*fSrSSKJr SSKJr SSKJr SSKJr Sr "SS\R5r "S S \R5r "S S \R5r "S S\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS\R5r"SS \R5r"S!S"\R5r"S#S$\R5r"S%S&\R5r"S'S(\R5r"S)S*\R5r"S+S,\R5r"S-S.\R5r"S/S0\R5r"S1S2\R5r "S3S4\R5r!"S5S6\R5r""S7S8\R5r#"S9S:\R5r$"S;S<\R5r%"S=S>\R5r&"S?S@\R5r'"SASB\R5r("SCSD\R5r)"SESF\R5r*"SGSH\R5r+"SISJ\R5r,"SKSL\R5r-"SMSN\R5r."SOSP\R5r/"SQSR\R5r0"SSST\R5r1"SUSV\R5r2"SWSX\R5r3"SYSZ\R5r4"S[S\\R5r5"S]S^\R5r6"S_S`\R5r7"SaSb\R5r8"ScSd\R5r9"SeSf\R5r:"SgSh\R5r;"SiSj\R5r<"SkSl\R5r="SmSn\R5r>"SoSp\R5r?"SqSr\R5r@"SsSt\R5rA"SuSv\R5rB"SwSx\R5rC"SySz\R5rD"S{S|\R5rE"S}S~\R5rF"SS\R5rG"SS\R5rH"SS\R5rI"SS\R5rJ"SS\R5rK"SS\R5rL"SS\R5rM"SS\R5rN"SS\R5rO"SS\R5rP"SS\R5rQ"SS\R5rR"SS\R5rS"SS\R5rT"SS\R5rU"SS\R5rV"SS\R5rW"SS\R5rX"SS\R5rY"SS\R5rZ"SS\R5r["SS\R5r\"SS\R5r]"SS\R5r^"SS\R5r_"SS\R5r`"SS\R5ra"SS\R5rb"SS\R5rc"SS\R5rd"SS\R5re"SS\R5rf"SS\R5rg"SS\R5rh"SS\R5ri"SS\R5rj"SS\R5rk"SS\R5rl"SS\R5rm"SS\R5rn"SS\R5ro"SS\R5rp"SS\R5rq"SS\R5rr"SS\R5rs"SS\R5rt"SS\R5ru"SS\R5rv"SS\R5rw"SS\R5rx"SS\R5ry"SS\R5rz"SS\R5r{\R"\{SS5 \R"\{RSS5 \R"\{RSS5 g)aGenerated message classes for iam version v3alpha. Manages identity and access control for Google Cloud resources, including the creation of service accounts, which you can use to authenticate to Google and make API calls. Enabling this API also enables the IAM Service Account Credentials API (iamcredentials.googleapis.com). However, disabling this API doesn't disable the IAM Service Account Credentials API. )absolute_import)messages)encoding) extra_typesiamc>\rSrSrSr\R "SS5rSrg)GoogleIamAdminV1AuditDatazAudit log information specific to Cloud IAM admin APIs. This message is serialized as an `Any` type in the `ServiceData` message of an `AuditLog` message. Fields: permissionDelta: The permission_delta when when creating or updating a Role. (GoogleIamAdminV1AuditDataPermissionDeltaN) __name__ __module__ __qualname____firstlineno____doc__ _messages MessageFieldpermissionDelta__static_attributes__r Mlib/googlecloudsdk/generated_clients/apis/iam/v3alpha/iam_v3alpha_messages.pyr r s**+UWXY/rr c\\rSrSrSr\R "SSS9r\R "SSS9rSr g) r "zA PermissionDelta message to record the added_permissions and removed_permissions inside a role. Fields: addedPermissions: Added permissions. removedPermissions: Removed permissions. r Trepeatedr N) rrrrrr StringFieldaddedPermissionsremovedPermissionsrr rrr r "s/**1t< ,,Q>rr c\rSrSrSr\R "SS5r\R"SSS9r \R"S5r S r g ) GoogleIamV1Binding/atAssociates `members`, or principals, with a `role`. Fields: condition: The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource- policies). members: Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other- app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how- to/kubernetes-service-accounts). For example, `my- project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locatio ns/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.goog leapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.co m/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{ attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePo ols/{pool_id}/*`: All identities in a workforce identity pool. * `princi pal://iam.googleapis.com/projects/{project_number}/locations/global/work loadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.c om/projects/{project_number}/locations/global/workloadIdentityPools/{poo l_id}/group/{group_id}`: A workload identity pool group. * `principalSet ://iam.googleapis.com/projects/{project_number}/locations/global/workloa dIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * ` principalSet://iam.googleapis.com/projects/{project_number}/locations/gl obal/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other- app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.google apis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attr ibute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workfo rcePools/my-pool-id/subject/my-subject-attribute-value`. role: Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles). GoogleTypeExprr rTrr N) rrrrrrr conditionrmembersrolerr rrr"r"/s@Ob$$%5q9)  ! !!d 3'   q !$rr"c\rSrSrSr\R "S5"SS\R55r \R"SS5r \R"S5r \R"SS 5r\R"S 5r\R"S 5r\R"S 5r\R"S 5r\R"S5rSrg)GoogleIamV3alphaAccessPolicyaAn IAM access policy resource. Messages: AnnotationsValue: Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations Fields: annotations: Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations createTime: Output only. The time when the access policy was created. details: Optional. The details for the access policy. displayName: Optional. The description of the access policy. Must be less than or equal to 63 characters. etag: Optional. The etag for the access policy. If this is provided on update, it must match the server's etag. name: Identifier. The resource name of the access policy. The following formats are supported: `projects/{project_id}/locations/{location}/accessPolicies/{policy_id}` `projects/{project_number}/locations/{location}/accessPolicies/{policy_i d}` `folders/{folder_id}/locations/{location}/accessPolicies/{policy_id}` `o rganizations/{organization_id}/locations/{location}/accessPolicies/{poli cy_id}` uid: Output only. The globally unique ID of the access policy. updateTime: Output only. The time when the access policy was most recently updated. additionalPropertiescf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) -GoogleIamV3alphaAccessPolicy.AnnotationsValue/Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations Messages: AdditionalProperty: An additional property for a AnnotationsValue object. Fields: additionalProperties: Additional properties of type AnnotationsValue c`\rSrSrSr\R "S5r\R "S5rSr g)@GoogleIamV3alphaAccessPolicy.AnnotationsValue.AdditionalPropertyAn additional property for a AnnotationsValue object. Fields: key: Name of the additional property. value: A string attribute. r rr N rrrrrrrkeyvaluerr rrAdditionalPropertyr2)   ! !! $c##A&err8r Trr N rrrrrrMessager8rr,rr rrAnnotationsValuer.2  'Y.. '%112FTXYrr<r r#GoogleIamV3alphaAccessPolicyDetailsr%r NrrrrrrMapUnrecognizedFieldsrr;r<r annotationsr createTimedetails displayNameetagnameuid updateTimerr rrr*r*s< !!"89Z**Z:Z4&&'91=+$$Q'*  " "#H! L'%%a(+   q !$   q !