Policy`, referenced by resource name. Referencing an `AccessLevel`
which does not exist is an error. All access levels listed must be
granted for the Condition to be true. Example:
"`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
risk: The request must have acceptable risk profile. Following constraints
apply to its use: - It cannot be negated and cannot be nested. - If set,
no other attributes can be applied within a Condition. - If set, you may
optionally specify a amendable response.
unsatisfiedResult: The result to apply if the condition is not met.
vpcNetworkSources: The request must originate from one of the provided VPC
networks in Google Cloud. Cannot specify this field together with
`ip_subnetworks`.
DevicePolicyr r Tr1 r r r r Risk UnsatisfiedResult VpcNetworkSource r N)r r
r r r r r! devicePolicyr%
ipSubnetworksr r+ negateregionsrequiredAccessLevelsriskunsatisfiedResultvpcNetworkSourcesr r r r r r t s )V '':,''D9- ! !!d 3' ! !! $& ! !!d 3'"..q4@ *$ ,,-@!D ,,-?TRr r c > \ rS rSrSr\R " SS5 rSrg)r i a `CustomLevel` is an `AccessLevel` using the Cloud Common Expression
Language to represent the necessary conditions for the level to apply to a
request. See CEL spec at: https://github.com/google/cel-spec
Fields:
expr: Required. A Cloud CEL expression evaluating to a boolean.
r r r N) r r
r r r r r! exprr r r r r r s
*$r r c D \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SSSS 9r
\R " SS
SS 9r \R " S S SS 9r
\R " S
5 r\R " S5 r\R " S5 rSrg)r i a# `DevicePolicy` specifies device specific restrictions necessary to
acquire a given access level. A `DevicePolicy` specifies requirements for
requests from devices to be granted access levels, it does not do any
enforcement on the device. `DevicePolicy` acts as an AND over all specified
fields, and each repeated field is an OR over its elements. Any unset fields
are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS,
os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the
DevicePolicy will be true for requests originating from encrypted Linux
desktops and encrypted Windows desktops.
Enums:
AllowedDeviceManagementLevelsValueListEntryValuesEnum:
AllowedEncryptionStatusesValueListEntryValuesEnum:
Fields:
allowedDeviceManagementLevels: Allowed device management levels, an empty
list allows all management levels.
allowedEncryptionStatuses: Allowed encryptions statuses, an empty list
allows all statuses.
osConstraints: Allowed OS versions, an empty list allows all types and all
versions.
requireAdminApproval: Whether the device needs to be approved by the
customer admin.
requireCorpOwned: Whether the device needs to be corp owned.
requireScreenlock: Whether or not screenlock is required for the
DevicePolicy to be true. Defaults to `false`.
c ( \ rS rSrSrSrSrSrSrSr g) BDevicePolicy.AllowedDeviceManagementLevelsValueListEntryValuesEnumi a AllowedDeviceManagementLevelsValueListEntryValuesEnum enum type.
Values:
MANAGEMENT_UNSPECIFIED: The device's management level is not specified
or not known.
NONE: The device is not managed.
BASIC: Basic management is enabled, which is generally limited to
monitoring and wiping the corporate account.
COMPLETE: Complete device management. This includes more thorough
monitoring and the ability to directly manage the device (such as
remote wiping). This can be enabled through the Android Enterprise
Platform.
r r r r r N)
r r
r r r MANAGEMENT_UNSPECIFIEDNONEBASICCOMPLETEr r r r 5AllowedDeviceManagementLevelsValueListEntryValuesEnumr s D
EHr r$ c ( \ rS rSrSrSrSrSrSrSr g) >DevicePolicy.AllowedEncryptionStatusesValueListEntryValuesEnumi a` AllowedEncryptionStatusesValueListEntryValuesEnum enum type.
Values:
ENCRYPTION_UNSPECIFIED: The encryption status of the device is not
specified or not known.
ENCRYPTION_UNSUPPORTED: The device does not support encryption.
UNENCRYPTED: The device supports encryption, but is currently
unencrypted.
ENCRYPTED: The device is encrypted.
r r r r r N)
r r
r r r ENCRYPTION_UNSPECIFIEDENCRYPTION_UNSUPPORTED UNENCRYPTED ENCRYPTEDr r r r 1AllowedEncryptionStatusesValueListEntryValuesEnumr& s KIr r+ r Tr1 r OsConstraintr r r r r N)r r
r r r r rW r$ r+ rX allowedDeviceManagementLevelsallowedEncryptionStatusesr!
osConstraintsr+ requireAdminApprovalrequireCorpOwnedrequireScreenlockr r r r r r s 8inn &).. #,"5"56mop{ #A ' 1 12eghsw x(( TJ-"//2 ++A. ,,Q/r r c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SSS 9r
\R " SS
5 r \R " SS 5 r
\R " S S
SS 9rSrg)
EgressFromi a Defines the conditions under which an EgressPolicy matches a request.
Conditions based on information about the source of the request. Note that
if the destination of the request also is protected by a ServicePerimeter,
then that ServicePerimeter must have an IngressPolicy which allows access in
order for this request to succeed.
Enums:
IdentityTypeValueValuesEnum: Specifies the type of identities that are
allowed access to outside the perimeter. If left unspecified, then
members of `identities` field will be allowed access.
SourceRestrictionValueValuesEnum: Whether to enforce traffic restrictions
based on `sources` field. If the `sources` fields is non-empty, then
this field must be set to `SOURCE_RESTRICTION_ENABLED`.
Fields:
identities: A list of identities that are allowed access through
EgressPolicy. Identities can be an individual user, service account,
Google group, or third-party identity. For third-party identity, only
single identities are supported and other identity types are not
supported. The `v1` identities that have the prefix `user`, `group`,
`serviceAccount`, and `principal` in
https://cloud.google.com/iam/docs/principal-identifiers#v1 are
supported.
identityType: Specifies the type of identities that are allowed access to
outside the perimeter. If left unspecified, then members of `identities`
field will be allowed access.
sourceRestriction: Whether to enforce traffic restrictions based on
`sources` field. If the `sources` fields is non-empty, then this field
must be set to `SOURCE_RESTRICTION_ENABLED`.
sources: Sources that this EgressPolicy authorizes access from. If this
field is not empty, then `source_restriction` must be set to
`SOURCE_RESTRICTION_ENABLED`.
c ( \ rS rSrSrSrSrSrSrSr g) &EgressFrom.IdentityTypeValueValuesEnumi" a Specifies the type of identities that are allowed access to outside
the perimeter. If left unspecified, then members of `identities` field
will be allowed access.
