| <html><body> |
| <style> |
| |
| body, h1, h2, h3, div, span, p, pre, a { |
| margin: 0; |
| padding: 0; |
| border: 0; |
| font-weight: inherit; |
| font-style: inherit; |
| font-size: 100%; |
| font-family: inherit; |
| vertical-align: baseline; |
| } |
| |
| body { |
| font-size: 13px; |
| padding: 1em; |
| } |
| |
| h1 { |
| font-size: 26px; |
| margin-bottom: 1em; |
| } |
| |
| h2 { |
| font-size: 24px; |
| margin-bottom: 1em; |
| } |
| |
| h3 { |
| font-size: 20px; |
| margin-bottom: 1em; |
| margin-top: 1em; |
| } |
| |
| pre, code { |
| line-height: 1.5; |
| font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace; |
| } |
| |
| pre { |
| margin-top: 0.5em; |
| } |
| |
| h1, h2, h3, p { |
| font-family: Arial, sans serif; |
| } |
| |
| h1, h2, h3 { |
| border-bottom: solid #CCC 1px; |
| } |
| |
| .toc_element { |
| margin-top: 0.5em; |
| } |
| |
| .firstline { |
| margin-left: 2 em; |
| } |
| |
| .method { |
| margin-top: 1em; |
| border: solid 1px #CCC; |
| padding: 1em; |
| background: #EEE; |
| } |
| |
| .details { |
| font-weight: bold; |
| font-size: 14px; |
| } |
| |
| </style> |
| |
| <h1><a href="cloudasset_v1.html">Cloud Asset API</a> . <a href="cloudasset_v1.v1.html">v1</a></h1> |
| <h2>Instance Methods</h2> |
| <p class="toc_element"> |
| <code><a href="#batchGetAssetsHistory">batchGetAssetsHistory(parent, assetNames=None, contentType=None, readTimeWindow_endTime=None, readTimeWindow_startTime=None, x__xgafv=None)</a></code></p> |
| <p class="firstline">Batch gets the update history of assets that overlap a time window.</p> |
| <p class="toc_element"> |
| <code><a href="#exportAssets">exportAssets(parent, body=None, x__xgafv=None)</a></code></p> |
| <p class="firstline">Exports assets with time and resource types to a given Cloud Storage</p> |
| <p class="toc_element"> |
| <code><a href="#searchAllIamPolicies">searchAllIamPolicies(scope, query=None, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p> |
| <p class="firstline">Searches all the IAM policies within the given accessible scope (e.g., a</p> |
| <p class="toc_element"> |
| <code><a href="#searchAllIamPolicies_next">searchAllIamPolicies_next(previous_request, previous_response)</a></code></p> |
| <p class="firstline">Retrieves the next page of results.</p> |
| <p class="toc_element"> |
| <code><a href="#searchAllResources">searchAllResources(scope, orderBy=None, query=None, assetTypes=None, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p> |
| <p class="firstline">Searches all the resources within the given accessible scope (e.g., a</p> |
| <p class="toc_element"> |
| <code><a href="#searchAllResources_next">searchAllResources_next(previous_request, previous_response)</a></code></p> |
| <p class="firstline">Retrieves the next page of results.</p> |
| <h3>Method Details</h3> |
| <div class="method"> |
| <code class="details" id="batchGetAssetsHistory">batchGetAssetsHistory(parent, assetNames=None, contentType=None, readTimeWindow_endTime=None, readTimeWindow_startTime=None, x__xgafv=None)</code> |
| <pre>Batch gets the update history of assets that overlap a time window. |
| For IAM_POLICY content, this API outputs history when the asset and its |
| attached IAM POLICY both exist. This can create gaps in the output history. |
| Otherwise, this API outputs history with asset in both non-delete or |
| deleted status. |
| If a specified asset does not exist, this API returns an INVALID_ARGUMENT |
| error. |
| |
| Args: |
| parent: string, Required. The relative name of the root asset. It can only be an |
| organization number (such as "organizations/123"), a project ID (such as |
| "projects/my-project-id")", or a project number (such as "projects/12345"). (required) |
| assetNames: string, A list of the full names of the assets. |
| See: https://cloud.google.com/asset-inventory/docs/resource-name-format |
| Example: |
| |
| `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. |
| |
| The request becomes a no-op if the asset name list is empty, and the max |
| size of the asset name list is 100 in one request. (repeated) |
| contentType: string, Optional. The content type. |
| readTimeWindow_endTime: string, End time of the time window (inclusive). If not specified, the current |
| timestamp is used instead. |
| readTimeWindow_startTime: string, Start time of the time window (exclusive). |
| x__xgafv: string, V1 error format. |
| Allowed values |
| 1 - v1 error format |
| 2 - v2 error format |
| |
| Returns: |
| An object of the form: |
| |
| { # Batch get assets history response. |
| "assets": [ # A list of assets with valid time windows. |
| { # An asset in Google Cloud and its temporal metadata, including the time window |
| # when it was observed and its status during that window. |
| "deleted": True or False, # Whether the asset has been deleted or not. |
| "priorAsset": { # An asset in Google Cloud. An asset can be any resource in the Google Cloud # Prior copy of the asset. Populated if prior_asset_state is PRESENT. |
| # Currently this is only set for responses in Real-Time Feed. |
| # [resource |
| # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), |
| # a resource outside the Google Cloud resource hierarchy (such as Google |
| # Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy). |
| # See [Supported asset |
| # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) |
| # for more information. |
| "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access # A representation of the Cloud IAM policy set on a Google Cloud resource. |
| # There can be a maximum of one Cloud IAM policy set on any given resource. |
| # In addition, Cloud IAM policies inherit their granted access scope from any |
| # policies set on parent resources in the resource hierarchy. Therefore, the |
| # effectively policy is the union of both the policy set on this resource |
| # and each policy set on all of the resource's ancestry resource levels in |
| # the hierarchy. See |
| # [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for |
| # more information. |
| # controls for Google Cloud resources. |
| # |
| # |
| # A `Policy` is a collection of `bindings`. A `binding` binds one or more |
| # `members` to a single `role`. Members can be user accounts, service accounts, |
| # Google groups, and domains (such as G Suite). A `role` is a named list of |
| # permissions; each `role` can be an IAM predefined role or a user-created |
| # custom role. |
| # |
| # For some types of Google Cloud resources, a `binding` can also specify a |
| # `condition`, which is a logical expression that allows access to a resource |
| # only if the expression evaluates to `true`. A condition can add constraints |
| # based on attributes of the request, the resource, or both. To learn which |
| # resources support conditions in their IAM policies, see the |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| # |
| # **JSON example:** |
| # |
| # { |
| # "bindings": [ |
| # { |
| # "role": "roles/resourcemanager.organizationAdmin", |
| # "members": [ |
| # "user:mike@example.com", |
| # "group:admins@example.com", |
| # "domain:google.com", |
| # "serviceAccount:my-project-id@appspot.gserviceaccount.com" |
| # ] |
| # }, |
| # { |
| # "role": "roles/resourcemanager.organizationViewer", |
| # "members": [ |
| # "user:eve@example.com" |
| # ], |
| # "condition": { |
| # "title": "expirable access", |
| # "description": "Does not grant access after Sep 2020", |
| # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", |
| # } |
| # } |
| # ], |
| # "etag": "BwWWja0YfJA=", |
| # "version": 3 |
| # } |
| # |
| # **YAML example:** |
| # |
| # bindings: |
| # - members: |
| # - user:mike@example.com |
| # - group:admins@example.com |
| # - domain:google.com |
| # - serviceAccount:my-project-id@appspot.gserviceaccount.com |
| # role: roles/resourcemanager.organizationAdmin |
| # - members: |
| # - user:eve@example.com |
| # role: roles/resourcemanager.organizationViewer |
| # condition: |
| # title: expirable access |
| # description: Does not grant access after Sep 2020 |
| # expression: request.time < timestamp('2020-10-01T00:00:00.000Z') |
| # - etag: BwWWja0YfJA= |
| # - version: 3 |
| # |
| # For a description of IAM and its features, see the |
| # [IAM documentation](https://cloud.google.com/iam/docs/). |
| "version": 42, # Specifies the format of the policy. |
| # |
| # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value |
| # are rejected. |
| # |
| # Any operation that affects conditional role bindings must specify version |
| # `3`. This requirement applies to the following operations: |
| # |
| # * Getting a policy that includes a conditional role binding |
| # * Adding a conditional role binding to a policy |
| # * Changing a conditional role binding in a policy |
| # * Removing any role binding, with or without a condition, from a policy |
| # that includes conditions |
| # |
| # **Important:** If you use IAM Conditions, you must include the `etag` field |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows |
| # you to overwrite a version `3` policy with a version `1` policy, and all of |
| # the conditions in the version `3` policy are lost. |
| # |
| # If a policy does not include any conditions, operations on that policy may |
| # specify any valid version or leave the field unset. |
| # |
| # To learn which resources support conditions in their IAM policies, see the |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| "auditConfigs": [ # Specifies cloud audit logging configuration for this policy. |
| { # Specifies the audit configuration for a service. |
| # The configuration determines which permission types are logged, and what |
| # identities, if any, are exempted from logging. |
| # An AuditConfig must have one or more AuditLogConfigs. |
| # |
| # If there are AuditConfigs for both `allServices` and a specific service, |
| # the union of the two AuditConfigs is used for that service: the log_types |
| # specified in each AuditConfig are enabled, and the exempted_members in each |
| # AuditLogConfig are exempted. |
| # |
| # Example Policy with multiple AuditConfigs: |
| # |
| # { |
| # "audit_configs": [ |
| # { |