$a #$$Q'*rr*c<\rSrSrSr\R "SSSS9rSrg) r>zRAccess policy details. Fields: rules: Required. A list of access policy rules. GoogleIamV3alphaAccessPolicyRuler Trr N) rrrrrrrrulesrr rrr>r>s  !CQQU V%rr>c\rSrSrSr"SS\R 5r\R"S5"SS\R55r \R"SS5r \R"S 5r\R "SS 5r\R"S S S 9r\R"SS S 9r\R"SS S 9r\R"SS S 9rSrg)rPaAccess Policy Rule that determines the behavior of the policy. Enums: EffectValueValuesEnum: Required. The effect of the rule. Messages: ActivationConditionsValue: Optional. The conditions that determine whether this rule applies to a request. Conditions are identified by their key, which is the FQDN of the service that they are relevant to, e.g.: "activationConditions": { "iam.googleapis.com": { "cel_condition": } } Each rule is evaluated independently. If this rule does not apply to a request, other rules might still apply. Currently supported keys are: * `eventarc.googleapis.com` Fields: activationConditions: Optional. The conditions that determine whether this rule applies to a request. Conditions are identified by their key, which is the FQDN of the service that they are relevant to, e.g.: "activationConditions": { "iam.googleapis.com": { "cel_condition": } } Each rule is evaluated independently. If this rule does not apply to a request, other rules might still apply. Currently supported keys are: * `eventarc.googleapis.com` description: Optional. Customer specified description of the rule. Must be less than or equal to 256 characters. effect: Required. The effect of the rule. excludedPermissions: Optional. Specifies the permissions that this rule excludes from the set of affected permissions given by `permissions`. If a permission appears in `permissions` _and_ in `excluded_permissions` then it will _not_ be subject to the policy effect. The excluded permissions can be specified using the same syntax as `permissions`. excludedPrincipals: Optional. The identities that are excluded from the access policy rule, even if they are listed in the `principals`. For example, you could add a Google group to the `principals`, then exclude specific users who belong to that group. permissions: Required. The permissions that are explicitly affected by this rule. Each permission uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}` is the fully qualified domain name for the service. Currently supported permissions are: * `eventarc.googleapis.com/messageBuses.publish`. principals: Required. The identities for which this rule's effect governs using one or more permissions on Google Cloud resources. This field can contain the following values: * `principal://goog/subject/{email_id}`: A specific Google Account. Includes Gmail, Cloud Identity, and Google Workspace user accounts. For example, `principal://goog/subject/alice@example.com`. * `principal://iam.googlea pis.com/projects/-/serviceAccounts/{service_account_id}`: A Google Cloud service account. For example, `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service- account@iam.gserviceaccount.com`. * `principalSet://goog/group/{group_id}`: A Google group. For example, `principalSet://goog/group/admins@example.com`. * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the principals associated with the specified Google Workspace or Cloud Identity customer ID. For example, `principalSet://goog/cloudIdentityCustomerId/C01Abc35`. If an identifier that was previously set on a policy is soft deleted, then calls to read that policy will return the identifier with a deleted prefix. Users cannot set identifiers with this syntax. * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific Google Account that was deleted recently. For example, `deleted:principal://goog/subject/alice@example.com?uid=1234567890`. If the Google Account is recovered, this identifier reverts to the standard identifier for a Google Account. * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group that was deleted recently. For example, `deleted:principalSet://goog/group/admins@example.com?uid=1234567890`. If the Google group is restored, this identifier reverts to the standard identifier for a Google group. * `deleted:principal://iam.googleapis.com /projects/-/serviceAccounts/{service_account_id}?uid={uid}`: A Google Cloud service account that was deleted recently. For example, `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my- service-account@iam.gserviceaccount.com?uid=1234567890`. If the service account is undeleted, this identifier reverts to the standard identifier for a service account. c$\rSrSrSrSrSrSrSrg)6GoogleIamV3alphaAccessPolicyRule.EffectValueValuesEnumi!zRequired. The effect of the rule. Values: EFFECT_UNSPECIFIED: The effect is unspecified. DENY: The policy will deny access if it evaluates to true. ALLOW: The policy will grant access if it evaluates to true. rr rr N) rrrrrEFFECT_UNSPECIFIEDDENYALLOWrr rrEffectValueValuesEnumrU!s D ErrYr,cf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) :GoogleIamV3alphaAccessPolicyRule.ActivationConditionsValuei-akOptional. The conditions that determine whether this rule applies to a request. Conditions are identified by their key, which is the FQDN of the service that they are relevant to, e.g.: "activationConditions": { "iam.googleapis.com": { "cel_condition": } } Each rule is evaluated independently. If this rule does not apply to a request, other rules might still apply. Currently supported keys are: * `eventarc.googleapis.com` Messages: AdditionalProperty: An additional property for a ActivationConditionsValue object. Fields: additionalProperties: Additional properties of type ActivationConditionsValue cb\rSrSrSr\R "S5r\R"SS5r Sr g)MGoogleIamV3alphaAccessPolicyRule.ActivationConditionsValue.AdditionalPropertyi?zAn additional property for a ActivationConditionsValue object. Fields: key: Name of the additional property. value: A GoogleIamV3alphaAccessPolicyRuleActivationCondition attribute. r 3GoogleIamV3alphaAccessPolicyRuleActivationConditionrr N rrrrrrrr6rr7rr rrr8r]?s-   ! !! $c$$%Z\]^err8r Trr Nr:r rrActivationConditionsValuer[-s4 _Y.. _%112FTXYrr`r rr%r?Trr@rArBr N)rrrrrrEnumrYrrEr;r`ractivationConditionsr description EnumFieldeffectexcludedPermissionsexcludedPrincipals permissions principalsrr rrrPrPsJX inn  !!"89Z)"3"3Z:Z>#//0KQO%%a(+   6 :&!--a$? ,,Q>%%a$7+$$Q6*rrPc>\rSrSrSr\R "SS5rSrg)r^iVa~Defines an activation condition. Fields: celCondition: Required. The CEL condition that will be evaluated to determine rule applicability. Note that the attributes and functions that can be used in the condition will be limited by the namespace it is associated with in the `activation_conditions` map. Expr.expression must be less than 512 characters in length. r$r r N) rrrrrrr celConditionrr rrr^r^Vs''(8!<,rr^c\rSrSrSr\R "SSS9r\R "SSS9r\R "SSS9r \R "S5r \R "S 5r S r g ) GoogleIamV3alphaAccessTraceidayAccessTrace contains trace(provenance) info of the individual role bindings within the policies. NOTE : To be used only as part of TranslationReport. Fields: contributingPolicyIds: Optional. Contributing policy ids. mappedPermissions: Optional. Mapped permissions. matchedRoles: Optional. Matched roles. principal: Optional. Principal. resource: Optional. Resource. r Trrr%r?r@r N) rrrrrrrcontributingPolicyIdsmappedPermissions matchedRoles principalresourcerr rrrmrmdsa $//DA++A=&&q48,##A&)  " "1 %(rrmc\rSrSrSr"SS\R 5r\R"S5r \R"SS5r Sr g) /GoogleIamV3alphaExportTranslatedPoliciesRequestixa}Message for requesting export of TranslatedPolicies. Enums: InlineDestinationValueValuesEnum: Inline export of translated policy with format mentioned in this enum. Fields: filter: Optional. Filtering results. Filter expression would be on the TranslatedPolicy resource. inlineDestination: Inline export of translated policy with format mentioned in this enum. c \rSrSrSrSrSrSrg)PGoogleIamV3alphaExportTranslatedPoliciesRequest.InlineDestinationValueValuesEnumizInline export of translated policy with format mentioned in this enum. Values: INLINE_DESTINATION_FORMAT_UNSPECIFIED: Default value. This is unused. TERRAFORM: Represents terraform format of policy. rr r N)rrrrr%INLINE_DESTINATION_FORMAT_UNSPECIFIED TERRAFORMrr rr InlineDestinationValueValuesEnumrvs -.)Irryr rr N) rrrrrrraryrfilterrdinlineDestinationrr rrrtrtxs=    #&))*LaPrrtc`\rSrSrSr\R "SSSS9r\R"S5r Sr g ) *GoogleIamV3alphaListAccessPoliciesResponseiaResponse message for ListAccessPolicies method. Fields: accessPolicies: The access policies from the specified parent. nextPageToken: Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages. r*r Trrr N) rrrrrrraccessPoliciesr nextPageTokenrr rrr}r}s/))*H!VZ[.''