Values:
IDENTITY_TYPE_UNSPECIFIED: No blanket identity group specified.
ANY_IDENTITY: Authorize access from all identities outside the
perimeter.
ANY_USER_ACCOUNT: Authorize access from all human users outside the
perimeter.
ANY_SERVICE_ACCOUNT: Authorize access from all service accounts outside
the perimeter.
r r r r r N
r r
r r r IDENTITY_TYPE_UNSPECIFIED ANY_IDENTITYANY_USER_ACCOUNTANY_SERVICE_ACCOUNTr r r r IdentityTypeValueValuesEnumr6 " !" Lr r< c $ \ rS rSrSrSrSrSrSrg)+EgressFrom.SourceRestrictionValueValuesEnumi5 aV Whether to enforce traffic restrictions based on `sources` field. If
the `sources` fields is non-empty, then this field must be set to
`SOURCE_RESTRICTION_ENABLED`.
Values:
SOURCE_RESTRICTION_UNSPECIFIED: Enforcement preference unspecified, will
not enforce traffic restrictions based on `sources` in EgressFrom.
SOURCE_RESTRICTION_ENABLED: Enforcement preference enabled, traffic
restrictions will be enforced based on `sources` in EgressFrom.
SOURCE_RESTRICTION_DISABLED: Enforcement preference disabled, will not
enforce traffic restrictions based on `sources` in EgressFrom.
r r r r N) r r
r r r SOURCE_RESTRICTION_UNSPECIFIEDSOURCE_RESTRICTION_ENABLEDSOURCE_RESTRICTION_DISABLEDr r r r SourceRestrictionValueValuesEnumr? 5 s &'"!" "# r rC r Tr1 r r EgressSourcer r N)r r
r r r r rW r< rC r%
identitiesrX identityTypesourceRestrictionr! sourcesr r r r r4 r4 sw D INN &$ $" $$Q6*$$%BAF, ))*LaP " ">1t D'r r4 c \ rS rSrSr\R " SS5 r\R " SS5 r\R " S5 r
Sr g )
EgressPolicyiL a9 Policy for egress from perimeter. EgressPolicies match requests based on
`egress_from` and `egress_to` stanzas. For an EgressPolicy to match, both
`egress_from` and `egress_to` stanzas must be matched. If an EgressPolicy
matches a request, the request is allowed to span the ServicePerimeter
boundary. For example, an EgressPolicy can be used to allow VMs on networks
within the ServicePerimeter to access a defined set of projects outside the
perimeter in certain contexts (e.g. to read data from a Cloud Storage bucket
or query against a BigQuery dataset). EgressPolicies are concerned with the
*resources* that a request relates as well as the API services and API
actions being used. They do not related to the direction of data movement.
More detailed documentation for this concept can be found in the
descriptions of EgressFrom and EgressTo.
Fields:
egressFrom: Defines conditions on the source of a request causing this
EgressPolicy to apply.
egressTo: Defines the conditions on the ApiOperation and destination
resources that cause this EgressPolicy to apply.
title: Optional. Human-readable title for the egress rule. The title must
be unique within the perimeter and can not exceed 100 characters. Within
the access policy, the combined length of all rule titles must not
exceed 240,000 characters.
r4 r EgressTor r r N) r r
r r r r r!
egressFromegressTor% r( r r r r rJ rJ L s= 0 %%lA6*
#
#J
2(
"%r rJ c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)rD ij a) The source that EgressPolicy authorizes access from inside the
ServicePerimeter to somewhere outside the ServicePerimeter boundaries.
Fields:
accessLevel: An AccessLevel resource name that allows protected resources
inside the ServicePerimeters to access outside the ServicePerimeter
boundaries. AccessLevels listed must be in the same policy as this
ServicePerimeter. Referencing a nonexistent AccessLevel will cause an
error. If an AccessLevel name is not specified, only resources within
the perimeter can be accessed through Google Cloud calls with request
origins within the perimeter. Example:
`accessPolicies/MY_POLICY/accessLevels/MY_LEVEL`. If a single `*` is
specified for `access_level`, then all EgressSources will be allowed.
resource: A Google Cloud resource from the service perimeter that you want
to allow to access data outside the perimeter. This field supports only
projects. The project format is `projects/{project_number}`. You can't
use `*` in this field to allow all Google Cloud resources.
r r r N
r r
r r r r r% rF rs r r r r rD rD j s) & %%a(+
"
"1
%(r rD c \ rS rSrSr\R " SSS9r\R " SSSS9r \R " SSS9r
\R " S SS9r S
r g ) rK i a Defines the conditions under which an EgressPolicy matches a request.
Conditions are based on information about the ApiOperation intended to be
performed on the `resources` specified. Note that if the destination of the
request is also protected by a ServicePerimeter, then that ServicePerimeter
must have an IngressPolicy which allows access in order for this request to
succeed. The request must match `operations` AND `resources` fields in order
to be allowed egress out of the perimeter.
Fields:
externalResources: A list of external resources that are allowed to be
accessed. Only AWS and Azure resources are supported. For Amazon S3, the
supported formats are s3://BUCKET_NAME, s3a://BUCKET_NAME, and
s3n://BUCKET_NAME. For Azure Storage, the supported format is
azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request
matches if it contains an external resource in this list (Example:
s3://bucket/path). Currently '*' is not allowed.
operations: A list of ApiOperations allowed to be performed by the sources
specified in the corresponding EgressFrom. A request matches if it uses
an operation/service in this list.
resources: A list of resources, currently only projects in the form
`projects/`, that are allowed to be accessed by sources defined in the
corresponding EgressFrom. A request matches if it contains a resource in
this list. If `*` is specified for `resources`, then this EgressTo rule
will authorize access to all resources outside the perimeter.
roles: IAM roles that represent the set of operations allowed to be
performed by the sources specified in the corresponding EgressFrom.
r Tr1 r r r r r N)
r r
r r r r r% externalResourcesr!
operations resourcesrolesr r r r rK rK sT 8 ++A=%%na$G*##A5)
D
1%r rK c \ rS rSrSr\R " S5 r\R " S5 r\R " S5 r \R " S5 r
Sr g) r i aq Represents a textual expression in the Common Expression Language (CEL)
syntax. CEL is a C-like expression language. The syntax and semantics of CEL
are documented at https://github.com/google/cel-spec. Example (Comparison):
title: "Summary size limit" description: "Determines if a summary is less
than 100 chars" expression: "document.summary.size() < 100" Example
(Equality): title: "Requestor is owner" description: "Determines if
requestor is the document owner" expression: "document.owner ==
request.auth.claims.email" Example (Logic): title: "Public documents"
description: "Determine whether the document should be publicly visible"
expression: "document.type != 'private' && document.type != 'internal'"
Example (Data Manipulation): title: "Notification string" description:
"Create a notification string with a timestamp." expression: "'New message
received at ' + string(document.create_time)" The exact variables and
functions that may be referenced within an expression are determined by the
service that evaluates it. See the service documentation for additional
information.
