# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
  - GA
  auto_generated: true
  hidden: true
  help_text:
    brief: Update a cloud control.
    description: |
      Update a specific cloud control.
    examples: |-
      To update cloud control `my-cloud-control-id` in organization `my-organization-id` and location `global`, run:

      $ {command} my-cloud-control-id --organization=my-organization-id --location=global \
          --display-name="New control display name" \
          --description="New control description"
  arguments:
    params:
    - help_text: |-
        Identifier. The name of the cloud control, in the format
        `organizations/{organization}/locations/{location}/cloudControls/{cloud_control_id}`.
        The only supported location is `global`.
      is_positional: true
      is_primary_resource: true
      resource_spec: !REF googlecloudsdk.command_lib.compliance_manager.v1_resources:organizations_locations_cloud_controls
      required: true
    - arg_name: description
      api_field: cloudControl.description
      required: false
      repeated: false
      help_text: |-
        A description of the cloud control. The maximum length is 2000 characters.
    - arg_name: display-name
      api_field: cloudControl.displayName
      required: false
      repeated: false
      help_text: |-
        The friendly name of the cloud control. The maximum length is 200
        characters.
    - arg_name: parameter-spec
      api_field: cloudControl.parameterSpec
      required: false
      repeated: true
      help_text: |-
        The parameter specifications for the cloud control.
      clearable: true
      spec:
      - api_field: name
        help_text: |-
          The name of the parameter.
      - api_field: displayName
        help_text: |-
          The friendly name of the parameter. The maximum length is 200 characters.
      - api_field: description
        help_text: |-
          The description of the parameter. The maximum length is 2000 characters.
      - api_field: isRequired
        help_text: |-
          Whether the parameter is required.
      - api_field: valueType
        help_text: |-
          The parameter value type.
      - api_field: defaultValue
        help_text: |-
          The default value of the parameter.
        spec:
        - api_field: stringValue
          one_of_index: 0
          help_text: |-
            A string value.
        - api_field: boolValue
          one_of_index: 0
          help_text: |-
            A boolean value.
        - api_field: stringListValue
          one_of_index: 0
          help_text: |-
            A repeated string.
          spec:
          - api_field: values
            help_text: |-
              The strings in the list.
        - api_field: numberValue
          one_of_index: 0
          help_text: |-
            A double value.
      - api_field: substitutionRules
        help_text: |-
          The list of parameter substitutions.
        spec:
        - api_field: placeholderSubstitutionRule
          one_of_index: 0
          help_text: |-
            The placeholder substitution rule.
          spec:
          - api_field: attribute
            help_text: |-
              The fully qualified proto attribute path, in dot notation.
        - api_field: attributeSubstitutionRule
          one_of_index: 0
          help_text: |-
            The attribute substitution rule.
          spec:
          - api_field: attribute
            help_text: |-
              The fully qualified proto attribute path, in dot notation.
              For example: `rules[0].cel_expression.resource_types_values`
      - api_field: validation
        help_text: |-
          The permitted set of values for the parameter.
        spec:
        - api_field: allowedValues
          one_of_index: 0
          help_text: |-
            The permitted set of values for the parameter.
          spec:
          - api_field: values
            help_text: |-
              The list of allowed values for the parameter.
            spec:
            - api_field: stringValue
              one_of_index: 0
              help_text: |-
                A string value.
            - api_field: boolValue
              one_of_index: 0
              help_text: |-
                A boolean value.
            - api_field: stringListValue
              one_of_index: 0
              help_text: |-
                A repeated string.
              spec:
              - api_field: values
                help_text: |-
                  The strings in the list.
            - api_field: numberValue
              one_of_index: 0
              help_text: |-
                A double value.
        - api_field: intRange
          one_of_index: 0
          help_text: |-
            The permitted range for numeric parameters.
          spec:
          - api_field: min
            help_text: |-
              The minimum permitted value for the numeric parameter (inclusive).
          - api_field: max
            help_text: |-
              The maximum permitted value for the numeric parameter (inclusive).
        - api_field: regexpPattern
          one_of_index: 0
          help_text: |-
            The regular expression for string parameters.
          spec:
          - api_field: pattern
            help_text: |-
              The regex pattern to match the values of the parameter with.
    - arg_name: rules
      api_field: cloudControl.rules
      required: false
      repeated: true
      help_text: |-
        The rules that you can enforce to meet your security or compliance intent.
      clearable: true
      spec:
      - api_field: celExpression
        one_of_index: 0
        help_text: |-
          The rule's logic expression in Common Expression Language (CEL).
        spec:
        - api_field: resourceTypesValues
          one_of_index: 0
          help_text: |-
            The resource instance types on which this expression is defined.
            The format is `<SERVICE_NAME>/<type>`.
            For example: `compute.googleapis.com/Instance`
          spec:
          - api_field: values
            help_text: |-
              The strings in the list.
        - api_field: expression
          help_text: |-
            The logical expression in CEL. The maximum length of the condition
            is 1000 characters. For more information, see
            [CEL
            expression](https://cloud.google.com/security-command-center/docs/compliance-manager-write-cel-expressions).
      - api_field: description
        help_text: |-
          The rule description. The maximum length is 2000 characters.
      - api_field: ruleActionTypes
        help_text: |-
          The functionality that's enabled by the rule.
    - arg_name: severity
      api_field: cloudControl.severity
      required: false
      help_text: |-
        The severity of the findings that are generated by the cloud control.
      choices:
      - arg_value: critical
        enum_value: CRITICAL
        help_text: |-
          A critical vulnerability is easily discoverable by an external actor,
          exploitable, and results in the direct ability to execute arbitrary code,
          exfiltrate data, and otherwise gain additional access and privileges to
          cloud resources and workloads. Examples include publicly accessible
          unprotected user data and public SSH access with weak or no
          passwords.