*-rr}c`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) *GoogleIamV3alphaListPolicyBindingsResponseiaResponse message for ListPolicyBindings method. Fields: nextPageToken: Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages. policyBindings: The policy bindings from the specified parent. r GoogleIamV3alphaPolicyBindingrTrr N rrrrrrrrrpolicyBindingsrr rrrr/''*-))*I1W[\.rrc\rSrSrSr\R "S5r\R"SSSS9r \R "SSS9r S r g ) )GoogleIamV3alphaListPolicyPortersResponseizMessage for response to listing PolicyPorters Fields: nextPageToken: A token identifying a page of results the server should return. policyPorters: The list of PolicyPorter unreachable: Locations that could not be reached. r GoogleIamV3alphaPolicyPorterrTrr%r N) rrrrrrrrr policyPorters unreachablerr rrrrsA''*-(()GUYZ-%%a$7+rrc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) ;GoogleIamV3alphaListPrincipalAccessBoundaryPoliciesResponseiaUResponse message for ListPrincipalAccessBoundaryPolicies method. Fields: nextPageToken: Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages. principalAccessBoundaryPolicies: The principal access boundary policies from the specified parent. r -GoogleIamV3alphaPrincipalAccessBoundaryPolicyrTrr N) rrrrrrrrrprincipalAccessBoundaryPoliciesrr rrrrs1''*-$-$:$:;jlmx|$}!rrc\rSrSrSr\R "S5r\R"SSSS9r \R "SSS9r S r g ) *GoogleIamV3alphaListSourcePoliciesResponseizMessage for response to listing SourcePolicies Fields: nextPageToken: A token identifying a page of results the server should return. sourcePolicies: The list of SourcePolicy unreachable: Locations that could not be reached. r GoogleIamV3alphaSourcePolicyrTrr%r N) rrrrrrrrrsourcePoliciesrrr rrrrsA''*-))*H!VZ[.%%a$7+rrc\rSrSrSr\R "S5r\R"SSSS9r \R "SSS9r S r g ) .GoogleIamV3alphaListTranslatedPoliciesResponseizMessage for response to listing TranslatedPolicies Fields: nextPageToken: A token identifying a page of results the server should return. translatedPolicies: The list of TranslatedPolicy unreachable: Locations that could not be reached. r GoogleIamV3alphaTranslatedPolicyrTrr%r N) rrrrrrrrrtranslatedPoliciesrrr rrrrsC''*- --.PRS^bc%%a$7+rrc\rSrSrSr\R "S5r\R"SSSS9r \R "SSS9r S r g ) (GoogleIamV3alphaListTranslationsResponseizMessage for response to listing Translations Fields: nextPageToken: A token identifying a page of results the server should return. translations: The list of Translation unreachable: Locations that could not be reached. r GoogleIamV3alphaTranslationrTrr%r N) rrrrrrrrr translationsrrr rrrrsA''*-''(EqSWX,%%a$7+rrc\rSrSrSr\R "S5r\R "S5r\R "S5r \R"S5r \R "S5r \R "S5r \R "S 5rS rg ) !GoogleIamV3alphaOperationMetadataiaRepresents the metadata of the long-running operation. Fields: apiVersion: Output only. API version used to start the operation. createTime: Output only. The time the operation was created. endTime: Output only. The time the operation finished running. requestedCancellation: Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have Operation.error value with a google.rpc.Status.code of 1, corresponding to `Code.CANCELLED`. statusMessage: Output only. Human-readable status of the operation, if any. target: Output only. Server-defined resource path for the target of the verb: Output only. Name of the verb executed by the operation. r rr%r?r@rArBr N)rrrrrrr apiVersionrGendTime BooleanFieldrequestedCancellation statusMessagetargetverbrr rrrrsz $$Q'*$$Q'*  ! !! $'#003''*-   #&   q !$rrc>\rSrSrSr\R "SS5rSrg)GoogleIamV3alphaPolicyiz|One of the policies supported by IAM V3 Fields: principalAccessBoundaryPolicy: The principal access boundary kind policy rr r N) rrrrrrrprincipalAccessBoundaryPolicyrr rrrrs #,"8"89hjk"lrrcN\rSrSrSr"SS\R 5r\R"S5"SS\R55r \R"SS5r \R"S S 5r\R"S 5r\R"S 5r\R"S 5r\R"S5r\R"S5r\R*"SS5r\R"S5r\R"SS5r\R"S5r\R"S5rSrg)ria;IAM policy binding resource. Enums: PolicyKindValueValuesEnum: Immutable. The kind of the policy to attach in this binding. This field must be one of the following: - Left empty (will be automatically set to the policy kind) - The input policy kind Messages: AnnotationsValue: Optional. User-defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations Fields: annotations: Optional. User-defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations condition: Optional. The condition to apply to the policy binding. When set, the `expression` field in the `Expr` must include from 1 to 10 subexpressions, joined by the "||"(Logical OR), "&&"(Logical AND) or "!"(Logical NOT) operators and cannot contain more than 250 characters. The condition is currently only supported when bound to policies of kind principal access boundary. When the bound policy is a principal access boundary policy, the only supported attributes in any subexpression are `principal.type` and `principal.subject`. An example expression is: "principal.type == 'iam.googleapis.com/ServiceAccount'" or "principal.subject == 'bob@example.com'". Allowed operations for `principal.subject`: - `principal.subject == ` - `principal.subject != ` - `principal.subject in []` - `principal.subject.startsWith()` - `principal.subject.endsWith()` Allowed operations for `principal.type`: - `principal.type == ` - `principal.type != ` - `principal.type in []` Supported principal types are Workspace, Workforce Pool, Workload Pool and Service Account. Allowed string must be one of: - iam.googleapis.com/WorkspaceIdentity - iam.googleapis.com/WorkforcePoolIdentity - iam.googleapis.com/WorkloadPoolIdentity - iam.googleapis.com/ServiceAccount createTime: Output only. The time when the policy binding was created. displayName: Optional. The description of the policy binding. Must be less than or equal to 63 characters. etag: Optional. The etag for the policy binding. If this is provided on update, it must match the server's etag. name: Identifier. The name of the policy binding, in the format `{binding_parent/locations/{location}/policyBindings/{policy_binding_id} `. The binding parent is the closest Resource Manager resource (project, folder, or organization) to the binding target. Format: * `projects/{pro