| # "service": "allServices", |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ", |
| # "exempted_members": [ |
| # "user:jose@example.com" |
| # ] |
| # }, |
| # { |
| # "log_type": "DATA_WRITE" |
| # }, |
| # { |
| # "log_type": "ADMIN_READ" |
| # } |
| # ] |
| # }, |
| # { |
| # "service": "sampleservice.googleapis.com", |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ" |
| # }, |
| # { |
| # "log_type": "DATA_WRITE", |
| # "exempted_members": [ |
| # "user:aliya@example.com" |
| # ] |
| # } |
| # ] |
| # } |
| # ] |
| # } |
| # |
| # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ |
| # logging. It also exempts jose@example.com from DATA_READ logging, and |
| # aliya@example.com from DATA_WRITE logging. |
| "service": "A String", # Specifies a service that will be enabled for audit logging. |
| # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. |
| # `allServices` is a special value that covers all services. |
| "auditLogConfigs": [ # The configuration for logging of each type of permission. |
| { # Provides the configuration for logging a type of permissions. |
| # Example: |
| # |
| # { |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ", |
| # "exempted_members": [ |
| # "user:jose@example.com" |
| # ] |
| # }, |
| # { |
| # "log_type": "DATA_WRITE" |
| # } |
| # ] |
| # } |
| # |
| # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting |
| # jose@example.com from DATA_READ logging. |
| "logType": "A String", # The log type that this config enables. |
| "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of |
| # permission. |
| # Follows the same format of Binding.members. |
| "A String", |
| ], |
| }, |
| ], |
| }, |
| ], |
| "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a |
| # `condition` that determines how and when the `bindings` are applied. Each |
| # of the `bindings` must contain at least one member. |
| { # Associates `members` with a `role`. |
| "role": "A String", # Role that is assigned to `members`. |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. |
| "members": [ # Specifies the identities requesting access for a Cloud Platform resource. |
| # `members` can have the following values: |
| # |
| # * `allUsers`: A special identifier that represents anyone who is |
| # on the internet; with or without a Google account. |
| # |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone |
| # who is authenticated with a Google account or a service account. |
| # |
| # * `user:{emailid}`: An email address that represents a specific Google |
| # account. For example, `alice@example.com` . |
| # |
| # |
| # * `serviceAccount:{emailid}`: An email address that represents a service |
| # account. For example, `my-other-app@appspot.gserviceaccount.com`. |
| # |
| # * `group:{emailid}`: An email address that represents a Google group. |
| # For example, `admins@example.com`. |
| # |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique |
| # identifier) representing a user that has been recently deleted. For |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is |
| # recovered, this value reverts to `user:{emailid}` and the recovered user |
| # retains the role in the binding. |
| # |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus |
| # unique identifier) representing a service account that has been recently |
| # deleted. For example, |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. |
| # If the service account is undeleted, this value reverts to |
| # `serviceAccount:{emailid}` and the undeleted service account retains the |
| # role in the binding. |
| # |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique |
| # identifier) representing a Google group that has been recently |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If |
| # the group is recovered, this value reverts to `group:{emailid}` and the |
| # recovered group retains the role in the binding. |
| # |
| # |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the |
| # users of that domain. For example, `google.com` or `example.com`. |
| # |
| "A String", |
| ], |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. |
| # |
| # If the condition evaluates to `true`, then this binding applies to the |
| # current request. |
| # |
| # If the condition evaluates to `false`, then this binding does not apply to |
| # the current request. However, a different role binding might grant the same |
| # role to one or more of the members in this binding. |
| # |
| # To learn which resources support conditions in their IAM policies, see the |
| # [IAM |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL |
| # are documented at https://github.com/google/cel-spec. |
| # |
| # Example (Comparison): |
| # |
| # title: "Summary size limit" |
| # description: "Determines if a summary is less than 100 chars" |
| # expression: "document.summary.size() < 100" |
| # |
| # Example (Equality): |
| # |
| # title: "Requestor is owner" |
| # description: "Determines if requestor is the document owner" |
| # expression: "document.owner == request.auth.claims.email" |
| # |
| # Example (Logic): |
| # |
| # title: "Public documents" |
| # description: "Determine whether the document should be publicly visible" |
| # expression: "document.type != 'private' && document.type != 'internal'" |
| # |
| # Example (Data Manipulation): |
| # |
| # title: "Notification string" |
| # description: "Create a notification string with a timestamp." |
| # expression: "'New message received at ' + string(document.create_time)" |
| # |
| # The exact variables and functions that may be referenced within an expression |
| # are determined by the service that evaluates it. See the service |
| # documentation for additional information. |
| "description": "A String", # Optional. Description of the expression. This is a longer text which |
| # describes the expression, e.g. when hovered over it in a UI. |
| "location": "A String", # Optional. String indicating the location of the expression for error |
| # reporting, e.g. a file name and a position in the file. |
| "expression": "A String", # Textual representation of an expression in Common Expression Language |
| # syntax. |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing |
| # its purpose. This can be used e.g. in UIs which allow to enter the |
| # expression. |
| }, |
| }, |
| ], |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help |
| # prevent simultaneous updates of a policy from overwriting each other. |
| # It is strongly suggested that systems make use of the `etag` in the |
| # read-modify-write cycle to perform policy updates in order to avoid race |
| # conditions: An `etag` is returned in the response to `getIamPolicy`, and |
| # systems are expected to put that etag in the request to `setIamPolicy` to |
| # ensure that their change will be applied to the same version of the policy. |
| # |
| # **Important:** If you use IAM Conditions, you must include the `etag` field |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows |
| # you to overwrite a version `3` policy with a version `1` policy, and all of |
| # the conditions in the version `3` policy are lost. |
| }, |
| "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` |
| # |
| # See [Supported asset |
| # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) |
| # for more information. |
| "ancestors": [ # The ancestry path of an asset in Google Cloud [resource |
| # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), |
| # represented as a list of relative resource names. An ancestry path starts |
| # with the closest ancestor in the hierarchy and ends at root. If the asset |
| # is a project, folder, or organization, the ancestry path starts from the |
| # asset itself. |
| # |
| # Example: `["projects/123456789", "folders/5432", "organizations/1234"]` |
| "A String", |
| ], |
| "resource": { # A representation of a Google Cloud resource. # A representation of the resource. |
| "resourceUrl": "A String", # The REST URL for accessing the resource. An HTTP `GET` request using this |
| # URL returns the resource itself. Example: |
| # `https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123` |
| # |
| # This value is unspecified for resources without a REST API. |
| "discoveryName": "A String", # The JSON schema name listed in the discovery document. Example: |
| # `Project` |
| # |
| # This value is unspecified for resources that do not have an API based on a |
| # discovery document, such as Cloud Bigtable. |
| "discoveryDocumentUri": "A String", # The URL of the discovery document containing the resource's JSON schema. |
| # Example: |
| # `https://www.googleapis.com/discovery/v1/apis/compute/v1/rest` |
| # |
| # This value is unspecified for resources that do not have an API based on a |
| # discovery document, such as Cloud Bigtable. |
| "data": { # The content of the resource, in which some sensitive fields are removed |
| # and may not be present. |
| "a_key": "", # Properties of the object. |
| }, |
| "version": "A String", # The API version. Example: `v1` |
| "parent": "A String", # The full name of the immediate parent of this resource. See |
| # [Resource |
| # Names](https://cloud.google.com/apis/design/resource_names#full_resource_name) |
| # for more information. |
| # |
| # For Google Cloud assets, this value is the parent resource defined in the |
| # [Cloud IAM policy |
| # hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy). |
| # Example: |
| # `//cloudresourcemanager.googleapis.com/projects/my_project_123` |
| # |
| # For third-party assets, this field may be set differently. |
| "location": "A String", # The location of the resource in Google Cloud, such as its zone and region. |
| # For more information, see https://cloud.google.com/about/locations/. |
| }, |
| "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary # Please also refer to the [access policy user |
| # guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). |
| # attributes to use Google Cloud services) and `ServicePerimeters` (which |
| # define regions of services able to freely pass data within a perimeter). An |
| # access policy is globally visible within an organization, and the |