          A critical threat is a threat that can access, modify, or delete data or
          execute unauthorized code within existing resources.
      - arg_value: high
        enum_value: HIGH
        help_text: |-
          A high-risk vulnerability can be easily discovered and exploited in
          combination with other vulnerabilities to gain direct access and
          the ability to execute arbitrary code, exfiltrate data, and otherwise
          gain additional access and privileges to cloud resources and workloads.
          An example is a database with weak or no passwords that is only
          accessible internally. This database could easily be compromised by an
          actor that had access to the internal network.

          A high-risk threat is a threat that can create new computational
          resources in an environment but can't access data or execute code in
          existing resources.
      - arg_value: medium
        enum_value: MEDIUM
        help_text: |-
          A medium-risk vulnerability can be used by an actor to gain access to
          resources or privileges that enable them to eventually (through multiple
          steps or a complex exploit) gain access and the ability to execute
          arbitrary code or exfiltrate data. An example is a service account with
          access to more projects than it should have. If an actor gains access to
          the service account, they could potentially use that access to manipulate
          a project the service account was not intended to.

          A medium-risk threat can cause operational impact but might not
          access data or execute unauthorized code.
      - arg_value: low
        enum_value: LOW
        help_text: |-
          A low-risk vulnerability hampers a security organization's ability to
          detect vulnerabilities or active threats in their deployment, or prevents
          the root cause investigation of security issues. An example is monitoring
          and logs being disabled for resource configurations and access.