ject_id}/locations/{location}/policyBindings/{policy_binding_id}` * `pro jects/{project_number}/locations/{location}/policyBindings/{policy_bindi ng_id}` * `folders/{folder_id}/locations/{location}/policyBindings/{poli cy_binding_id}` * `organizations/{organization_id}/locations/{location}/ policyBindings/{policy_binding_id}` policy: Required. Immutable. The resource name of the policy to be bound. The binding parent and policy must belong to the same organization. policyKind: Immutable. The kind of the policy to attach in this binding. This field must be one of the following: - Left empty (will be automatically set to the policy kind) - The input policy kind policyUid: Output only. The globally unique ID of the policy to be bound. target: Required. Immutable. The full resource name of the resource to which the policy will be bound. Immutable once set. uid: Output only. The globally unique ID of the policy binding. Assigned when the policy binding is created. updateTime: Output only. The time when the policy binding was most recently updated. c$\rSrSrSrSrSrSrSrg)7GoogleIamV3alphaPolicyBinding.PolicyKindValueValuesEnumi`aImmutable. The kind of the policy to attach in this binding. This field must be one of the following: - Left empty (will be automatically set to the policy kind) - The input policy kind Values: POLICY_KIND_UNSPECIFIED: Unspecified policy kind; Not a valid state PRINCIPAL_ACCESS_BOUNDARY: Principal access boundary policy kind ACCESS: Access policy kind. Keep behind visibility label until Access Policy launch. rr rr N) rrrrrPOLICY_KIND_UNSPECIFIEDPRINCIPAL_ACCESS_BOUNDARYACCESSrr rrPolicyKindValueValuesEnumr`s   ! Frrr,cf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) .GoogleIamV3alphaPolicyBinding.AnnotationsValueioa/Optional. User-defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations Messages: AdditionalProperty: An additional property for a AnnotationsValue object. Fields: additionalProperties: Additional properties of type AnnotationsValue c`\rSrSrSr\R "S5r\R "S5rSr g)AGoogleIamV3alphaPolicyBinding.AnnotationsValue.AdditionalPropertyi}r4r rr Nr5r rrr8r}r9rr8r Trr Nr:r rrr<ror=rr<r r$rr%r?r@rArBrC #GoogleIamV3alphaPolicyBindingTarget r N)rrrrrrrarrrEr;r<rrFr&rrGrIrJrKpolicyrd policyKind policyUidrrLrMrr rrrrs>@ )..  !!"89Z**Z:Z4&&'91=+$$%5q9)$$Q'*%%a(+   q !$   q !$   #&""#>B*##A&)  ! !"G L&b!#$$R(*rrc`\rSrSrSr\R "S5r\R "S5rSr g)ria$The full resource name of the resource to which the policy will be bound. Immutable once set. Fields: principalSet: Immutable. The full resource name that's used for principal access boundary policy bindings. The principal set must be directly parented by the policy binding's parent or same as the parent if the target is a project, folder, or organization. Examples: * For bindings parented by an organization: * Organization: `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID` * Workforce Identity: `//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID` * Workspace Identity: `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID` * For bindings parented by a folder: * Folder: `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID` * For bindings parented by a project: * Project: * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER` * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID` * Workload Identity Pool: `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/L OCATION/workloadIdentityPools/WORKLOAD_POOL_ID` resource: Immutable. The full resource name that's used for access policy bindings Examples: * Organization: `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID` * Folder: `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID` * Project: * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER` * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID` r rr N) rrrrrrr principalSetrrrr rrrrs)<&&q),  " "1 %(rrc\rSrSrSrSrg)"GoogleIamV3alphaPolicyInaccessibleiz4A marker to indicate that the policy is inaccessibler Nrrrrrrr rrrrs=rrc\rSrSrSrSrg)GoogleIamV3alphaPolicyNotFoundiz2A marker to indicate that the policy was not foundr Nrr rrrrs;rrcl\rSrSrSr\R "S5"SS\R55r \R"S5r \R"S5r \R"S5r \R"SS 5r\R"S 5r\R"S S 5r\R"S 5rSrg)riaPolicy porter resource defines a workspace where customers can upload security policies from different clouds and get them translated to GCP security policies. Messages: LabelsValue: Optional. Resource labels as key value pairs, used for List API filtering. Fields: createTime: Output only. [Output only] Create time stamp description: Optional. Description about translation. displayName: Required. An arbitrary user-provided name for policy porter. The display name should adhere to the following format: * Must be 6 to 63 characters in length. * Can only contain lowercase letters, numbers, and hyphens. * Must start with a letter. labels: Optional. Resource labels as key value pairs, used for List API filtering. name: Identifier. Name of resource. Format: projects/{project}/locations/{location}/policyPorters/{policy_porter}. policyConfig: Optional. Represents config for PolicyPorter such as policies, mappings, etc. required by PolicyPorter. updateTime: Output only. [Output only] Update time stamp r,cf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) (GoogleIamV3alphaPolicyPorter.LabelsValueizOptional. Resource labels as key value pairs, used for List API filtering. Messages: AdditionalProperty: An additional property for a LabelsValue object. Fields: additionalProperties: Additional properties of type LabelsValue c`\rSrSrSr\R "S5r\R "S5rSr g);GoogleIamV3alphaPolicyPorter.LabelsValue.AdditionalPropertyizAn additional property for a LabelsValue object. Fields: key: Name of the additional property. value: A string attribute. r rr Nr5r rrr8rr9rr8r Trr Nr:r rr LabelsValuers2 'Y.. '%112FTXYrrr rr%r?r@"GoogleIamV3alphaPolicyPorterConfigrArBr N)rrrrrrrErr;rrrGrcrIrlabelsrK policyConfigrMrr rrrrs0 !!"89ZI%%Z:Z0$$Q'*%%a(+%%a(+  ! !- 3&   q !