Fields:
description: Optional. Description of the expression. This is a longer
text which describes the expression, e.g. when hovered over it in a UI.
expression: Textual representation of an expression in Common Expression
Language syntax.
location: Optional. String indicating the location of the expression for
error reporting, e.g. a file name and a position in the file.
title: Optional. Title for the expression, i.e. a short string describing
its purpose. This can be used e.g. in UIs which allow to enter the
expression.
r r r r r N) r r
r r r r r% r&
expressionlocationr( r r r r r r sI : %%a(+$$Q'*
"
"1
%(
"%r r c 8 \ rS rSrSr\R " SSS9r\R " SSS9r\R " S5 r \R " S5 r
\R " S S
5 r \R " S S SS9r
\R " S
SSS9r\R " SS5 rSrg)r i a Restricts access to Cloud Console and Google Cloud APIs for a set of
users using Context-Aware Access.
Fields:
accessLevels: Optional. Access level that a user must have to be granted
access. Only one access level is supported, not multiple. This repeated
field must have exactly one element. Example:
"accessPolicies/9522/accessLevels/device_trusted"
dryRunAccessLevels: Optional. Dry run access level that will be evaluated
but will not be enforced. The access denial based on dry run policy will
be logged. Only one access level is supported, not multiple. This list
must have exactly one element. Example:
"accessPolicies/9522/accessLevels/device_trusted"
groupKey: Optional. Immutable. Google Group id whose users are subject to
this binding's restrictions. See "id" in the [Google Workspace Directory
API's Group Resource] (https://developers.google.com/admin-
sdk/directory/v1/reference/groups#resource). If a group's email
address/alias is changed, this resource will continue to point at the
changed group. This field does not accept group email addresses or
aliases. Example: "01d520gv4vjcrht"
name: Immutable. Identifier. Assigned by the server during creation. The
last segment has an arbitrary length and has only URI unreserved
characters (as defined by [RFC 3986 Section
2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be
specified by the client during creation. Example:
"organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
principal: Optional. Immutable. The principal that is subject to the
access policies in this policy binding.
restrictedClientApplications: Optional. A list of applications that are
subject to this binding's restrictions. If the list is empty, the
binding restrictions will universally apply to all applications.
scopedAccessSettings: Optional. A list of scoped access settings that set
this binding's restrictions on a subset of applications. This field
cannot be set if restricted_client_applications is set.
sessionSettings: Optional. The Google Cloud session length (GCSL) policy
for the group key.
r Tr1 r r r Principalr r r ScopedAccessSettingsr r> r r N)r r
r r r r r% r? dryRunAccessLevelsgroupKeyr' r! principal restrictedClientApplicationsscopedAccessSettingsr@ r r r r r r s $L &&q48, ,,Q>
"
"1
%( q !$$$[!4)!*!7!7
qSW!X "//0FTXY **+ \ rS rSrSr\R " SS5 rSrg)r i zRequest message for `GetIamPolicy` method.
Fields:
options: OPTIONAL: A `GetPolicyOptions` object for specifying options to
`GetIamPolicy`.
GetPolicyOptionsr r N) r r
r r r r r! optionsr r r r r r s
" "#5q 9'r r c b \ rS rSrSr\R " S\R R S9r Sr
g)ra i a] Encapsulates settings provided to GetIamPolicy.
Fields:
requestedPolicyVersion: Optional. The maximum policy version that will be
used to format the policy. Valid values are 0, 1, and 3. Requests
specifying an invalid value will be rejected. Requests for policies with
any conditional role bindings must specify version 3. Policies with no
conditional role bindings may specify any valid value or leave the field
unset. The policy in the response might use the policy version that you
specified, or it might use a lower policy version. For example, if you
specify version 3, but the policy has no conditional role bindings, the
response uses version 1. To learn which resources support conditions in
their IAM policies, see the [IAM
documentation](https://cloud.google.com/iam/help/conditions/resource-
policies).
r r` r N) r r
r r r r rb rc rd requestedPolicyVersionr r r r ra ra s( " %11!Y=N=N=T=TUr ra c \ rS rSrSr " S S\R 5 r\R " SSS9r \R " SS5 r \R " S S
SS9r
S rg )
IngressFromi a Defines the conditions under which an IngressPolicy matches a request.
Conditions are based on information about the source of the request. The
request must satisfy what is defined in `sources` AND identity related
fields in order to match.
Enums:
IdentityTypeValueValuesEnum: Specifies the type of identities that are
allowed access from outside the perimeter. If left unspecified, then
members of `identities` field will be allowed access.
Fields:
identities: A list of identities that are allowed access through
IngressPolicy. Identities can be an individual user, service account,
Google group, or third-party identity. For third-party identity, only
single identities are supported and other identity types are not
supported. The `v1` identities that have the prefix `user`, `group`,
`serviceAccount`, and `principal` in
https://cloud.google.com/iam/docs/principal-identifiers#v1 are
supported.
identityType: Specifies the type of identities that are allowed access
from outside the perimeter. If left unspecified, then members of
`identities` field will be allowed access.
sources: Sources that this IngressPolicy authorizes access from.
c ( \ rS rSrSrSrSrSrSrSr g) 'IngressFrom.IdentityTypeValueValuesEnumi4 a Specifies the type of identities that are allowed access from outside
the perimeter. If left unspecified, then members of `identities` field
will be allowed access.
Values:
IDENTITY_TYPE_UNSPECIFIED: No blanket identity group specified.
ANY_IDENTITY: Authorize access from all identities outside the
perimeter.
ANY_USER_ACCOUNT: Authorize access from all human users outside the
perimeter.
ANY_SERVICE_ACCOUNT: Authorize access from all service accounts outside
the perimeter.
r r r r r Nr7 r r r r< rh 4 r= r r< r Tr1 r
IngressSourcer r N)r r
r r r r rW r< r% rE rX rF r! rH r r r r rf rf sR 2 INN & $$Q6*$$%BAF, " "?A E'r rf c \ rS rSrSr\R " SS5 r\R " SS5 r\R " S5 r
Sr g )
IngressPolicyiL a Policy for ingress into ServicePerimeter. IngressPolicies match requests
based on `ingress_from` and `ingress_to` stanzas. For an ingress policy to
match, both the `ingress_from` and `ingress_to` stanzas must be matched. If
an IngressPolicy matches a request, the request is allowed through the
perimeter boundary from outside the perimeter. For example, access from the
internet can be allowed either based on an AccessLevel or, for traffic
hosted on Google Cloud, the project of the source network. For access from
private networks, using the project of the hosting network is required.