| # restrictions it specifies apply to all projects within an organization. |
| "parent": "A String", # Required. The parent of this `AccessPolicy` in the Cloud Resource |
| # Hierarchy. Currently immutable once created. Format: |
| # `organizations/{organization_id}` |
| "title": "A String", # Required. Human readable title. Does not affect behavior. |
| "name": "A String", # Output only. Resource name of the `AccessPolicy`. Format: |
| # `accessPolicies/{policy_id}` |
| "etag": "A String", # Output only. An opaque identifier for the current version of the |
| # `AccessPolicy`. This will always be a strongly validated etag, meaning that |
| # two Access Polices will be identical if and only if their etags are |
| # identical. Clients should not expect this to be in any specific format. |
| }, |
| "accessLevel": { # An `AccessLevel` is a label that can be applied to requests to Google Cloud # Please also refer to the [access level user |
| # guide](https://cloud.google.com/access-context-manager/docs/overview#access-levels). |
| # services, along with a list of requirements necessary for the label to be |
| # applied. |
| "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. |
| "basic": { # `BasicLevel` is an `AccessLevel` using a set of recommended features. # A `BasicLevel` composed of `Conditions`. |
| "combiningFunction": "A String", # How the `conditions` list should be combined to determine if a request is |
| # granted this `AccessLevel`. If AND is used, each `Condition` in |
| # `conditions` must be satisfied for the `AccessLevel` to be applied. If OR |
| # is used, at least one `Condition` in `conditions` must be satisfied for the |
| # `AccessLevel` to be applied. Default behavior is AND. |
| "conditions": [ # Required. A list of requirements for the `AccessLevel` to be granted. |
| { # A condition necessary for an `AccessLevel` to be granted. The Condition is an |
| # AND over its fields. So a Condition is true if: 1) the request IP is from one |
| # of the listed subnetworks AND 2) the originating device complies with the |
| # listed device policy AND 3) all listed access levels are granted AND 4) the |
| # request was sent at a time allowed by the DateTimeRestriction. |
| "requiredAccessLevels": [ # A list of other access levels defined in the same `Policy`, referenced by |
| # resource name. Referencing an `AccessLevel` which does not exist is an |
| # error. All access levels listed must be granted for the Condition |
| # to be true. Example: |
| # "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"` |
| "A String", |
| ], |
| "devicePolicy": { # `DevicePolicy` specifies device specific restrictions necessary to acquire a # Device specific restrictions, all restrictions must hold for the |
| # Condition to be true. If not specified, all devices are allowed. |
| # given access level. A `DevicePolicy` specifies requirements for requests from |
| # devices to be granted access levels, it does not do any enforcement on the |
| # device. `DevicePolicy` acts as an AND over all specified fields, and each |
| # repeated field is an OR over its elements. Any unset fields are ignored. For |
| # example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : |
| # DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be |
| # true for requests originating from encrypted Linux desktops and encrypted |
| # Windows desktops. |
| "requireScreenlock": True or False, # Whether or not screenlock is required for the DevicePolicy to be true. |
| # Defaults to `false`. |
| "osConstraints": [ # Allowed OS versions, an empty list allows all types and all versions. |
| { # A restriction on the OS type and version of devices making requests. |
| "osType": "A String", # Required. The allowed OS type. |
| "minimumVersion": "A String", # The minimum allowed OS version. If not set, any version of this OS |
| # satisfies the constraint. Format: `"major.minor.patch"`. |
| # Examples: `"10.5.301"`, `"9.2.1"`. |
| "requireVerifiedChromeOs": True or False, # Only allows requests from devices with a verified Chrome OS. |
| # Verifications includes requirements that the device is enterprise-managed, |
| # conformant to domain policies, and the caller has permission to call |
| # the API targeted by the request. |
| }, |
| ], |
| "requireAdminApproval": True or False, # Whether the device needs to be approved by the customer admin. |
| "allowedDeviceManagementLevels": [ # Allowed device management levels, an empty list allows all management |
| # levels. |
| "A String", |
| ], |
| "requireCorpOwned": True or False, # Whether the device needs to be corp owned. |
| "allowedEncryptionStatuses": [ # Allowed encryptions statuses, an empty list allows all statuses. |
| "A String", |
| ], |
| }, |
| "members": [ # The request must be made by one of the provided user or service |
| # accounts. Groups are not supported. |
| # Syntax: |
| # `user:{emailid}` |
| # `serviceAccount:{emailid}` |
| # If not specified, a request may come from any user. |
| "A String", |
| ], |
| "regions": [ # The request must originate from one of the provided countries/regions. |
| # Must be valid ISO 3166-1 alpha-2 codes. |
| "A String", |
| ], |
| "ipSubnetworks": [ # CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for |
| # a CIDR IP address block, the specified IP address portion must be properly |
| # truncated (i.e. all the host bits must be zero) or the input is considered |
| # malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is |
| # not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas |
| # "2001:db8::1/32" is not. The originating IP of a request must be in one of |
| # the listed subnets in order for this Condition to be true. If empty, all IP |
| # addresses are allowed. |
| "A String", |
| ], |
| "negate": True or False, # Whether to negate the Condition. If true, the Condition becomes a NAND over |
| # its non-empty fields, each field must be false for the Condition overall to |
| # be satisfied. Defaults to false. |
| }, |
| ], |
| }, |
| "name": "A String", # Required. Resource name for the Access Level. The `short_name` component |
| # must begin with a letter and only include alphanumeric and '_'. Format: |
| # `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length |
| # of the `short_name` component is 50 characters. |
| "custom": { # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language # A `CustomLevel` written in the Common Expression Language. |
| # to represent the necessary conditions for the level to apply to a request. |
| # See CEL spec at: https://github.com/google/cel-spec |
| "expr": { # Represents a textual expression in the Common Expression Language (CEL) # Required. A Cloud CEL expression evaluating to a boolean. |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL |
| # are documented at https://github.com/google/cel-spec. |
| # |
| # Example (Comparison): |
| # |
| # title: "Summary size limit" |
| # description: "Determines if a summary is less than 100 chars" |
| # expression: "document.summary.size() < 100" |
| # |
| # Example (Equality): |
| # |
| # title: "Requestor is owner" |
| # description: "Determines if requestor is the document owner" |
| # expression: "document.owner == request.auth.claims.email" |
| # |
| # Example (Logic): |
| # |
| # title: "Public documents" |
| # description: "Determine whether the document should be publicly visible" |
| # expression: "document.type != 'private' && document.type != 'internal'" |
| # |
| # Example (Data Manipulation): |
| # |
| # title: "Notification string" |
| # description: "Create a notification string with a timestamp." |
| # expression: "'New message received at ' + string(document.create_time)" |
| # |
| # The exact variables and functions that may be referenced within an expression |
| # are determined by the service that evaluates it. See the service |
| # documentation for additional information. |
| "description": "A String", # Optional. Description of the expression. This is a longer text which |
| # describes the expression, e.g. when hovered over it in a UI. |
| "location": "A String", # Optional. String indicating the location of the expression for error |
| # reporting, e.g. a file name and a position in the file. |
| "expression": "A String", # Textual representation of an expression in Common Expression Language |
| # syntax. |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing |
| # its purpose. This can be used e.g. in UIs which allow to enter the |
| # expression. |
| }, |
| }, |
| "title": "A String", # Human readable title. Must be unique within the Policy. |
| }, |
| "orgPolicy": [ # A representation of an [organization |
| # policy](https://cloud.google.com/resource-manager/docs/organization-policy/overview#organization_policy). |
| # There can be more than one organization policy with different constraints |
| # set on a given resource. |
| { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` |
| # for configurations of Cloud Platform resources. |
| "etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for |
| # concurrency control. |
| # |
| # When the `Policy` is returned from either a `GetPolicy` or a |
| # `ListOrgPolicy` request, this `etag` indicates the version of the current |
| # `Policy` to use when executing a read-modify-write loop. |
| # |
| # When the `Policy` is returned from a `GetEffectivePolicy` request, the |
| # `etag` will be unset. |
| # |
| # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value |
| # that was returned from a `GetOrgPolicy` request as part of a |
| # read-modify-write loop for concurrency control. Not setting the `etag`in a |
| # `SetOrgPolicy` request will result in an unconditional write of the |
| # `Policy`. |
| "version": 42, # Version of the `Policy`. Default version is 0; |
| "restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of |
| # `Constraint` type. |
| # `constraint_default` enforcement behavior of the specific `Constraint` at |
| # this resource. |
| # |
| # Suppose that `constraint_default` is set to `ALLOW` for the |
| # `Constraint` `constraints/serviceuser.services`. Suppose that organization |
| # foo.com sets a `Policy` at their Organization resource node that restricts |