$''(LaP,$$Q'*rrc\rSrSrSr"SS\R 5r\R"SS5r \R"SS5r \R"SS 5r S r g ) riaRepresents config for PolicyPorter such as policies, mappings, etc. required by PolicyPorter. Enums: SourceCloudValueValuesEnum: Optional. Type of source cloud from which policies are being translated. Fields: awsMappings: Optional. Mappings required for translating policies from AWS source cloud. inlinePolicyJson: Inline representation of policy json that is being translated. sourceCloud: Optional. Type of source cloud from which policies are being translated. c \rSrSrSrSrSrSrg)=GoogleIamV3alphaPolicyPorterConfig.SourceCloudValueValuesEnumizOptional. Type of source cloud from which policies are being translated. Values: SOURCE_CLOUD_UNSPECIFIED: Default value. This value is unused. AWS: Represents AWS cloud. rr r N)rrrrrSOURCE_CLOUD_UNSPECIFIEDAWSrr rrSourceCloudValueValuesEnumrs ! Crr-GoogleIamV3alphaPolicyPorterConfigAwsMappingsr 2GoogleIamV3alphaPolicyPorterConfigInlinePolicyJsonrr%r N)rrrrrrrarr awsMappingsinlinePolicyJsonrd sourceCloudrr rrrrsU  9>>  &&'VXYZ+++,`bcd##$@!D+rrcP\rSrSrSr\R "S5"SS\R55r \R "S5"SS\R55r \R"SS S 9r \R"SS 5r\R"S S S 9r\R"SS 5rSrg)riaResource and principal mappings required for translating policies. Messages: PrincipalMappingValue: Optional. User provided principal mapping for keys in `principal_keys` field. Keys format: [AWS JSON policy elements: Princ ipal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policie s_elements_principal.html). Values format: See [Members field in binding s](https://cloud.google.com/iam/docs/reference/rest/v1/Policy#binding). ResourceMappingValue: Optional. User provided resource mapping for keys in `resource_keys` field. Keys format: [IAM JSON policy elements: Resource] (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_ele ments_resource.html). Values format: See [Resource names](https://cloud.google.com/apis/design/resource_names). Fields: principalKeys: Output only. Principal keys identified in the policy json for which mappings are required for translation. Mappings need to be provided in `principal_mapping` field. principalMapping: Optional. User provided principal mapping for keys in `principal_keys` field. Keys format: [AWS JSON policy elements: Principa l](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_e lements_principal.html). Values format: See [Members field in bindings]( https://cloud.google.com/iam/docs/reference/rest/v1/Policy#binding). resourceKeys: Output only. Resource keys identified in the policy json for which mappings are required for translation. Mappings need to be provided in `resource_mapping` field. resourceMapping: Optional. User provided resource mapping for keys in `resource_keys` field. Keys format: [IAM JSON policy elements: Resource] (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_ele ments_resource.html). Values format: See [Resource names](https://cloud.google.com/apis/design/resource_names). r,cf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) CGoogleIamV3alphaPolicyPorterConfigAwsMappings.PrincipalMappingValueiAaOptional. User provided principal mapping for keys in `principal_keys` field. Keys format: [AWS JSON policy elements: Principal](https://docs.aws .amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.htm l). Values format: See [Members field in bindings](https://cloud.google.co m/iam/docs/reference/rest/v1/Policy#binding). Messages: AdditionalProperty: An additional property for a PrincipalMappingValue object. Fields: additionalProperties: Additional properties of type PrincipalMappingValue c`\rSrSrSr\R "S5r\R "S5rSr g)VGoogleIamV3alphaPolicyPorterConfigAwsMappings.PrincipalMappingValue.AdditionalPropertyiRzAn additional property for a PrincipalMappingValue object. Fields: key: Name of the additional property. value: A string attribute. r rr Nr5r rrr8rRr9rr8r Trr Nr:r rrPrincipalMappingValuerAs2  'Y.. '%112FTXYrrcf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) BGoogleIamV3alphaPolicyPorterConfigAwsMappings.ResourceMappingValuei_aOptional. User provided resource mapping for keys in `resource_keys` field. Keys format: [IAM JSON policy elements: Resource](https://docs.aws. amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html) . Values format: See [Resource names](https://cloud.google.com/apis/design/resource_names). Messages: AdditionalProperty: An additional property for a ResourceMappingValue object. Fields: additionalProperties: Additional properties of type ResourceMappingValue c`\rSrSrSr\R "S5r\R "S5rSr g)UGoogleIamV3alphaPolicyPorterConfigAwsMappings.ResourceMappingValue.AdditionalPropertyiozAn additional property for a ResourceMappingValue object. Fields: key: Name of the additional property. value: A string attribute. r rr Nr5r rrr8ror9rr8r Trr Nr:r rrResourceMappingValuer_s2  'Y.. '%112FTXYrrr Trrr%r?r N)rrrrrrrErr;rrr principalKeysrprincipalMapping resourceKeysresourceMappingrr rrrrsB !!"89Zi//Z:Z: !!"89ZY..Z:Z8''D9-++,CQG&&q48,**+A1E/rrc`\rSrSrSr\R "S5r\R "S5rSr g)riaInline representation of policy json that is being translated. Fields: content: Required. Content of the file containing policies in json format. fileName: Required. Name of file from which policy json got imported. This helps user to recognize the source of policies. r rr N) rrrrrrrcontentfileNamerr rrrrs)  ! !! $'  " "1 %(rrc^\rSrSrSr\R "SSS9r\R "S5rSr g) GoogleIamV3alphaPolicyTraceiaTranslationTraceTable contains trace(provenance) info of the translated policies. NOTE : To be used only as part of TranslationReport. Fields: contributingPolicyIds: Optional. Contributing policy ids. translatedPolicyId: Optional. Translated policy id. r Trrr N) rrrrrrrrntranslatedPolicyIdrr rrrrs-$//DA ,,Q/rrc\rSrSrSr\R "S5"SS\R55r \R"SS5r \R"S5r \R"SS 5r\R"S 5r\R"S 5r\R"S 5r\R"S 5r\R"S5rSrg)riaAn IAM principal access boundary policy resource. Messages: AnnotationsValue: Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations Fields: annotations: Optional. User defined annotations. See https://google.aip.dev/148#annotations for more details such as format and size limitations createTime: Output only. The time when the principal access boundary policy was created. details: Optional. The details for the principal access boundary policy. displayName: Optional. The description of the principal access boundary policy. Must be less than or equal to 63 characters. etag: Optional. The etag for the principal access boundary. If this is provided on update, it must match the server's etag. name: Identifier. The resource name of the principal access boundary policy. The following format is supported: `organizations/{organization_ id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}` uid: Output only. The globally unique ID of the principal access boundary policy. updateTime: Output only. The time when the principal access boundary policy was most recently updated. r,cf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) >GoogleIamV3alphaPrincipalAccessBoundaryPolicy.AnnotationsValueir0c`\rSrSrSr\R "S5r\R "S5rSr g)QGoogleIamV3alphaPrincipalAccessBoundaryPolicy.AnnotationsValue.AdditionalPropertyir4r rr Nr5r rrr8rr9rr8r Trr Nr:r rrr<rr=rr<r r4GoogleIamV3alphaPrincipalAccessBoundaryPolicyDetailsr%r?r@rArBrCr NrDr rrrrs6 !!"89Z**Z:Z4&&'91=+$$Q'*  " "#Y[\ ]'%%a(+   q !$   q !