Individual ingress policies can be limited by restricting which services
and/or actions they match using the `ingress_to` field.
Fields:
ingressFrom: Defines the conditions on the source of a request causing
this IngressPolicy to apply.
ingressTo: Defines the conditions on the ApiOperation and request
destination that cause this IngressPolicy to apply.
title: Optional. Human-readable title for the ingress rule. The title must
be unique within the perimeter and can not exceed 100 characters. Within
the access policy, the combined length of all rule titles must not
exceed 240,000 characters.
rf r IngressTor r r N) r r
r r r r r! ingressFrom ingressTor% r( r r r r rk rk L s= , &&}a8+$$[!4)
"%r rk c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)ri ih a The source that IngressPolicy authorizes access from.
Fields:
accessLevel: An AccessLevel resource name that allows resources within the
ServicePerimeters to be accessed from the internet. AccessLevels listed
must be in the same policy as this ServicePerimeter. Referencing a
nonexistent AccessLevel will cause an error. If an AccessLevel
AccessLevel name is not specified, resources within the perimeter can
only be accessed through Google Cloud calls with request origins within
the perimeter. Example:
`accessPolicies/MY_POLICY/accessLevels/MY_LEVEL`. If a single `*` is
specified for `access_level`, then all IngressSources will be allowed.
resource: A Google Cloud resource that is allowed to ingress the
perimeter. Requests from these resources are allowed to access perimeter
data. Only projects and VPCs are allowed. Project format:
`projects/{project_number}`. VPC network format: `//compute.googleapis.c
om/projects/{PROJECT_ID}/global/networks/{NETWORK_NAME}`. The resource
might be in any Google Cloud organization, not just the organization
that the perimeter is defined in. `*` is not allowed, the case of
allowing all Google Cloud resources only is not supported.
r r r NrO r r r ri ri h s) , %%a(+
"
"1
%(r ri c \ rS rSrSr\R " SSSS9r\R " SSS9r \R " SSS9r
S r g
) rl i a Defines the conditions under which an IngressPolicy matches a request.
Conditions are based on information about the ApiOperation intended to be
performed on the target resource of the request. The request must satisfy
what is defined in `operations` AND `resources` in order to match.
Fields:
operations: A list of ApiOperations the sources specified in corresponding
IngressFrom are allowed to perform in this ServicePerimeter.
resources: A list of resources, currently only projects in the form
`projects/`, protected by this ServicePerimeter that are allowed to be
accessed by sources defined in the corresponding IngressFrom. If a
single `*` is specified, then access to all resources inside the
perimeter are allowed.
roles: IAM roles that represent the set of operations that the sources
specified in the corresponding IngressFrom are allowed to perform in
this ServicePerimeter.
r r Tr1 r r r N) r r
r r r r r! rR r% rS rT r r r r rl rl sA $ %%na$G*##A5)
D
1%r rl c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListAccessLevelsResponsei zA response to `ListAccessLevelsRequest`.
Fields:
accessLevels: List of the Access Level instances.
nextPageToken: The pagination token to retrieve the next page of results.
If the value is empty, no further results remain.
r r Tr1 r r N) r r
r r r r r! r? r%
nextPageTokenr r r r rr rr s- ''
q4H,''*-r rr c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListAccessPoliciesResponsei zA response to `ListAccessPoliciesRequest`.
Fields:
accessPolicies: List of the AccessPolicy instances.
nextPageToken: The pagination token to retrieve the next page of results.
If the value is empty, no further results remain.
r/ r Tr1 r r N) r r
r r r r r! accessPoliciesr% rs r r r r ru ru s- )).!dK.''*-r ru c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
ListAuthorizedOrgsDescsResponsei zA response to `ListAuthorizedOrgsDescsRequest`.
Fields:
authorizedOrgsDescs: List of the Authorized Orgs Desc instances.
nextPageToken: The pagination token to retrieve the next page of results.
If the value is empty, no further results remain.
rx r Tr1 r r N) r r
r r r r r! authorizedOrgsDescsr% rs r r r r rx rx s0 "../CQQUV''*-r rx c ` \ rS rSrSr\R " SSSS9r\R " S5 r Sr
g )
!ListGcpUserAccessBindingsResponsei zResponse of ListGcpUserAccessBindings.
Fields:
gcpUserAccessBindings: GcpUserAccessBinding
nextPageToken: Token to get the next page of items. If blank, there are no
more items.
r r Tr1 r r N) r r
r r r r r! gcpUserAccessBindingsr% rs r r r r r{ r{ s0 $001GUYZ''*-r r{ c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
ListServicePerimetersResponsei zA response to `ListServicePerimetersRequest`.
Fields:
nextPageToken: The pagination token to retrieve the next page of results.
If the value is empty, no further results remain.
servicePerimeters: List of the Service Perimeter instances.
r r r Tr1 r N) r r
r r r r r% rs r! r
r r r r r~ r~ / ''*- ,,-?TRr r~ c ^ \ rS rSrSr\R " S5 r\R " SSS9rSr g) ListSupportedPermissionsResponsei zA response to `ListSupportedPermissionsRequest`.
Fields:
nextPageToken: The pagination token to retrieve the next page of results.
If the value is empty, no further results remain.
supportedPermissions: List of VPC-SC supported permissions.
r r Tr1 r N)
r r
r r r r r% rs supportedPermissionsr r r r r r s, ''*-"..q4@r r c ` \ rS rSrSr\R " S5 r\R " SSSS9r Sr
g )
ListSupportedServicesResponsei zA response to `ListSupportedServicesRequest`.
Fields:
nextPageToken: The pagination token to retrieve the next page of results.
If the value is empty, no further results remain.
supportedServices: List of services supported by VPC-SC instances.
r SupportedServicer Tr1 r N) r r
r r r r r% rs r! supportedServicesr r r r r r r r r c ` \ rS rSrSr\R " S5 r\R " S5 rSr g)r i an An allowed method or permission of a service specified in ApiOperation.
Fields:
method: A valid method name for the corresponding `service_name` in
ApiOperation. If `*` is used as the value for the `method`, then ALL
methods and permissions are allowed.
permission: A valid Cloud IAM permission for the corresponding
`service_name` in ApiOperation.
r r r N)
r r
r r r r r% method
permissionr r r r r r s) #&$$Q'*r r c > \ rS rSrSr\R " SS5 rSrg)Modifieri zjModifier to apply to the API requests.