| # the allowed service activations to deny all service activations. They |
| # could then set a `Policy` with the `policy_type` `restore_default` on |
| # several experimental projects, restoring the `constraint_default` |
| # enforcement of the `Constraint` for only those projects, allowing those |
| # projects to have all services activated. |
| }, |
| "updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the |
| # server, not specified by the caller, and represents the last time a call to |
| # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will |
| # be ignored. |
| "constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example, |
| # `constraints/serviceuser.services`. |
| # |
| # A [list of available |
| # constraints](/resource-manager/docs/organization-policy/org-policy-constraints) |
| # is available. |
| # |
| # Immutable after creation. |
| "booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not. |
| # resource. |
| "enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any |
| # configuration is acceptable. |
| # |
| # Suppose you have a `Constraint` |
| # `constraints/compute.disableSerialPortAccess` with `constraint_default` |
| # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following |
| # behavior: |
| # - If the `Policy` at this resource has enforced set to `false`, serial |
| # port connection attempts will be allowed. |
| # - If the `Policy` at this resource has enforced set to `true`, serial |
| # port connection attempts will be refused. |
| # - If the `Policy` at this resource is `RestoreDefault`, serial port |
| # connection attempts will be allowed. |
| # - If no `Policy` is set at this resource or anywhere higher in the |
| # resource hierarchy, serial port connection attempts will be allowed. |
| # - If no `Policy` is set at this resource, but one exists higher in the |
| # resource hierarchy, the behavior is as if the`Policy` were set at |
| # this resource. |
| # |
| # The following examples demonstrate the different possible layerings: |
| # |
| # Example 1 (nearest `Constraint` wins): |
| # `organizations/foo` has a `Policy` with: |
| # {enforced: false} |
| # `projects/bar` has no `Policy` set. |
| # The constraint at `projects/bar` and `organizations/foo` will not be |
| # enforced. |
| # |
| # Example 2 (enforcement gets replaced): |
| # `organizations/foo` has a `Policy` with: |
| # {enforced: false} |
| # `projects/bar` has a `Policy` with: |
| # {enforced: true} |
| # The constraint at `organizations/foo` is not enforced. |
| # The constraint at `projects/bar` is enforced. |
| # |
| # Example 3 (RestoreDefault): |
| # `organizations/foo` has a `Policy` with: |
| # {enforced: true} |
| # `projects/bar` has a `Policy` with: |
| # {RestoreDefault: {}} |
| # The constraint at `organizations/foo` is enforced. |
| # The constraint at `projects/bar` is not enforced, because |
| # `constraint_default` for the `Constraint` is `ALLOW`. |
| }, |
| "listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed. |
| # resource. |
| # |
| # `ListPolicy` can define specific values and subtrees of Cloud Resource |
| # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that |
| # are allowed or denied by setting the `allowed_values` and `denied_values` |
| # fields. This is achieved by using the `under:` and optional `is:` prefixes. |
| # The `under:` prefix is used to denote resource subtree values. |
| # The `is:` prefix is used to denote specific values, and is required only |
| # if the value contains a ":". Values prefixed with "is:" are treated the |
| # same as values with no prefix. |
| # Ancestry subtrees must be in one of the following formats: |
| # - "projects/<project-id>", e.g. "projects/tokyo-rain-123" |
| # - "folders/<folder-id>", e.g. "folders/1234" |
| # - "organizations/<organization-id>", e.g. "organizations/1234" |
| # The `supports_under` field of the associated `Constraint` defines whether |
| # ancestry prefixes can be used. You can set `allowed_values` and |
| # `denied_values` in the same `Policy` if `all_values` is |
| # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all |
| # values. If `all_values` is set to either `ALLOW` or `DENY`, |
| # `allowed_values` and `denied_values` must be unset. |
| "allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values` |
| # is set to `ALL_VALUES_UNSPECIFIED`. |
| "A String", |
| ], |
| "inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`. |
| # |
| # By default, a `ListPolicy` set at a resource supersedes any `Policy` set |
| # anywhere up the resource hierarchy. However, if `inherit_from_parent` is |
| # set to `true`, then the values from the effective `Policy` of the parent |
| # resource are inherited, meaning the values set in this `Policy` are |
| # added to the values inherited up the hierarchy. |
| # |
| # Setting `Policy` hierarchies that inherit both allowed values and denied |
| # values isn't recommended in most circumstances to keep the configuration |
| # simple and understandable. However, it is possible to set a `Policy` with |
| # `allowed_values` set that inherits a `Policy` with `denied_values` set. |
| # In this case, the values that are allowed must be in `allowed_values` and |
| # not present in `denied_values`. |
| # |
| # For example, suppose you have a `Constraint` |
| # `constraints/serviceuser.services`, which has a `constraint_type` of |
| # `list_constraint`, and with `constraint_default` set to `ALLOW`. |
| # Suppose that at the Organization level, a `Policy` is applied that |
| # restricts the allowed API activations to {`E1`, `E2`}. Then, if a |
| # `Policy` is applied to a project below the Organization that has |
| # `inherit_from_parent` set to `false` and field all_values set to DENY, |
| # then an attempt to activate any API will be denied. |
| # |
| # The following examples demonstrate different possible layerings for |
| # `projects/bar` parented by `organizations/foo`: |
| # |
| # Example 1 (no inherited values): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values:"E2"} |
| # `projects/bar` has `inherit_from_parent` `false` and values: |
| # {allowed_values: "E3" allowed_values: "E4"} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The accepted values at `projects/bar` are `E3`, and `E4`. |
| # |
| # Example 2 (inherited values): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values:"E2"} |
| # `projects/bar` has a `Policy` with values: |
| # {value: "E3" value: "E4" inherit_from_parent: true} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`. |
| # |
| # Example 3 (inheriting both allowed and denied values): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values: "E2"} |
| # `projects/bar` has a `Policy` with: |
| # {denied_values: "E1"} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The value accepted at `projects/bar` is `E2`. |
| # |
| # Example 4 (RestoreDefault): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values:"E2"} |
| # `projects/bar` has a `Policy` with values: |
| # {RestoreDefault: {}} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The accepted values at `projects/bar` are either all or none depending on |
| # the value of `constraint_default` (if `ALLOW`, all; if |
| # `DENY`, none). |
| # |
| # Example 5 (no policy inherits parent policy): |
| # `organizations/foo` has no `Policy` set. |
| # `projects/bar` has no `Policy` set. |
| # The accepted values at both levels are either all or none depending on |
| # the value of `constraint_default` (if `ALLOW`, all; if |
| # `DENY`, none). |
| # |
| # Example 6 (ListConstraint allowing all): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values: "E2"} |
| # `projects/bar` has a `Policy` with: |
| # {all: ALLOW} |
| # The accepted values at `organizations/foo` are `E1`, E2`. |
| # Any value is accepted at `projects/bar`. |
| # |
| # Example 7 (ListConstraint allowing none): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values: "E2"} |
| # `projects/bar` has a `Policy` with: |
| # {all: DENY} |
| # The accepted values at `organizations/foo` are `E1`, E2`. |
| # No value is accepted at `projects/bar`. |
| # |
| # Example 10 (allowed and denied subtrees of Resource Manager hierarchy): |
| # Given the following resource hierarchy |
| # O1->{F1, F2}; F1->{P1}; F2->{P2, P3}, |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "under:organizations/O1"} |
| # `projects/bar` has a `Policy` with: |
| # {allowed_values: "under:projects/P3"} |
| # {denied_values: "under:folders/F2"} |
| # The accepted values at `organizations/foo` are `organizations/O1`, |
| # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`, |
| # `projects/P3`. |
| # The accepted values at `projects/bar` are `organizations/O1`, |
| # `folders/F1`, `projects/P1`. |
| "suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration |
| # that matches the value specified in this `Policy`. If `suggested_value` |
| # is not set, it will inherit the value specified higher in the hierarchy, |
| # unless `inherit_from_parent` is `false`. |
| "deniedValues": [ # List of values denied at this resource. Can only be set if `all_values` |
| # is set to `ALL_VALUES_UNSPECIFIED`. |
| "A String", |
| ], |
| "allValues": "A String", # The policy all_values state. |
| }, |
| }, |
| ], |
| "name": "A String", # The full name of the asset. Example: |
| # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1` |
| # |
| # See [Resource |
| # names](https://cloud.google.com/apis/design/resource_names#full_resource_name) |
| # for more information. |
| "updateTime": "A String", # The last update timestamp of an asset. update_time is updated when |
| # create/update/delete operation is performed. |
| "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely # Please also refer to the [service perimeter user |
| # guide](https://cloud.google.com/vpc-service-controls/docs/overview). |
| # import and export data amongst themselves, but not export outside of the |
| # `ServicePerimeter`. If a request with a source within this `ServicePerimeter` |
| # has a target outside of the `ServicePerimeter`, the request will be blocked. |
| # Otherwise the request is allowed. There are two types of Service Perimeter - |