$a #$$Q'*rrc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) riaPrincipal access boundary policy details Fields: enforcementVersion: Optional. The version number (for example, `1` or `latest`) that indicates which permissions are able to be blocked by the policy. If empty, the PAB policy version will be set to the most recent version number at the time of the policy's creation. rules: Required. A list of principal access boundary policy rules. The number of rules in a policy is limited to 500. r 1GoogleIamV3alphaPrincipalAccessBoundaryPolicyRulerTrr N) rrrrrrrenforcementVersionrrQrr rrrrs1 !,,Q/  !TVWbf g%rrc\rSrSrSr"SS\R 5r\R"S5r \R"SS5r \R"SSS 9r S r g ) riaPrincipal access boundary policy rule that defines the resource boundary. Enums: EffectValueValuesEnum: Required. The access relationship of principals to the resources in this rule. Fields: description: Optional. The description of the principal access boundary policy rule. Must be less than or equal to 256 characters. effect: Required. The access relationship of principals to the resources in this rule. resources: Required. A list of Resource Manager resources. If a resource is listed in the rule, then the rule applies for that resource and its descendants. The number of resources in a policy is limited to 500 across all rules in the policy. The following resource types are supported: * Organizations, such as `//cloudresourcemanager.googleapis.com/organizations/123`. * Folders, such as `//cloudresourcemanager.googleapis.com/folders/123`. * Projects, such as `//cloudresourcemanager.googleapis.com/projects/123` or `//cloudresourcemanager.googleapis.com/projects/my-project-id`. c \rSrSrSrSrSrSrg)GGoogleIamV3alphaPrincipalAccessBoundaryPolicyRule.EffectValueValuesEnumizRequired. The access relationship of principals to the resources in this rule. Values: EFFECT_UNSPECIFIED: Effect unspecified. ALLOW: Allows access to the resources in this rule. rr r N)rrrrrrVrXrr rrrYrs ErrYr rr%Trr N)rrrrrrrarYrrcrdre resourcesrr rrrrsN. inn %%a(+   6 :&##A5)rrc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) 2GoogleIamV3alphaSearchAccessPolicyBindingsResponseia+Response message for SearchAccessPolicyBindings rpc. Fields: nextPageToken: Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages. policyBindings: The policy bindings that reference the specified policy. r rrTrr Nrr rrrrrrrc\rSrSrSr\R "SSSS9r\R"S5r \R"S5r S r g ) 0GoogleIamV3alphaSearchApplicablePoliciesResponsei#a<Response message for SearchApplicablePolicies Fields: bindingsAndPolicies: A list of Bindings and the policies associated with those bindings. The bindings are ordered by attachment point starting from the lowest level of the resource hierarchy. No order is guaranteed for bindings for a given enforcement point. nextPageToken: The page token to use in a follow up SearchApplicablePolicies request responseComplete: Does the response contain the full list of all bindings and policies applicable or were some excluded due to lack of permissions @GoogleIamV3alphaSearchApplicablePoliciesResponseBindingAndPolicyr Trrr%r N) rrrrrrrbindingsAndPoliciesrrrresponseCompleterr rrrr#sI "../qst@DE''*-++A.rrc\rSrSrSr\R "SS5r\R "SS5r\R "SS5r \R "S S 5r S r g ) ri6anA pair of a binding and a policy referenced by that binding (if accessible) Fields: binding: A binding between a target and a policy policy: The policy associated with the above binding. Omitted if the policy cannot be retrieved due to lack of permissions policyInaccessible: Will be set if there was a permission error getting the policy (even though the binding was accessible). policyNotFound: Will be set if there was not a permission error, but the policy was not found. This would indicate the binding is orphaned. Any orphan binding will eventually be cleaned up - this state is temporary. rr rrrr%rr?r N) rrrrrrrbindingrpolicyInaccessiblepolicyNotFoundrr rrrr6sW   " "#BA F'  ! !":A >& --.RTUV))*JAN.rrc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) CGoogleIamV3alphaSearchPrincipalAccessBoundaryPolicyBindingsResponseiKa<Response message for SearchPrincipalAccessBoundaryPolicyBindings rpc. Fields: nextPageToken: Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages. policyBindings: The policy bindings that reference the specified policy. r rrTrr Nrr rrrrKrrrc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) 2GoogleIamV3alphaSearchTargetPolicyBindingsResponseiYa(Response message for SearchTargetPolicyBindings method. Fields: nextPageToken: Optional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages. policyBindings: The policy bindings bound to the specified target. r rrTrr Nrr rrrrYrrrc\rSrSrSr\R "SS5r\R"S5r \R"S5r \R"S5r \R"S5r \R"S 5r S rg ) rigaXSourcePolicy resource represents a security policy provided by user for translation. Fields: awsIamPolicy: AWS IAM policy. createTime: Output only. [Output only] Create time stamp description: Optional. The description of the source policy. It explains the purpose of this policy. displayName: Required. The display name of the source policy. name: Identifier. Name of resource. Format: projects/{project}/locations/{ location}/policyPorters/{policy_porter}/translations/{translation}/sourc ePolicies/{source_policy}. updateTime: Output only. [Output only] Update time stamp (GoogleIamV3alphaSourcePolicyAwsIamPolicyr rr%r?r@rAr N)rrrrrrr awsIamPolicyrrGrcrIrKrMrr rrrrgsm ''(RTUV,$$Q'*%%a(+%%a(+   q !$$$Q'*rrc\rSrSrSr\R "S5r\R"SSSS9r \R "S5r \R "S 5r \R "S 5r \R "S 5r \R"S S SS9rSrg)riaProto representation of AWS IAM policy and attachment. Please check [AWS - IAM JSON policy reference](https://docs.aws.amazon.com/IAM/latest/UserGuid e/reference_policies.html) to see the AWS IAM JSON policy reference. Fields: arn: The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources. attachmentInfo: Information about the attachment of the policy. defaultVersion: The identifier for the version of the policy that is set as the default version. id: The stable and unique string identifying the policy. name: The friendly name (not ARN) identifying the policy. path: The path for the policy. policyVersions: Policy versions. r 6GoogleIamV3alphaSourcePolicyAwsIamPolicyAttachmentInforTrr%r?r@rA5GoogleIamV3alphaSourcePolicyAwsIamPolicyPolicyVersionrBr N)rrrrrrrarnrattachmentInfodefaultVersionidrKpathpolicyVersionsrr rrrrs a #))*bdeptu.((+.Q"   q !$   q !$))*acdost.rrc`\rSrSrSr\R "S5r\R "S5rSr g)r izInformation about the attachment of the policy. Fields: principal: Principal where policy is attached. resource: Resource where policy is attached. r rr N) rrrrrrrrqrrrr rrr r s)##A&)  " "1 %(rr c\rSrSrSr\R "S5r\R"SSSS9r \R "S5r S r g ) 0GoogleIamV3alphaSourcePolicyAwsIamPolicyDocumentiaIThe policy document is the content of the policy containing policy rules/statements. Fields: id: The Id element specifies an optional identifier for the policy. statements: Statements present in a policy. version: The Version policy element specifies the language syntax rules that are to be used to process a policy. r 9GoogleIamV3alphaSourcePolicyAwsIamPolicyDocumentStatementrTrr%r N) rrrrrrrrr statementsversionrr rrrrs@Q"%%&acdost*  ! !! $'rrc4\rSrSrSr\R "SSS9r\R "S5r\R "S5r \R "SSS9r \R"S S 5r \R "S SS9r \R"S S 5r\R "S SS9rSrg)riaDefines single rule/statement in a policy. Fields: actions: The Action element describes the specific action or actions that will be allowed or denied. effect: The Effect element is required and specifies whether the statement results in an allow or an explicit deny. id: Optional id to identify a statement within a policy. notActions: NotAction explicitly matches everything except the specified