Fields:
addRequestHeader: Adds additional HTTP request headers.
r r r N) r r
r r r r r! addRequestHeaderr r r r r r s ++,>Br r c z \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S5 " S S\R 5 5 r
\R " S5 r \R " S S
5 r\R " SS 5 r\R " S 5 r\R " SS
5 rSrg) Operationi a This resource represents a long-running operation that is the result of
a network API call.
Messages:
MetadataValue: Service-specific metadata associated with the operation. It
typically contains progress information and common metadata such as
create time. Some services might not provide such metadata. Any method
that returns a long-running operation should document the metadata type,
if any.
ResponseValue: The normal, successful response of the operation. If the
original method returns no data on success, such as `Delete`, the
response is `google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
Fields:
done: If the value is `false`, it means the operation is still in
progress. If `true`, the operation is completed, and either `error` or
`response` is available.
error: The error result of the operation in case of failure or
cancellation.
metadata: Service-specific metadata associated with the operation. It
typically contains progress information and common metadata such as
create time. Some services might not provide such metadata. Any method
that returns a long-running operation should document the metadata type,
if any.
name: The server-assigned name, which is only unique within the same
service that originally returns it. If you use the default HTTP mapping,
the `name` should be a resource name ending with
`operations/{unique_id}`.
response: The normal, successful response of the operation. If the
original method returns no data on success, such as `Delete`, the
response is `google.protobuf.Empty`. If the original method is standard
`Get`/`Create`/`Update`, the response should be the resource. For other
methods, the response should have the type `XxxResponse`, where `Xxx` is
the original method name. For example, if the original method name is
`TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
additionalPropertiesc f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Operation.MetadataValuei9 a Service-specific metadata associated with the operation. It typically
contains progress information and common metadata such as create time.
Some services might not provide such metadata. Any method that returns a
long-running operation should document the metadata type, if any.
Messages:
AdditionalProperty: An additional property for a MetadataValue object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)*Operation.MetadataValue.AdditionalPropertyiH zAn additional property for a MetadataValue object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r extra_types.JsonValuer r N r r
r r r r r% r r! r r r r r AdditionalPropertyr H ,
! !! $c$$% \ rS rSrSr\R " SS5 rSrg)r
iJ zmRisk-based access level.
Fields:
userManagedRisk: The user managed risk associated with the access level.
UserManagedRiskr r N) r r
r r r r r! userManagedRiskr r r r r
r
J s **+. ))*:A>.
2%r rZ c \ rS rSrSr\R " SSSS9r\R " S5 r \R " S5 r
S r g
) ServicePatterni} aX Service patterns used to allow access.
Fields:
modifiers: Modifiers to apply to the requests that match the URL pattern.
pattern: URL pattern to allow. Only patterns of ".googleapis.com/*",
"www.googleapis.com//*" and "*.appspot.com/* form are supported, where
should be alphanumerical name.
service: Supported service to allow.
r r Tr1 r r r N) r r
r r r r r! modifiersr% patternr r r r r r r } s= $$ZTB) ! !! $' ! !! $'r r c h \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S5 r \R " SS5 r
\R " S S
5 r\R " S S 5 r\R " S 5 r\R$ " S
5 rSrg)r i a
`ServicePerimeter` describes a set of Google Cloud resources which can
freely import and export data amongst themselves, but not export outside of
the `ServicePerimeter`. If a request with a source within this
`ServicePerimeter` has a target outside of the `ServicePerimeter`, the
request is blocked. Otherwise the request is allowed. There are two types of
service perimeter: regular and bridge. Regular perimeters cannot overlap, a
single Google Cloud project or VPC network can only belong to a single
regular perimeter. Perimeter bridges can contain only Google Cloud projects
as members, a single Google Cloud project might belong to multiple Service
perimeter bridges.
Enums:
PerimeterTypeValueValuesEnum: Perimeter type indicator. A single project
or VPC network is allowed to be a member of single regular perimeter,
but a project can be in multiple service perimeter bridges. A project
cannot be a included in a perimeter bridge without being included in
regular perimeter. For perimeter bridges, the restricted service list as
well as access level lists must be empty.
Fields:
description: Description of the `ServicePerimeter` and its use. Does not
affect behavior.
etag: Optional. An opaque identifier for the current version of the
`ServicePerimeter`. This identifier does not follow any specific format.
If an etag is not provided, the operation will be performed as if a
valid etag is provided.
name: Identifier. Resource name for the `ServicePerimeter`. Format:
`accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`.
The `service_perimeter` component must begin with a letter, followed by
alphanumeric characters or `_`. After you create a `ServicePerimeter`,
you cannot change its `name`.
perimeterType: Perimeter type indicator. A single project or VPC network
is allowed to be a member of single regular perimeter, but a project can
be in multiple service perimeter bridges. A project cannot be a included
in a perimeter bridge without being included in regular perimeter. For
perimeter bridges, the restricted service list as well as access level
lists must be empty.
spec: Proposed (or dry run) ServicePerimeter configuration. This
configuration allows to specify and test ServicePerimeter configuration
without enforcing actual access restrictions. Only allowed to be set
when the "use_explicit_dry_run_spec" flag is set.
status: Current ServicePerimeter configuration. Specifies sets of
resources, restricted services and access levels that determine
perimeter content and boundaries.
title: Human readable title. Must be unique within the Policy.
useExplicitDryRunSpec: Use explicit dry run spec flag. Ordinarily, a dry-
run spec implicitly exists for all Service Perimeters, and that spec is
identical to the status for those Service Perimeters. When this flag is
set, it inhibits the generation of the implicit spec, thereby allowing
the user to explicitly provide a configuration ("spec") to use in a dry-
run version of the Service Perimeter. This allows the user to test
changes to the enforced config ("status") without actually enforcing
them. This testing is done through analyzing the differences between
currently enforced and suggested restrictions. use_explicit_dry_run_spec
must bet set to True if any of the fields in the spec are set to non-
default values.
c \ rS rSrSrSrSrSrg)-ServicePerimeter.PerimeterTypeValueValuesEnumi a Perimeter type indicator. A single project or VPC network is allowed
to be a member of single regular perimeter, but a project can be in
multiple service perimeter bridges. A project cannot be a included in a
perimeter bridge without being included in regular perimeter. For
perimeter bridges, the restricted service list as well as access level
lists must be empty.
Values:
PERIMETER_TYPE_REGULAR: Regular Perimeter. When no value is specified,
the perimeter uses this type.