| # Regular and Bridge. Regular Service Perimeters cannot overlap, a single |
| # Google Cloud project can only belong to a single regular Service Perimeter. |
| # Service Perimeter Bridges can contain only Google Cloud projects as members, |
| # a single Google Cloud project may belong to multiple Service Perimeter |
| # Bridges. |
| "title": "A String", # Human readable title. Must be unique within the Policy. |
| "perimeterType": "A String", # Perimeter type indicator. A single project is |
| # allowed to be a member of single regular perimeter, but multiple service |
| # perimeter bridges. A project cannot be a included in a perimeter bridge |
| # without being included in regular perimeter. For perimeter bridges, |
| # the restricted service list as well as access level lists must be |
| # empty. |
| "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources, |
| # restricted services and access levels that determine perimeter |
| # content and boundaries. |
| # describe specific Service Perimeter configuration. |
| "resources": [ # A list of Google Cloud resources that are inside of the service perimeter. |
| # Currently only projects are allowed. Format: `projects/{project_number}` |
| "A String", |
| ], |
| "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter |
| # restrictions. For example, if `storage.googleapis.com` is specified, access |
| # to the storage buckets inside the perimeter must meet the perimeter's |
| # access restrictions. |
| "A String", |
| ], |
| "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the |
| # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed |
| # must be in the same policy as this `ServicePerimeter`. Referencing a |
| # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are |
| # listed, resources within the perimeter can only be accessed via Google |
| # Cloud calls with request origins within the perimeter. Example: |
| # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. |
| # For Service Perimeter Bridge, must be empty. |
| "A String", |
| ], |
| "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter. |
| # Perimeter. |
| "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty |
| # unless 'enable_restriction' is True. |
| "A String", |
| ], |
| "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of |
| # APIs specified in 'allowed_services'. |
| }, |
| }, |
| "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` |
| # component must begin with a letter and only include alphanumeric and '_'. |
| # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}` |
| "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly |
| # exists for all Service Perimeters, and that spec is identical to the |
| # status for those Service Perimeters. When this flag is set, it inhibits the |
| # generation of the implicit spec, thereby allowing the user to explicitly |
| # provide a configuration ("spec") to use in a dry-run version of the Service |
| # Perimeter. This allows the user to test changes to the enforced config |
| # ("status") without actually enforcing them. This testing is done through |
| # analyzing the differences between currently enforced and suggested |
| # restrictions. use_explicit_dry_run_spec must bet set to True if any of the |
| # fields in the spec are set to non-default values. |
| "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration |
| # allows to specify and test ServicePerimeter configuration without enforcing |
| # actual access restrictions. Only allowed to be set when the |
| # "use_explicit_dry_run_spec" flag is set. |
| # describe specific Service Perimeter configuration. |
| "resources": [ # A list of Google Cloud resources that are inside of the service perimeter. |
| # Currently only projects are allowed. Format: `projects/{project_number}` |
| "A String", |
| ], |
| "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter |
| # restrictions. For example, if `storage.googleapis.com` is specified, access |
| # to the storage buckets inside the perimeter must meet the perimeter's |
| # access restrictions. |
| "A String", |
| ], |
| "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the |
| # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed |
| # must be in the same policy as this `ServicePerimeter`. Referencing a |
| # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are |
| # listed, resources within the perimeter can only be accessed via Google |
| # Cloud calls with request origins within the perimeter. Example: |
| # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. |
| # For Service Perimeter Bridge, must be empty. |
| "A String", |
| ], |
| "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter. |
| # Perimeter. |
| "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty |
| # unless 'enable_restriction' is True. |
| "A String", |
| ], |
| "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of |
| # APIs specified in 'allowed_services'. |
| }, |
| }, |
| "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect |
| # behavior. |
| }, |
| }, |
| "asset": { # An asset in Google Cloud. An asset can be any resource in the Google Cloud # An asset in Google Cloud. |
| # [resource |
| # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), |
| # a resource outside the Google Cloud resource hierarchy (such as Google |
| # Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy). |
| # See [Supported asset |
| # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) |
| # for more information. |
| "iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access # A representation of the Cloud IAM policy set on a Google Cloud resource. |
| # There can be a maximum of one Cloud IAM policy set on any given resource. |
| # In addition, Cloud IAM policies inherit their granted access scope from any |
| # policies set on parent resources in the resource hierarchy. Therefore, the |
| # effectively policy is the union of both the policy set on this resource |
| # and each policy set on all of the resource's ancestry resource levels in |
| # the hierarchy. See |
| # [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for |
| # more information. |
| # controls for Google Cloud resources. |
| # |
| # |
| # A `Policy` is a collection of `bindings`. A `binding` binds one or more |
| # `members` to a single `role`. Members can be user accounts, service accounts, |
| # Google groups, and domains (such as G Suite). A `role` is a named list of |
| # permissions; each `role` can be an IAM predefined role or a user-created |
| # custom role. |
| # |
| # For some types of Google Cloud resources, a `binding` can also specify a |
| # `condition`, which is a logical expression that allows access to a resource |
| # only if the expression evaluates to `true`. A condition can add constraints |
| # based on attributes of the request, the resource, or both. To learn which |
| # resources support conditions in their IAM policies, see the |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| # |
| # **JSON example:** |
| # |
| # { |
| # "bindings": [ |
| # { |
| # "role": "roles/resourcemanager.organizationAdmin", |
| # "members": [ |
| # "user:mike@example.com", |
| # "group:admins@example.com", |
| # "domain:google.com", |
| # "serviceAccount:my-project-id@appspot.gserviceaccount.com" |
| # ] |
| # }, |
| # { |
| # "role": "roles/resourcemanager.organizationViewer", |
| # "members": [ |
| # "user:eve@example.com" |
| # ], |
| # "condition": { |
| # "title": "expirable access", |
| # "description": "Does not grant access after Sep 2020", |
| # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", |
| # } |
| # } |
| # ], |
| # "etag": "BwWWja0YfJA=", |
| # "version": 3 |
| # } |
| # |
| # **YAML example:** |
| # |
| # bindings: |
| # - members: |
| # - user:mike@example.com |
| # - group:admins@example.com |
| # - domain:google.com |
| # - serviceAccount:my-project-id@appspot.gserviceaccount.com |
| # role: roles/resourcemanager.organizationAdmin |
| # - members: |
| # - user:eve@example.com |
| # role: roles/resourcemanager.organizationViewer |
| # condition: |
| # title: expirable access |
| # description: Does not grant access after Sep 2020 |
| # expression: request.time < timestamp('2020-10-01T00:00:00.000Z') |
| # - etag: BwWWja0YfJA= |
| # - version: 3 |
| # |
| # For a description of IAM and its features, see the |
| # [IAM documentation](https://cloud.google.com/iam/docs/). |
| "version": 42, # Specifies the format of the policy. |
| # |
| # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value |
| # are rejected. |
| # |
| # Any operation that affects conditional role bindings must specify version |
| # `3`. This requirement applies to the following operations: |
| # |
| # * Getting a policy that includes a conditional role binding |
| # * Adding a conditional role binding to a policy |
| # * Changing a conditional role binding in a policy |
| # * Removing any role binding, with or without a condition, from a policy |
| # that includes conditions |
| # |
| # **Important:** If you use IAM Conditions, you must include the `etag` field |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows |
| # you to overwrite a version `3` policy with a version `1` policy, and all of |
| # the conditions in the version `3` policy are lost. |
| # |
| # If a policy does not include any conditions, operations on that policy may |
| # specify any valid version or leave the field unset. |
| # |
| # To learn which resources support conditions in their IAM policies, see the |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| "auditConfigs": [ # Specifies cloud audit logging configuration for this policy. |
| { # Specifies the audit configuration for a service. |
| # The configuration determines which permission types are logged, and what |
| # identities, if any, are exempted from logging. |
| # An AuditConfig must have one or more AuditLogConfigs. |
| # |
| # If there are AuditConfigs for both `allServices` and a specific service, |
| # the union of the two AuditConfigs is used for that service: the log_types |
| # specified in each AuditConfig are enabled, and the exempted_members in each |
| # AuditLogConfig are exempted. |
| # |