list of actions. notPrincipal: NotPrincipal element to deny access to all principals except the IAM user, federated user, IAM role, AWS account, AWS service, or other principal specified in the NotPrincipal element. notResources: NotResource is an advanced policy element that explicitly matches every resource except those specified. principal: Principal element is present in a resource-based JSON policy to specify the principal that is allowed or denied access to a resource. resources: The Resource element specifies the object or objects that the statement covers. r Trrr%r?BGoogleIamV3alphaSourcePolicyAwsIamPolicyDocumentStatementPrincipalr@rArBrCr N)rrrrrrractionsrer notActionsr notPrincipal notResourcesrqrrr rrrrs*  ! !!d 3'   #&Q"$$Q6*''(lnop,&&q48,$$%iklm)##A5)rrc\rSrSrSr\R "SSS9r\R "SSS9r\R "SSS9r \R "SSS9r S r g ) ria5Principal represents IAM user, federated user, IAM role, AWS account, AWS service, or other principal. Fields: aws: AWS account identifier. canonicalUser: Canonical user identifier in AWS account. federated: A web identity session principal or SAML session principal. service: AWS service principal. r Trrr%r?r N) rrrrrrraws canonicalUser federatedservicerr rrrrsQ a$/#''D9-##A5)  ! !!d 3'rrc\rSrSrSr\R "S5r\R"SS5r \R"S5r Sr g) r izPolicy version. Fields: isDefaultVersion: Boolean to identify the default version. policyDocument: Policy document containing the policy. version: Version id of the policy version. r rrr%r N) rrrrrrrisDefaultVersionrpolicyDocumentrrrr rrr r s>++A.))*\^_`.  ! !! $'rr c<\rSrSrSr\R "S5r\R "S5r\R "S5r \R "S5r \R"SS5r \R"S 5r\R "S 5r\R"SS 5rS rg )ria_TranslatedPolicy resource represents an output translated policy from PolicyPorter. User can refine the TranslatedPolicy before applying it. Fields: createTime: Output only. [Output only] Create time stamp description: Optional. The description of the translated policy. It explains the purpose of this policy. displayName: Required. The display name of the translated policy. name: Identifier. Name of resource. Format: projects/{project}/locations/{ location}/policyPorters/{policy_porter}/translations/{translation}/trans latedPolicies/{translated_policy}. policy: Output only. System generated policy. skipExport: Optional. If this flag is set to true, this policy will be skipped from exporting the policy. updateTime: Output only. [Output only] Update time stamp userUpdatedPolicy: Optional. User updated translated policy. r rr%r?-GoogleIamV3alphaTranslatedPolicyPolicyWrapperr@rArBrCr N)rrrrrrrrGrcrIrKrrr skipExportrMuserUpdatedPolicyrr rrrrs$$$Q'*%%a(+%%a(+   q !$  ! !"QST U&%%a(*$$Q'*,,-\^_`rrc`\rSrSrSr\R "S5r\R"SSSS9r Sr g ) .GoogleIamV3alphaTranslatedPolicyGcpIamV1PolicyiaRepresents GCP IAM V1 policy. Fields: attachmentResource: Required. Resource name to which policy binding is attached. See [Resource names](https://cloud.google.com/apis/design/resource_names) for the appropriate value for this field binding: Required. Binding of role and members representing GCP IAM V1 binding. See [Policy Binding Reference](https://cloud.google.com/iam/doc s/reference/rest/v1/Policy#Binding) binding reference. r r"rTrr N) rrrrrrrattachmentResourcerrrr rrr+r+s/ !,,Q/  " "#7T J'rr+c\rSrSrSr\R "SS5r\R"SSS9r \R"S5r S r g ) r'i"zThe translated policy wrapper. Fields: gcpIamV1Policy: GCP IAM V1 policy. sourcePolicies: Output only. Source policies which contributed to this translated policy. updateTime: Output only. Update time stamp. r+r rTrr%r N) rrrrrrrgcpIamV1PolicyrrrMrr rrr'r'"s?))*Z\]^.((T:.$$Q'*rr'cD\rSrSrSr"SS\R 5r\R"S5r \R"S5r \R"S5r \R"SS 5r \R"SS 5r\R"S S 5r\R"S 5rSrg)ri1aTranslation resource represents one translation instance on the PolicyPorter resource. Enums: StateValueValuesEnum: Output only. State of the translation. Fields: createTime: Output only. [Output only] Create time stamp displayName: Required. The display name of translation. name: Identifier. Name of resource. Format: projects/{project}/locations/{ location}/policyPorters/{policy_porter}/translations/{translation}. policyConfig: Output only. Represents config for PolicyPorter such as policies, mappings, etc. required by PolicyPorter. state: Output only. State of the translation. translationReport: Output only. Translation report contains insights about a translation. updateTime: Output only. [Output only] Update time stamp c0\rSrSrSrSrSrSrSrSr Sr S r g ) 0GoogleIamV3alphaTranslation.StateValueValuesEnumiEa_Output only. State of the translation. Values: STATE_UNSPECIFIED: Default value. This value is unused. INITIALIZING: Represents initialization of translation. TRANSLATING: Represents in progress translation. REFINING: Represents refining of translation. COMPLETED: Represents completed translation. FAILED: Represents failed translation. rr rr%r?r@r N) rrrrrSTATE_UNSPECIFIED INITIALIZING TRANSLATINGREFINING COMPLETEDFAILEDrr rrStateValueValuesEnumr1Es( LKHI Frr8r rr%rr?r@!GoogleIamV3alphaTranslationReportrArBr N)rrrrrrrar8rrGrIrKrrrdstatetranslationReportrMrr rrrr1s&Y^^$$$Q'*%%a(+   q !$''(LaP,   4a 8%,,-PRST$$Q'*rrc`\rSrSrSr\R "SSS9r\R"SS5r Sr g ) r9i`aQTranslation report contains meta-details about translation (non-critical failures, provenance of a translated access etc). NOTE : To be used only as part of Translation resource. Fields: messages: Optional. Messages to be displayed in the translation report. translationTraceTable: Optional. Trace table for the translation report. r Tr%GoogleIamV3alphaTranslationTraceTablerr N) rrrrrrrrrtranslationTraceTablerr rrr9r9`s0 " "1t 4(#001XZ[\rr9c`\rSrSrSr\R "SSSS9r\R "SSSS9rS r g ) r=ina)TranslationTraceTable contains trace(provenance) info for the artifacts produced by translation. NOTE : To be used only as part of TranslationReport. Fields: accessTraces: Optional. Access traces for the translated policies. policyTraces: Optional. Policy traces for the translated policies. rmr Trrrr N) rrrrrrr accessTraces policyTracesrr rrr=r=ns5''(EqSWX,''(EqSWX,rr=cz\rSrSrSr\R "S5"SS\R55r \R "S5"SS\R55r \R"S5r \R"S S 5r\R"SS 5r\R "S 5r\R"SS 5rSrg)GoogleLongrunningOperationi|aThis resource represents a long-running operation that is the result of a network API call. Messages: MetadataValue: Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. ResponseValue: The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. Fields: done: If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. error: The error result of the operation in case of failure or cancellation. metadata: Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. name: The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. response: The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. r,cf\rSrSrSr"SS\R 5r\R"SSSS9r Sr g ) (GoogleLongrunningOperation.MetadataValueiaService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. Messages: AdditionalProperty: An additional property for a MetadataValue object. Fields: additionalProperties: Properties of the object. Contains field @type