          A low-risk threat is a threat that has obtained minimal access to an
          environment but can't access data, execute code, or create resources.
    - arg_name: finding-category
      api_field: cloudControl.findingCategory
      required: false
      repeated: false
      help_text: |-
        The finding category for the cloud control findings. The maximum
        length is 255 characters.
    - arg_name: supported-cloud-providers
      api_field: cloudControl.supportedCloudProviders
      required: false
      repeated: true
      help_text: |-
        The supported cloud providers.
      choices:
      - arg_value: aws
        enum_value: AWS
        help_text: |-
          Amazon Web Services (AWS).
      - arg_value: azure
        enum_value: AZURE
        help_text: |-
          Microsoft Azure.
      - arg_value: gcp
        enum_value: GCP
        help_text: |-
          Google Cloud.
      clearable: true
    - arg_name: remediation-steps
      api_field: cloudControl.remediationSteps
      required: false
      repeated: false
      help_text: |-
        The remediation steps for the cloud control findings. The
        maximum length is 400 characters.
    - arg_name: categories
      api_field: cloudControl.categories
      required: false
      repeated: true
      help_text: |-
        The categories for the cloud control.
      choices:
      - arg_value: cc-category-infrastructure
        enum_value: CC_CATEGORY_INFRASTRUCTURE
        help_text: |-
          The infrastructure security category.
      - arg_value: cc-category-artificial-intelligence
        enum_value: CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
        help_text: |-
          The artificial intelligence category.
      - arg_value: cc-category-physical-security
        enum_value: CC_CATEGORY_PHYSICAL_SECURITY
        help_text: |-
          The physical security category.
      - arg_value: cc-category-data-security
        enum_value: CC_CATEGORY_DATA_SECURITY
        help_text: |-
          The data security category.
      - arg_value: cc-category-network-security
        enum_value: CC_CATEGORY_NETWORK_SECURITY
        help_text: |-
          The network security category.
      - arg_value: cc-category-incident-management
        enum_value: CC_CATEGORY_INCIDENT_MANAGEMENT
        help_text: |-
          The incident management category.
      - arg_value: cc-category-identity-and-access-management
        enum_value: CC_CATEGORY_IDENTITY_AND_ACCESS_MANAGEMENT
        help_text: |-
          The identity and access management category.
      - arg_value: cc-category-encryption
        enum_value: CC_CATEGORY_ENCRYPTION
        help_text: |-
          The encryption category.
      - arg_value: cc-category-logs-management-and-infrastructure
        enum_value: CC_CATEGORY_LOGS_MANAGEMENT_AND_INFRASTRUCTURE
        help_text: |-
          The logs management and infrastructure category.
      - arg_value: cc-category-hr-admin-and-processes
        enum_value: CC_CATEGORY_HR_ADMIN_AND_PROCESSES
        help_text: |-
          The HR, admin, and processes category.
      - arg_value: cc-category-third-party-and-sub-processor-management
        enum_value: CC_CATEGORY_THIRD_PARTY_AND_SUB_PROCESSOR_MANAGEMENT
        help_text: |-
          The third-party and sub-processor management category.
      - arg_value: cc-category-legal-and-disclosures
        enum_value: CC_CATEGORY_LEGAL_AND_DISCLOSURES
        help_text: |-
          The legal and disclosures category.
      - arg_value: cc-category-vulnerability-management
        enum_value: CC_CATEGORY_VULNERABILITY_MANAGEMENT
        help_text: |-
          The vulnerability management category.
      - arg_value: cc-category-privacy
        enum_value: CC_CATEGORY_PRIVACY
        help_text: |-
          The privacy category.
      - arg_value: cc-category-bcdr
        enum_value: CC_CATEGORY_BCDR
        help_text: |-
          The business continuity and disaster recovery (BCDR) category.
      clearable: true
    - arg_name: supported-target-resource-types
      api_field: cloudControl.supportedTargetResourceTypes
      required: false
      repeated: true
      help_text: |-
        The target resource types that are supported by the cloud control.
      choices:
      - arg_value: target-resource-crm-type-org
        enum_value: TARGET_RESOURCE_CRM_TYPE_ORG
        help_text: |-
          The target resource is a Google Cloud organization.
      - arg_value: target-resource-crm-type-folder
        enum_value: TARGET_RESOURCE_CRM_TYPE_FOLDER
        help_text: |-
          The target resource is a folder.
      - arg_value: target-resource-crm-type-project
        enum_value: TARGET_RESOURCE_CRM_TYPE_PROJECT
        help_text: |-
          The target resource is a project.
      - arg_value: target-resource-type-application
        enum_value: TARGET_RESOURCE_TYPE_APPLICATION
        help_text: |-
          The target resource is an application in App Hub.
      clearable: true
  request:
    api_version: v1
    collection:
    - cloudsecuritycompliance.organizations.locations.cloudControls
  update:
    read_modify_update: true