| # Example Policy with multiple AuditConfigs: |
| # |
| # { |
| # "audit_configs": [ |
| # { |
| # "service": "allServices", |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ", |
| # "exempted_members": [ |
| # "user:jose@example.com" |
| # ] |
| # }, |
| # { |
| # "log_type": "DATA_WRITE" |
| # }, |
| # { |
| # "log_type": "ADMIN_READ" |
| # } |
| # ] |
| # }, |
| # { |
| # "service": "sampleservice.googleapis.com", |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ" |
| # }, |
| # { |
| # "log_type": "DATA_WRITE", |
| # "exempted_members": [ |
| # "user:aliya@example.com" |
| # ] |
| # } |
| # ] |
| # } |
| # ] |
| # } |
| # |
| # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ |
| # logging. It also exempts jose@example.com from DATA_READ logging, and |
| # aliya@example.com from DATA_WRITE logging. |
| "service": "A String", # Specifies a service that will be enabled for audit logging. |
| # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. |
| # `allServices` is a special value that covers all services. |
| "auditLogConfigs": [ # The configuration for logging of each type of permission. |
| { # Provides the configuration for logging a type of permissions. |
| # Example: |
| # |
| # { |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ", |
| # "exempted_members": [ |
| # "user:jose@example.com" |
| # ] |
| # }, |
| # { |
| # "log_type": "DATA_WRITE" |
| # } |
| # ] |
| # } |
| # |
| # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting |
| # jose@example.com from DATA_READ logging. |
| "logType": "A String", # The log type that this config enables. |
| "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of |
| # permission. |
| # Follows the same format of Binding.members. |
| "A String", |
| ], |
| }, |
| ], |
| }, |
| ], |
| "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a |
| # `condition` that determines how and when the `bindings` are applied. Each |
| # of the `bindings` must contain at least one member. |
| { # Associates `members` with a `role`. |
| "role": "A String", # Role that is assigned to `members`. |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. |
| "members": [ # Specifies the identities requesting access for a Cloud Platform resource. |
| # `members` can have the following values: |
| # |
| # * `allUsers`: A special identifier that represents anyone who is |
| # on the internet; with or without a Google account. |
| # |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone |
| # who is authenticated with a Google account or a service account. |
| # |
| # * `user:{emailid}`: An email address that represents a specific Google |
| # account. For example, `alice@example.com` . |
| # |
| # |
| # * `serviceAccount:{emailid}`: An email address that represents a service |
| # account. For example, `my-other-app@appspot.gserviceaccount.com`. |
| # |
| # * `group:{emailid}`: An email address that represents a Google group. |
| # For example, `admins@example.com`. |
| # |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique |
| # identifier) representing a user that has been recently deleted. For |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is |
| # recovered, this value reverts to `user:{emailid}` and the recovered user |
| # retains the role in the binding. |
| # |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus |
| # unique identifier) representing a service account that has been recently |
| # deleted. For example, |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. |
| # If the service account is undeleted, this value reverts to |
| # `serviceAccount:{emailid}` and the undeleted service account retains the |
| # role in the binding. |
| # |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique |
| # identifier) representing a Google group that has been recently |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If |
| # the group is recovered, this value reverts to `group:{emailid}` and the |
| # recovered group retains the role in the binding. |
| # |
| # |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the |
| # users of that domain. For example, `google.com` or `example.com`. |
| # |
| "A String", |
| ], |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. |
| # |
| # If the condition evaluates to `true`, then this binding applies to the |
| # current request. |
| # |
| # If the condition evaluates to `false`, then this binding does not apply to |
| # the current request. However, a different role binding might grant the same |
| # role to one or more of the members in this binding. |
| # |
| # To learn which resources support conditions in their IAM policies, see the |
| # [IAM |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL |
| # are documented at https://github.com/google/cel-spec. |
| # |
| # Example (Comparison): |
| # |
| # title: "Summary size limit" |
| # description: "Determines if a summary is less than 100 chars" |
| # expression: "document.summary.size() < 100" |
| # |
| # Example (Equality): |
| # |
| # title: "Requestor is owner" |
| # description: "Determines if requestor is the document owner" |
| # expression: "document.owner == request.auth.claims.email" |
| # |
| # Example (Logic): |
| # |
| # title: "Public documents" |
| # description: "Determine whether the document should be publicly visible" |
| # expression: "document.type != 'private' && document.type != 'internal'" |
| # |
| # Example (Data Manipulation): |
| # |
| # title: "Notification string" |
| # description: "Create a notification string with a timestamp." |
| # expression: "'New message received at ' + string(document.create_time)" |
| # |
| # The exact variables and functions that may be referenced within an expression |
| # are determined by the service that evaluates it. See the service |
| # documentation for additional information. |
| "description": "A String", # Optional. Description of the expression. This is a longer text which |
| # describes the expression, e.g. when hovered over it in a UI. |
| "location": "A String", # Optional. String indicating the location of the expression for error |
| # reporting, e.g. a file name and a position in the file. |
| "expression": "A String", # Textual representation of an expression in Common Expression Language |
| # syntax. |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing |
| # its purpose. This can be used e.g. in UIs which allow to enter the |
| # expression. |
| }, |
| }, |
| ], |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help |
| # prevent simultaneous updates of a policy from overwriting each other. |
| # It is strongly suggested that systems make use of the `etag` in the |
| # read-modify-write cycle to perform policy updates in order to avoid race |
| # conditions: An `etag` is returned in the response to `getIamPolicy`, and |
| # systems are expected to put that etag in the request to `setIamPolicy` to |
| # ensure that their change will be applied to the same version of the policy. |
| # |
| # **Important:** If you use IAM Conditions, you must include the `etag` field |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows |
| # you to overwrite a version `3` policy with a version `1` policy, and all of |
| # the conditions in the version `3` policy are lost. |
| }, |
| "assetType": "A String", # The type of the asset. Example: `compute.googleapis.com/Disk` |
| # |
| # See [Supported asset |
| # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) |
| # for more information. |
| "ancestors": [ # The ancestry path of an asset in Google Cloud [resource |
| # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), |
| # represented as a list of relative resource names. An ancestry path starts |
| # with the closest ancestor in the hierarchy and ends at root. If the asset |
| # is a project, folder, or organization, the ancestry path starts from the |
| # asset itself. |
| # |
| # Example: `["projects/123456789", "folders/5432", "organizations/1234"]` |
| "A String", |
| ], |
| "resource": { # A representation of a Google Cloud resource. # A representation of the resource. |
| "resourceUrl": "A String", # The REST URL for accessing the resource. An HTTP `GET` request using this |
| # URL returns the resource itself. Example: |
| # `https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123` |
| # |
| # This value is unspecified for resources without a REST API. |
| "discoveryName": "A String", # The JSON schema name listed in the discovery document. Example: |
| # `Project` |
| # |
| # This value is unspecified for resources that do not have an API based on a |
| # discovery document, such as Cloud Bigtable. |
| "discoveryDocumentUri": "A String", # The URL of the discovery document containing the resource's JSON schema. |
| # Example: |
| # `https://www.googleapis.com/discovery/v1/apis/compute/v1/rest` |
| # |
| # This value is unspecified for resources that do not have an API based on a |
| # discovery document, such as Cloud Bigtable. |
| "data": { # The content of the resource, in which some sensitive fields are removed |
| # and may not be present. |
| "a_key": "", # Properties of the object. |
| }, |
| "version": "A String", # The API version. Example: `v1` |
| "parent": "A String", # The full name of the immediate parent of this resource. See |
| # [Resource |
| # Names](https://cloud.google.com/apis/design/resource_names#full_resource_name) |
| # for more information. |
| # |
| # For Google Cloud assets, this value is the parent resource defined in the |
| # [Cloud IAM policy |
| # hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy). |
| # Example: |
| # `//cloudresourcemanager.googleapis.com/projects/my_project_123` |
| # |
| # For third-party assets, this field may be set differently. |
| "location": "A String", # The location of the resource in Google Cloud, such as its zone and region. |
| # For more information, see https://cloud.google.com/about/locations/. |
| }, |
| "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary # Please also refer to the [access policy user |
| # guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). |
| # attributes to use Google Cloud services) and `ServicePerimeters` (which |