PERIMETER_TYPE_BRIDGE: Perimeter Bridge.
r r r N)r r
r r r PERIMETER_TYPE_REGULARPERIMETER_TYPE_BRIDGEr r r r PerimeterTypeValueValuesEnumr s r r r r r r ServicePerimeterConfigr r r r r N)r r
r r r r rW r r% r& r3 r' rX
perimeterTyper! specstatusr( r+ useExplicitDryRunSpecr r r r r r s 8t Y^^ %%a(+ q !$ q !$%%&DaH- 8! <$ ! !":A >&
"%#003r r c \ rS rSrSr\R " SSS9r\R " SSSS9r \R " SS SS9r
\R " S
SS9r \R " S SS9r \R " S S
5 r
Srg)r i a' `ServicePerimeterConfig` specifies a set of Google Cloud resources that
describe specific Service Perimeter configuration.
Fields:
accessLevels: A list of `AccessLevel` resource names that allow resources
within the `ServicePerimeter` to be accessed from the internet.
`AccessLevels` listed must be in the same policy as this
`ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax
error. If no `AccessLevel` names are listed, resources within the
perimeter can only be accessed through Google Cloud calls with request
origins within the perimeter. Example:
`"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service
Perimeter Bridge, must be empty.
egressPolicies: List of EgressPolicies to apply to the perimeter. A
perimeter may have multiple EgressPolicies, each of which is evaluated
separately. Access is granted if any EgressPolicy grants it. Must be
empty for a perimeter bridge.
ingressPolicies: List of IngressPolicies to apply to the perimeter. A
perimeter may have multiple IngressPolicies, each of which is evaluated
separately. Access is granted if any Ingress Policy grants it. Must be
empty for a perimeter bridge.
resources: A list Google Cloud resources that are inside of the service
perimeter. Only projects, VPCs are allowed. Project format:
`projects/{project_number}`. VPC network format: `//compute.googleapis.c
om/projects/{PROJECT_ID}/global/networks/{NETWORK_NAME}`.
restrictedServices: Google Cloud services that are subject to the Service
Perimeter restrictions. For example, if `storage.googleapis.com` is
specified, access to the storage buckets inside the perimeter must meet
the perimeter's access restrictions.
vpcAccessibleServices: Configuration for APIs allowed within Perimeter.
r Tr1 rJ r rk r r r VpcAccessibleServicesr r N)r r
r r r r r% r? r! egressPoliciesingressPoliciesrS restrictedServicesvpcAccessibleServicesr r r r r r s} @ &&q48, )).!dK. **?AM/##A5) ,,Q>#001H!Lr r c \ rS rSrSr " S S\R 5 r\R " S5 r \R " S5 r
\R " S5 r \R " SS5 r\R " S 5 rS
rg ) r> i aE Stores settings related to Google Cloud Session Length including session
duration, the type of challenge (i.e. method) they should face when their
session expires, and other related settings.
Enums:
SessionReauthMethodValueValuesEnum: Optional. Session method when user's
Google Cloud session is up.
Fields:
maxInactivity: Optional. How long a user is allowed to take between
actions before a new access token must be issued. Only set for Google
Cloud apps.
sessionLength: Optional. The session length. Setting this field to zero is
equal to disabling reauth. Also can set infinite session by flipping the
enabled bit to false below. If use_oidc_max_age is true, for OIDC apps,
the session length will be the minimum of this field and OIDC max_age
param.
sessionLengthEnabled: Optional. This field enables or disables Google
Cloud session length. When false, all fields set above will be
disregarded and the session length is basically infinite.
sessionReauthMethod: Optional. Session method when user's Google Cloud
session is up.
useOidcMaxAge: Optional. Only useful for OIDC apps. When false, the OIDC
max_age param, if passed in the authentication request will be ignored.
When true, the re-auth period will be the minimum of the session_length
field and the max_age OIDC param.
c ( \ rS rSrSrSrSrSrSrSr g) 2SessionSettings.SessionReauthMethodValueValuesEnumi( ak Optional. Session method when user's Google Cloud session is up.
Values:
SESSION_REAUTH_METHOD_UNSPECIFIED: If method is undefined in the API,
LOGIN will be used by default.
LOGIN: The user will be prompted to perform regular login. Users who are
enrolled for two-step verification and haven't chosen "Remember this
computer" will be prompted for their second factor.
SECURITY_KEY: The user will be prompted to authenticate using their
security key. If no security key has been configured, then
authentication will fallback to LOGIN.
PASSWORD: The user will be prompted for their password.
r r r r r N)
r r
r r r !SESSION_REAUTH_METHOD_UNSPECIFIEDLOGIN SECURITY_KEYPASSWORDr r r r "SessionReauthMethodValueValuesEnumr ( s )*%
ELHr r r r r r r r N)r r
r r r r rW r r%
maxInactivity
sessionLengthr+ sessionLengthEnabledrX sessionReauthMethod
useOidcMaxAger r r r r> r> so 89>> & ''*-''*-"//2!++,PRST((+-r r> c b \ rS rSrSr\R " SS5 r\R " S5 r Sr
g)r iB a
Request message for `SetIamPolicy` method.
Fields:
policy: REQUIRED: The complete policy to be applied to the `resource`. The
size of the policy is limited to a few 10s of KB. An empty policy is a
valid policy but certain Google Cloud services (such as Projects) might
reject them.
updateMask: OPTIONAL: A FieldMask specifying which fields of the policy to
modify. Only the fields in the mask will be modified. If no mask is
provided, the following default mask is used: `paths: "bindings, etag"`
r r r r N) r r
r r r r r! policyr% rj r r r r r r B s+
! !(A .&$$Q'*r r c \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " SS5 r
\R " S5 r \R " SS S
S 9r
\R " S 5 r\R " S
5 r\R " S5 r\R " S5 r\R$ " SSS 9r\R " S5 r\R " S5 r\R " S5 r\R " S5 rSrg)StandardQueryParametersiS a Query parameters accepted by all methods.
Enums:
FXgafvValueValuesEnum: V1 error format.
AltValueValuesEnum: Data format for response.
Fields:
f__xgafv: V1 error format.
access_token: OAuth access token.
alt: Data format for response.
callback: JSONP
fields: Selector specifying which fields to include in a partial response.
key: API key. Your API key identifies your project and provides you with
API access, quota, and reports. Required unless you provide an OAuth 2.0
token.
oauth_token: OAuth 2.0 token for the current user.
prettyPrint: Returns response with indentations and line breaks.
quotaUser: Available to use for quota purposes for server-side
applications. Can be any arbitrary string assigned to a user, but should
not exceed 40 characters.
trace: A tracing token of the form "token:" to include in api
requests.
uploadType: Legacy upload protocol for media (e.g. "media", "multipart").
upload_protocol: Upload protocol for media (e.g. "raw", "multipart").
c $ \ rS rSrSrSrSrSrSrg)*StandardQueryParameters.AltValueValuesEnumin zData format for response.