with type URL. cb\rSrSrSr\R "S5r\R"SS5r Sr g);GoogleLongrunningOperation.MetadataValue.AdditionalPropertyizAn additional property for a MetadataValue object. Fields: key: Name of the additional property. value: A extra_types.JsonValue attribute. r extra_types.JsonValuerr Nr_r rrr8rG,   ! !! $c$$%4J4JK|~5A1  T 2&rrc:\rSrSrSr\R "SSS9rSrg)IIamProjectsLocationsPolicyPortersTranslationsTranslatedPoliciesGetRequestiv a A IamProjectsLocationsPolicyPortersTranslationsTranslatedPoliciesGetRequest object. Fields: name: Required. Name of the resource. Format: projects/{project}/locations /{location}/policyPorters/{policy_porter}/translations/{translation}/tra nslatedPolicies/{translated_policy}. r Trhr Nrwr rrr r v s   q4 0$rr c\rSrSrSr\R "S5r\R "S5r\R"S\RRS9r \R "S5r \R "SS S 9rS rg ) JIamProjectsLocationsPolicyPortersTranslationsTranslatedPoliciesListRequesti acA IamProjectsLocationsPolicyPortersTranslationsTranslatedPoliciesListRequest object. Fields: filter: Optional. Filtering results orderBy: Optional. Hint for how to order the results pageSize: Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. pageToken: Optional. A token identifying a page of results the server should return. parent: Required. Parent value for ListTranslatedPoliciesRequest. Format: projects/{project}/locations/{location}/policyPorters/{policy_porter}/tr anslations/{translation}. r rr%r[r?r@Trhr Nrr rrr r  si   #&  ! !! $'  # #Ay/@/@/F/F G(##A&)  T 2&rr c\rSrSrSr\R "SS5r\R"SSS9r \R"S5r \R"S 5r S r g ) KIamProjectsLocationsPolicyPortersTranslationsTranslatedPoliciesPatchRequesti a(A IamProjectsLocationsPolicyPortersTranslationsTranslatedPoliciesPatchRequest object. Fields: googleIamV3alphaTranslatedPolicy: A GoogleIamV3alphaTranslatedPolicy resource to be passed as the request body. name: Identifier. Name of resource. Format: projects/{project}/locations/{ location}/policyPorters/{policy_porter}/translations/{translation}/trans latedPolicies/{translated_policy}. requestId: Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000). updateMask: Required. Field mask is used to specify the fields to be overwritten in the TranslatedPolicy resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then all fields will be overwritten. rr rTrhr%r?r N) rrrrrrr googleIamV3alphaTranslatedPolicyrrKrrrr rrrr sP8&/%;%;<^`a%b"   q4 0$##A&)$$Q'*rrc\rSrSrSr\R "S5r\R"S\RRS9r \R "S5r \R "S5r Srg ) (IamSearchApplicablePoliciesSearchRequesti a.A IamSearchApplicablePoliciesSearchRequest object. Fields: filter: Optional. Filtering currently only supports the kind of policies to return, and must be in the format "kind:[policyKind1] OR kind:[policyKind2]". New policy kinds may be added in the future without notice. Example value: "kind:principalAccessBoundaryPolicies" pageSize: Optional. The limit of number of items (binding+policy pairs) to return. The default and maximum is 100 and values above 100 are truncated to 100. pageToken: Optional. A page token, received from a previous `SearchApplicablePolicies` call. targetQuery: Required. The target for which to list the policies and bindings for. Binding conditions will not be evaluated and all bindings that are bound to the target will be returned. All targets from the PolicyBinding are supported, as well as principals that are part of the principalSet. For example: * `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID` * `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID` * `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER` * `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID` * `//iam.goo gleapis.com/projects/PROJECT_NUMBER/locations/LOCATION/workloadIdentityP ools/WORKLOAD_POOL_ID` * `//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID` * `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID` * `principal:alice@example.com` * `principal://iam.googleapis.com/locations/global/workforcePools/pool- id/subject/alice` * `principal://iam.googleapis.com/projects/123/locatio ns/global/workloadIdentityPools/pool-id/subject/alice` * `serviceAccount:my-sa@my-project.iam.gserviceaccount.com` * `user:user@example.com` * `user@example.com` r rr[r%r?r N)rrrrrrrrzr]r^r_r|r} targetQueryrr rrrr sXB   #&  # #Ay/@/@/F/F G(##A&)%%a(+rrc\rSrSrSr"SS\R 5r"SS\R 5r\R"SS5r \R"S5r \R"SS S S 9r \R"S 5r\R"S 5r\R"S5r\R"S5r\R$"SSS 9r\R"S5r\R"S5r\R"S5r\R"S5rSrg)StandardQueryParametersi aQuery parameters accepted by all methods. Enums: FXgafvValueValuesEnum: V1 error format. AltValueValuesEnum: Data format for response. Fields: f__xgafv: V1 error format. access_token: OAuth access token. alt: Data format for response. callback: JSONP fields: Selector specifying which fields to include in a partial response. key: API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token. oauth_token: OAuth 2.0 token for the current user. prettyPrint: Returns response with indentations and line breaks. quotaUser: Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters. trace: A tracing token of the form "token:" to include in api requests. uploadType: Legacy upload protocol for media (e.g. "media", "multipart"). upload_protocol: Upload protocol for media (e.g. "raw", "multipart"). c$\rSrSrSrSrSrSrSrg)*StandardQueryParameters.AltValueValuesEnumi zData format for response. Values: json: Responses with Content-Type of application/json media: Media download with context-dependent Content-Type proto: Responses with Content-Type of application/x-protobuf rr rr N) rrrrrjsonmediaprotorr rrAltValueValuesEnumr s D E Errc \rSrSrSrSrSrSrg)-StandardQueryParameters.FXgafvValueValuesEnumi zFV1 error format. Values: _1: v1 error format _2: v2 error format rr r N)rrrrr_1_2rr rrFXgafvValueValuesEnumr s B Brrr rr%r)defaultr?r@rArBrCTrrrrr N)rrrrrrrarrrdf__xgafvr access_tokenaltcallbackfieldsr6 oauth_tokenr prettyPrint quotaUsertrace uploadTypeupload_protocolrr rrrr s4 9>>  inn  !8! <(&&q),0!VD#  " "1 %(   #&a #%%a(+&&q$7+##A&)    #%$$R(*))"-/rrr!z$.xgafvr1r2N)r __future__rapitools.base.protorpcliterrapitools.base.pyrrpackager;r r r"r*r>rPr^rmrtr}rrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrr rr+r'rr9r=rCrPr$rgrqrvrzrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr r rrrAddCustomJsonFieldMappingAddCustomJsonEnumMappingrr rrr4s'<%(  Z 1 1 Z ?y/@/@ ?T"**T"nA(9#4#4A(HW)*;*;W7y'8'87D =):K:K =&)"3"3&(Qi6G6GQ8 +1B1B + ]1B1B ] 8 0A0A 8 ~)BSBS ~ 81B1B 8 8Y5F5F 8 8y/@/@ 8" (9(9"4mY..mv)I$5$5v)r &)*;*; &F>):):>(I4E4E>(B h9;L;L h %6 8I8I%6P ]9J9J ]/y7H7H/&OyGXGXO* ])J[J[ ] ]9J9J ](9#4#4(0uy/@/@u4 &Y=N=N & %y7H7H % 6 @Q@Q6@4IZIZ4" %I+I4E4E+4)$IZIZ)$X+9;L;L+4+9;L;L+0 1 8I8I 139J9J30+):K:K+.'IZIZ'61I4E4E1+9;L;L+6+9;L;L+* 1 8I8I 139J9J3>+):K:K+4*$yO`O`*$Z+IL]L]+4+IL]L]+, 1IZIZ 13)J[J[32+9K\K\+,'ZcZkZk'0+i6G6G+4+i6G6G+0 193D3D 13I4E4E30+Y5F5F+.'IDUDU'41y/@/@1+i6G6G+6+i6G6G+* 193D3D 13I4E4E3>+Y5F5F+4)$)J[J[)$X'Y5F5F'<'Y5F5F'61)2C2C1393D3D3*(I4E4E(@+ARAR+<'ARAR'81i>O>O13y?P?P3* 1IL]L] 13YM^M^3.3S\SdSd3$ 1PYPaPa 13QZQbQb30 (R[RcRc (F%)y/@/@%)P<.i//<.~ ""Z4!!114>!!114>r