| # define regions of services able to freely pass data within a perimeter). An |
| # access policy is globally visible within an organization, and the |
| # restrictions it specifies apply to all projects within an organization. |
| "parent": "A String", # Required. The parent of this `AccessPolicy` in the Cloud Resource |
| # Hierarchy. Currently immutable once created. Format: |
| # `organizations/{organization_id}` |
| "title": "A String", # Required. Human readable title. Does not affect behavior. |
| "name": "A String", # Output only. Resource name of the `AccessPolicy`. Format: |
| # `accessPolicies/{policy_id}` |
| "etag": "A String", # Output only. An opaque identifier for the current version of the |
| # `AccessPolicy`. This will always be a strongly validated etag, meaning that |
| # two Access Polices will be identical if and only if their etags are |
| # identical. Clients should not expect this to be in any specific format. |
| }, |
| "accessLevel": { # An `AccessLevel` is a label that can be applied to requests to Google Cloud # Please also refer to the [access level user |
| # guide](https://cloud.google.com/access-context-manager/docs/overview#access-levels). |
| # services, along with a list of requirements necessary for the label to be |
| # applied. |
| "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. |
| "basic": { # `BasicLevel` is an `AccessLevel` using a set of recommended features. # A `BasicLevel` composed of `Conditions`. |
| "combiningFunction": "A String", # How the `conditions` list should be combined to determine if a request is |
| # granted this `AccessLevel`. If AND is used, each `Condition` in |
| # `conditions` must be satisfied for the `AccessLevel` to be applied. If OR |
| # is used, at least one `Condition` in `conditions` must be satisfied for the |
| # `AccessLevel` to be applied. Default behavior is AND. |
| "conditions": [ # Required. A list of requirements for the `AccessLevel` to be granted. |
| { # A condition necessary for an `AccessLevel` to be granted. The Condition is an |
| # AND over its fields. So a Condition is true if: 1) the request IP is from one |
| # of the listed subnetworks AND 2) the originating device complies with the |
| # listed device policy AND 3) all listed access levels are granted AND 4) the |
| # request was sent at a time allowed by the DateTimeRestriction. |
| "requiredAccessLevels": [ # A list of other access levels defined in the same `Policy`, referenced by |
| # resource name. Referencing an `AccessLevel` which does not exist is an |
| # error. All access levels listed must be granted for the Condition |
| # to be true. Example: |
| # "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"` |
| "A String", |
| ], |
| "devicePolicy": { # `DevicePolicy` specifies device specific restrictions necessary to acquire a # Device specific restrictions, all restrictions must hold for the |
| # Condition to be true. If not specified, all devices are allowed. |
| # given access level. A `DevicePolicy` specifies requirements for requests from |
| # devices to be granted access levels, it does not do any enforcement on the |
| # device. `DevicePolicy` acts as an AND over all specified fields, and each |
| # repeated field is an OR over its elements. Any unset fields are ignored. For |
| # example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : |
| # DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be |
| # true for requests originating from encrypted Linux desktops and encrypted |
| # Windows desktops. |
| "requireScreenlock": True or False, # Whether or not screenlock is required for the DevicePolicy to be true. |
| # Defaults to `false`. |
| "osConstraints": [ # Allowed OS versions, an empty list allows all types and all versions. |
| { # A restriction on the OS type and version of devices making requests. |
| "osType": "A String", # Required. The allowed OS type. |
| "minimumVersion": "A String", # The minimum allowed OS version. If not set, any version of this OS |
| # satisfies the constraint. Format: `"major.minor.patch"`. |
| # Examples: `"10.5.301"`, `"9.2.1"`. |
| "requireVerifiedChromeOs": True or False, # Only allows requests from devices with a verified Chrome OS. |
| # Verifications includes requirements that the device is enterprise-managed, |
| # conformant to domain policies, and the caller has permission to call |
| # the API targeted by the request. |
| }, |
| ], |
| "requireAdminApproval": True or False, # Whether the device needs to be approved by the customer admin. |
| "allowedDeviceManagementLevels": [ # Allowed device management levels, an empty list allows all management |
| # levels. |
| "A String", |
| ], |
| "requireCorpOwned": True or False, # Whether the device needs to be corp owned. |
| "allowedEncryptionStatuses": [ # Allowed encryptions statuses, an empty list allows all statuses. |
| "A String", |
| ], |
| }, |
| "members": [ # The request must be made by one of the provided user or service |
| # accounts. Groups are not supported. |
| # Syntax: |
| # `user:{emailid}` |
| # `serviceAccount:{emailid}` |
| # If not specified, a request may come from any user. |
| "A String", |
| ], |
| "regions": [ # The request must originate from one of the provided countries/regions. |
| # Must be valid ISO 3166-1 alpha-2 codes. |
| "A String", |
| ], |
| "ipSubnetworks": [ # CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for |
| # a CIDR IP address block, the specified IP address portion must be properly |
| # truncated (i.e. all the host bits must be zero) or the input is considered |
| # malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is |
| # not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas |
| # "2001:db8::1/32" is not. The originating IP of a request must be in one of |
| # the listed subnets in order for this Condition to be true. If empty, all IP |
| # addresses are allowed. |
| "A String", |
| ], |
| "negate": True or False, # Whether to negate the Condition. If true, the Condition becomes a NAND over |
| # its non-empty fields, each field must be false for the Condition overall to |
| # be satisfied. Defaults to false. |
| }, |
| ], |
| }, |
| "name": "A String", # Required. Resource name for the Access Level. The `short_name` component |
| # must begin with a letter and only include alphanumeric and '_'. Format: |
| # `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length |
| # of the `short_name` component is 50 characters. |
| "custom": { # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language # A `CustomLevel` written in the Common Expression Language. |
| # to represent the necessary conditions for the level to apply to a request. |
| # See CEL spec at: https://github.com/google/cel-spec |
| "expr": { # Represents a textual expression in the Common Expression Language (CEL) # Required. A Cloud CEL expression evaluating to a boolean. |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL |
| # are documented at https://github.com/google/cel-spec. |
| # |
| # Example (Comparison): |
| # |
| # title: "Summary size limit" |
| # description: "Determines if a summary is less than 100 chars" |
| # expression: "document.summary.size() < 100" |
| # |
| # Example (Equality): |
| # |
| # title: "Requestor is owner" |
| # description: "Determines if requestor is the document owner" |
| # expression: "document.owner == request.auth.claims.email" |
| # |
| # Example (Logic): |
| # |
| # title: "Public documents" |
| # description: "Determine whether the document should be publicly visible" |
| # expression: "document.type != 'private' && document.type != 'internal'" |
| # |
| # Example (Data Manipulation): |
| # |
| # title: "Notification string" |
| # description: "Create a notification string with a timestamp." |
| # expression: "'New message received at ' + string(document.create_time)" |
| # |
| # The exact variables and functions that may be referenced within an expression |
| # are determined by the service that evaluates it. See the service |
| # documentation for additional information. |
| "description": "A String", # Optional. Description of the expression. This is a longer text which |
| # describes the expression, e.g. when hovered over it in a UI. |
| "location": "A String", # Optional. String indicating the location of the expression for error |
| # reporting, e.g. a file name and a position in the file. |
| "expression": "A String", # Textual representation of an expression in Common Expression Language |
| # syntax. |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing |
| # its purpose. This can be used e.g. in UIs which allow to enter the |
| # expression. |
| }, |
| }, |
| "title": "A String", # Human readable title. Must be unique within the Policy. |
| }, |
| "orgPolicy": [ # A representation of an [organization |
| # policy](https://cloud.google.com/resource-manager/docs/organization-policy/overview#organization_policy). |
| # There can be more than one organization policy with different constraints |
| # set on a given resource. |
| { # Defines a Cloud Organization `Policy` which is used to specify `Constraints` |
| # for configurations of Cloud Platform resources. |
| "etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for |
| # concurrency control. |
| # |
| # When the `Policy` is returned from either a `GetPolicy` or a |
| # `ListOrgPolicy` request, this `etag` indicates the version of the current |
| # `Policy` to use when executing a read-modify-write loop. |
| # |
| # When the `Policy` is returned from a `GetEffectivePolicy` request, the |
| # `etag` will be unset. |
| # |
| # When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value |
| # that was returned from a `GetOrgPolicy` request as part of a |
| # read-modify-write loop for concurrency control. Not setting the `etag`in a |
| # `SetOrgPolicy` request will result in an unconditional write of the |
| # `Policy`. |
| "version": 42, # Version of the `Policy`. Default version is 0; |
| "restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of |
| # `Constraint` type. |
| # `constraint_default` enforcement behavior of the specific `Constraint` at |
| # this resource. |
| # |
| # Suppose that `constraint_default` is set to `ALLOW` for the |