Values:
json: Responses with Content-Type of application/json
media: Media download with context-dependent Content-Type
proto: Responses with Content-Type of application/x-protobuf
r r r r N) r r
r r r jsonmediaprotor r r r AltValueValuesEnumr n s
D
E
Er r c \ rS rSrSrSrSrSrg)-StandardQueryParameters.FXgafvValueValuesEnumiz zFV1 error format.
Values:
_1: v1 error format
_2: v2 error format
r r r N)r r
r r r _1_2r r r r FXgafvValueValuesEnumr z s
B
Br r r r r r )defaultr r r r r Tr
r N)r r
r r r r rW r r rX f__xgafvr% access_tokenaltcallbackfieldsr oauth_tokenr+ prettyPrint quotaUsertrace
uploadTypeupload_protocolr r r r r r S s 4
9>>
inn
!8!
<(&&q), 0!VD#
"
"1
%( #& a #%%a(+&&q$7+##A&)
#%$$R(* ))"-/r r c \ rS rSrSr\R " S5 " S S\R 5 5 r \R " S\R R S9r
\R " SSS S
9r\R " S 5 rS rg
)r i a The `Status` type defines a logical error model that is suitable for
different programming environments, including REST APIs and RPC APIs. It is
used by [gRPC](https://github.com/grpc). Each `Status` message contains
three pieces of data: error code, error message, and error details. You can
find out more about this error model and how to work with it in the [API
Design Guide](https://cloud.google.com/apis/design/errors).
Messages:
DetailsValueListEntry: A DetailsValueListEntry object.
Fields:
code: The status code, which should be an enum value of google.rpc.Code.
details: A list of messages that carry the error details. There is a
common set of message types for APIs to use.
message: A developer-facing error message, which should be in English. Any
user-facing error message should be localized and sent in the
google.rpc.Status.details field, or localized by the client.
r c f \ rS rSrSr " S S\R 5 r\R " SSSS9r Sr
g )
Status.DetailsValueListEntryi zA DetailsValueListEntry object.
Messages:
AdditionalProperty: An additional property for a DetailsValueListEntry
object.
Fields:
additionalProperties: Properties of the object. Contains field @type
with type URL.
c b \ rS rSrSr\R " S5 r\R " SS5 r Sr
g)/Status.DetailsValueListEntry.AdditionalPropertyi zAn additional property for a DetailsValueListEntry object.
Fields:
key: Name of the additional property.
value: A extra_types.JsonValue attribute.
r r r r Nr r r r r r r r r r Tr1 r Nr r r r DetailsValueListEntryr s4 AY . . A %112FTXYr r r r` r Tr1 r r N)r r
r r r r r r r r rb rc rd coder! detailsr% messager r r r r r s| & !!"89Zi / / Z :Z2
9+<+<+B+B C$ " "#:A M' ! !! $'r r c l \ rS rSrSr " S S\R 5 r " S S\R 5 r\R " S5 r
\R " S5 r \R " S 5 r
\R " SS
5 r\R " SS 5 r\R" " S S
SS9r\R " S5 rSrg)r i a+ `SupportedService` specifies the VPC Service Controls and its
properties.
Enums:
ServiceSupportStageValueValuesEnum: The support stage of the service.
SupportStageValueValuesEnum: The support stage of the service.
Fields:
availableOnRestrictedVip: True if the service is available on the
restricted VIP. Services on the restricted VIP typically either support
VPC Service Controls or are core infrastructure services required for
the functioning of Google Cloud.
knownLimitations: True if the service is supported with some limitations.
Check [documentation](https://cloud.google.com/vpc-service-
controls/docs/supported-products) for details.
name: The service name/address of the supported service, such as
'service.googleapis.com'
serviceSupportStage: The support stage of the service.
supportStage: The support stage of the service.
supportedMethods: The list of the supported methods. This field exists
only in response to GetSupportedService
title: The name of the supported product, such as 'Cloud Product API'.
c ( \ rS rSrSrSrSrSrSrSr g) 3SupportedService.ServiceSupportStageValueValuesEnumi a The support stage of the service.
Values:
SERVICE_SUPPORT_STAGE_UNSPECIFIED: Do not use this default value.
GA: GA features are open to all developers and are considered stable and
fully qualified for production use.
PREVIEW: PREVIEW indicates a pre-release stage where the product is
functionally complete but undergoing real-world testing.
DEPRECATED: Deprecated features are scheduled to be shut down and
removed.
r r r r r N)
r r
r r r !SERVICE_SUPPORT_STAGE_UNSPECIFIEDGAPREVIEW
DEPRECATEDr r r r "ServiceSupportStageValueValuesEnumr s
)*%
BGJr r" c 8 \ rS rSrSrSrSrSrSrSr Sr
S r S
r S r
g )
,SupportedService.SupportStageValueValuesEnumi a The support stage of the service.
Values:
LAUNCH_STAGE_UNSPECIFIED: Do not use this default value.
UNIMPLEMENTED: The feature is not yet implemented. Users can not use it.
PRELAUNCH: Prelaunch features are hidden from users and are only visible
internally.
EARLY_ACCESS: Early Access features are limited to a closed group of
testers. To use these features, you must sign up in advance and sign a
Trusted Tester agreement (which includes confidentiality provisions).
These features may be unstable, changed in backward-incompatible ways,
and are not guaranteed to be released.
ALPHA: Alpha is a limited availability test for releases before they are
cleared for widespread use. By Alpha, all significant design issues
are resolved and we are in the process of verifying functionality.
Alpha customers need to apply for access, agree to applicable terms,
and have their projects allowlisted. Alpha releases don't have to be
feature complete, no SLAs are provided, and there are no technical
support obligations, but they will be far enough along that customers
can actually use them in test environments or for limited-use tests --
just like they would in normal production cases.
BETA: Beta is the point at which we are ready to open a release for any
customer to use. There are no SLA or technical support obligations in
a Beta release. Products will be complete from a feature perspective,
but may have some open outstanding issues. Beta releases are suitable
for limited production use cases.
GA: GA features are open to all developers and are considered stable and
fully qualified for production use.
DEPRECATED: Deprecated features are scheduled to be shut down and
removed. For more information, see the "Deprecation Policy" section of
our [Terms of Service](https://cloud.google.com/terms/) and the
[Google Cloud Platform Subject to the Deprecation
Policy](https://cloud.google.com/terms/deprecation) documentation.
r r r r r r r r r N)r r
r r r LAUNCH_STAGE_UNSPECIFIED
UNIMPLEMENTED PRELAUNCH EARLY_ACCESSALPHABETAr r! r r r r SupportStageValueValuesEnumr$ s3 !D ! MIL
E D
BJr r+ r r r r r r r Tr1 r r N)r r
r r r r rW r" r+ r+ availableOnRestrictedVipknownLimitationsr% r' rX serviceSupportStage supportStager! supportedMethodsr( r r r r r r s 09>> "*INN *X ' 3 3A 6 ++A. q !$!++,PRST$$%BAF, ++, ).. $$Q6*""#>B*r r c > \ rS rSrSr\R " SS5 rSrg)r i\
zUser managed risk associated with the access level.
Fields:
riskType: The type of the risks associated with the access level.
r r r N) r r
r r r r r! riskTyper r r r r r \
s
#
#J
2(r r c \ rS rSrSr " S S\R 5 r\R " SSSS9r \R " S SS9r \R " S
5 r
\R " SS SS9rS rg
)r if
a@ Specifies how APIs are allowed to communicate within the Service
Perimeter.
Enums:
ServicePatternsEnforcementScopesValueListEntryValuesEnum:
Fields:
allowedServicePatterns: Specifies which Google services are allowed to be
accessed from VPC networks in the service perimeter.
allowedServices: The list of APIs usable within the Service Perimeter.
Must be empty unless 'enable_restriction' is True. You can specify a
list of individual services, as well as include the 'RESTRICTED-
SERVICES' value, which automatically includes all of the services
protected by the perimeter.
enableRestriction: Whether to restrict API calls within the Service
Perimeter to the list of APIs specified in 'allowed_services'.
servicePatternsEnforcementScopes: Defines the enforcement scopes of
service patterns.
c \ rS rSrSrSrSrSrg)NVpcAccessibleServices.ServicePatternsEnforcementScopesValueListEntryValuesEnumi{
a ServicePatternsEnforcementScopesValueListEntryValuesEnum enum type.
Values:
SERVICE_PATTERNS_ENFORCEMENT_SCOPE_UNSPECIFIED: Default value. This can
not be used.
GOOGLE_APIS_VIA_PRIVATE_PATH: Enables VPC Accessible Services
enforcement for all APIs (including unsupported APIs) for Private
Google Access configured with Private VIP and Private Service Connect
Endpoint for Global Google APIs that uses 'all-apis' bundle.
r r r N)r r
r r r .SERVICE_PATTERNS_ENFORCEMENT_SCOPE_UNSPECIFIED GOOGLE_APIS_VIA_PRIVATE_PATHr r r r 8ServicePatternsEnforcementScopesValueListEntryValuesEnumrB {
s 672#$ r rE r r Tr1 r r r r N)r r
r r r r rW rE r! allowedServicePatternsr% allowedServicesr+ enableRestrictionrX servicePatternsEnforcementScopesr r r r r r f
sr ( % % %112BAPTU ))!d;/ ,,Q/%.%8%89suv BF &G"r r c > \ rS rSrSr\R " SS5 rSrg)r i
zoThe originating network source in Google Cloud.
Fields:
vpcSubnetwork: Sub-segment ranges of a VPC network.
VpcSubNetworkr r N) r r
r r r r r!
vpcSubnetworkr r r r r r
s (( !<-r r c ^ \ rS rSrSr\R " S5 r\R " SSS9rSr g) rK i
aC Sub-segment ranges inside of a VPC Network.
Fields:
network: Required. Network name. If the network is not part of the
organization, the `compute.network.get` permission must be granted to
the caller. Format: `//compute.googleapis.com/projects/{PROJECT_ID}/glob
al/networks/{NETWORK_NAME}` Example:
`//compute.googleapis.com/projects/my-project/global/networks/network-1`
vpcIpSubnetworks: CIDR block IP subnetwork specification. The IP address
must be an IPv4 address and can be a public or private IP address. Note
that for a CIDR IP address block, the specified IP address portion must
be properly truncated (i.e. all the host bits must be zero) or the input
is considered malformed. For example, "192.0.2.0/24" is accepted but
"192.0.2.1/24" is not. If empty, all IP addresses are allowed.
r r Tr1 r N)
r r
r r r r r% networkvpcIpSubnetworksr r r r rK rK
s,
! !! $' **1t<r rK r z$.xgafvr 1r 2N)ur
__future__r apitools.base.protorpcliter r apitools.base.pyr r packager r r r r/ r7 r< rB rH rM r[ rh rl rp rw r{ r} r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r rx r r r9 r r r r r r4 rJ rD rK r r r ra rf rk ri rl rr ru rx r{ r~ r r r r r r, r rY rm r r r r
r rZ r r r r> r r r r rq r5 r r r r rK AddCustomJsonFieldMappingAddCustomJsonEnumMappingr r r r rX s ' < % ( !GI,=,= G#)## #8 5)++ 5 $#9$$ $#N9)## 9AY&& A"
3)BSBS
31)BSBS 1*1y?P?P *1Z'3 @Q@Q '3T(ARAR (& WiFWFW W UiN_N_ U$ 3IZIZ 3
1IZIZ
1 1iFWFW 13yGXGX 3$( HYHY (*1i6G6G 1
5I-> 1
'i.?.?
' #y(( #)9$$ )& ")## "%)## %: =Y&& =Di1** i1X%E"" %EPT"i T"n I)## I"Y%6%6 "" Si&7&7 S4S !! 4Sn +)## +E09$$ E0PJE"" JEZ#9$$ #<&9$$ &0 2y 2F!#9 !#H.A9,, .Ab:)++ :Vy(( V*/F)## /Fd#I%% #8&I%% &62 !! 20
+y 0 0
+
+!2!2
+
+i&7&7
+
+ (9(9
+
SI$5$5
S
Ay'8'8
A
SI$5$5
S (Y&& ( Cy Ci8 !! i8X(69$$ (6VKGY
KG\9 !! 90"!2!2 "(I)"3"3 ISi&7&7 S(Sy'8'8 SA9 A+y +.39,, 3$
%Y&&
% R4y(( R4j&MY . . &MR4,i'' 4,n()++ ("<.i / / <.~0%Y
0%f\#y(( \#~
8 1 1
88!2!2 8 C )) C@3i'' 3&GI - - &GR=y(( ==I%% =* " "Z4 ! !114> ! !114>r