| # `Constraint` `constraints/serviceuser.services`. Suppose that organization |
| # foo.com sets a `Policy` at their Organization resource node that restricts |
| # the allowed service activations to deny all service activations. They |
| # could then set a `Policy` with the `policy_type` `restore_default` on |
| # several experimental projects, restoring the `constraint_default` |
| # enforcement of the `Constraint` for only those projects, allowing those |
| # projects to have all services activated. |
| }, |
| "updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the |
| # server, not specified by the caller, and represents the last time a call to |
| # `SetOrgPolicy` was made for that `Policy`. Any value set by the client will |
| # be ignored. |
| "constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example, |
| # `constraints/serviceuser.services`. |
| # |
| # A [list of available |
| # constraints](/resource-manager/docs/organization-policy/org-policy-constraints) |
| # is available. |
| # |
| # Immutable after creation. |
| "booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not. |
| # resource. |
| "enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any |
| # configuration is acceptable. |
| # |
| # Suppose you have a `Constraint` |
| # `constraints/compute.disableSerialPortAccess` with `constraint_default` |
| # set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following |
| # behavior: |
| # - If the `Policy` at this resource has enforced set to `false`, serial |
| # port connection attempts will be allowed. |
| # - If the `Policy` at this resource has enforced set to `true`, serial |
| # port connection attempts will be refused. |
| # - If the `Policy` at this resource is `RestoreDefault`, serial port |
| # connection attempts will be allowed. |
| # - If no `Policy` is set at this resource or anywhere higher in the |
| # resource hierarchy, serial port connection attempts will be allowed. |
| # - If no `Policy` is set at this resource, but one exists higher in the |
| # resource hierarchy, the behavior is as if the`Policy` were set at |
| # this resource. |
| # |
| # The following examples demonstrate the different possible layerings: |
| # |
| # Example 1 (nearest `Constraint` wins): |
| # `organizations/foo` has a `Policy` with: |
| # {enforced: false} |
| # `projects/bar` has no `Policy` set. |
| # The constraint at `projects/bar` and `organizations/foo` will not be |
| # enforced. |
| # |
| # Example 2 (enforcement gets replaced): |
| # `organizations/foo` has a `Policy` with: |
| # {enforced: false} |
| # `projects/bar` has a `Policy` with: |
| # {enforced: true} |
| # The constraint at `organizations/foo` is not enforced. |
| # The constraint at `projects/bar` is enforced. |
| # |
| # Example 3 (RestoreDefault): |
| # `organizations/foo` has a `Policy` with: |
| # {enforced: true} |
| # `projects/bar` has a `Policy` with: |
| # {RestoreDefault: {}} |
| # The constraint at `organizations/foo` is enforced. |
| # The constraint at `projects/bar` is not enforced, because |
| # `constraint_default` for the `Constraint` is `ALLOW`. |
| }, |
| "listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed. |
| # resource. |
| # |
| # `ListPolicy` can define specific values and subtrees of Cloud Resource |
| # Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that |
| # are allowed or denied by setting the `allowed_values` and `denied_values` |
| # fields. This is achieved by using the `under:` and optional `is:` prefixes. |
| # The `under:` prefix is used to denote resource subtree values. |
| # The `is:` prefix is used to denote specific values, and is required only |
| # if the value contains a ":". Values prefixed with "is:" are treated the |
| # same as values with no prefix. |
| # Ancestry subtrees must be in one of the following formats: |
| # - "projects/<project-id>", e.g. "projects/tokyo-rain-123" |
| # - "folders/<folder-id>", e.g. "folders/1234" |
| # - "organizations/<organization-id>", e.g. "organizations/1234" |
| # The `supports_under` field of the associated `Constraint` defines whether |
| # ancestry prefixes can be used. You can set `allowed_values` and |
| # `denied_values` in the same `Policy` if `all_values` is |
| # `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all |
| # values. If `all_values` is set to either `ALLOW` or `DENY`, |
| # `allowed_values` and `denied_values` must be unset. |
| "allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values` |
| # is set to `ALL_VALUES_UNSPECIFIED`. |
| "A String", |
| ], |
| "inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`. |
| # |
| # By default, a `ListPolicy` set at a resource supersedes any `Policy` set |
| # anywhere up the resource hierarchy. However, if `inherit_from_parent` is |
| # set to `true`, then the values from the effective `Policy` of the parent |
| # resource are inherited, meaning the values set in this `Policy` are |
| # added to the values inherited up the hierarchy. |
| # |
| # Setting `Policy` hierarchies that inherit both allowed values and denied |
| # values isn't recommended in most circumstances to keep the configuration |
| # simple and understandable. However, it is possible to set a `Policy` with |
| # `allowed_values` set that inherits a `Policy` with `denied_values` set. |
| # In this case, the values that are allowed must be in `allowed_values` and |
| # not present in `denied_values`. |
| # |
| # For example, suppose you have a `Constraint` |
| # `constraints/serviceuser.services`, which has a `constraint_type` of |
| # `list_constraint`, and with `constraint_default` set to `ALLOW`. |
| # Suppose that at the Organization level, a `Policy` is applied that |
| # restricts the allowed API activations to {`E1`, `E2`}. Then, if a |
| # `Policy` is applied to a project below the Organization that has |
| # `inherit_from_parent` set to `false` and field all_values set to DENY, |
| # then an attempt to activate any API will be denied. |
| # |
| # The following examples demonstrate different possible layerings for |
| # `projects/bar` parented by `organizations/foo`: |
| # |
| # Example 1 (no inherited values): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values:"E2"} |
| # `projects/bar` has `inherit_from_parent` `false` and values: |
| # {allowed_values: "E3" allowed_values: "E4"} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The accepted values at `projects/bar` are `E3`, and `E4`. |
| # |
| # Example 2 (inherited values): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values:"E2"} |
| # `projects/bar` has a `Policy` with values: |
| # {value: "E3" value: "E4" inherit_from_parent: true} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`. |
| # |
| # Example 3 (inheriting both allowed and denied values): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values: "E2"} |
| # `projects/bar` has a `Policy` with: |
| # {denied_values: "E1"} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The value accepted at `projects/bar` is `E2`. |
| # |
| # Example 4 (RestoreDefault): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values:"E2"} |
| # `projects/bar` has a `Policy` with values: |
| # {RestoreDefault: {}} |
| # The accepted values at `organizations/foo` are `E1`, `E2`. |
| # The accepted values at `projects/bar` are either all or none depending on |
| # the value of `constraint_default` (if `ALLOW`, all; if |
| # `DENY`, none). |
| # |
| # Example 5 (no policy inherits parent policy): |
| # `organizations/foo` has no `Policy` set. |
| # `projects/bar` has no `Policy` set. |
| # The accepted values at both levels are either all or none depending on |
| # the value of `constraint_default` (if `ALLOW`, all; if |
| # `DENY`, none). |
| # |
| # Example 6 (ListConstraint allowing all): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values: "E2"} |
| # `projects/bar` has a `Policy` with: |
| # {all: ALLOW} |
| # The accepted values at `organizations/foo` are `E1`, E2`. |
| # Any value is accepted at `projects/bar`. |
| # |
| # Example 7 (ListConstraint allowing none): |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "E1" allowed_values: "E2"} |
| # `projects/bar` has a `Policy` with: |
| # {all: DENY} |
| # The accepted values at `organizations/foo` are `E1`, E2`. |
| # No value is accepted at `projects/bar`. |
| # |
| # Example 10 (allowed and denied subtrees of Resource Manager hierarchy): |
| # Given the following resource hierarchy |
| # O1->{F1, F2}; F1->{P1}; F2->{P2, P3}, |
| # `organizations/foo` has a `Policy` with values: |
| # {allowed_values: "under:organizations/O1"} |
| # `projects/bar` has a `Policy` with: |
| # {allowed_values: "under:projects/P3"} |
| # {denied_values: "under:folders/F2"} |
| # The accepted values at `organizations/foo` are `organizations/O1`, |
| # `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`, |
| # `projects/P3`. |
| # The accepted values at `projects/bar` are `organizations/O1`, |
| # `folders/F1`, `projects/P1`. |
| "suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration |
| # that matches the value specified in this `Policy`. If `suggested_value` |
| # is not set, it will inherit the value specified higher in the hierarchy, |
| # unless `inherit_from_parent` is `false`. |
| "deniedValues": [ # List of values denied at this resource. Can only be set if `all_values` |
| # is set to `ALL_VALUES_UNSPECIFIED`. |
| "A String", |
| ], |
| "allValues": "A String", # The policy all_values state. |
| }, |
| }, |
| ], |
| "name": "A String", # The full name of the asset. Example: |
| # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1` |
| # |
| # See [Resource |
| # names](https://cloud.google.com/apis/design/resource_names#full_resource_name) |
| # for more information. |
| "updateTime": "A String", # The last update timestamp of an asset. update_time is updated when |
| # create/update/delete operation is performed. |
| "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely # Please also refer to the [service perimeter user |
| # guide](https://cloud.google.com/vpc-service-controls/docs/overview). |
| # import and export data amongst themselves, but not export outside of the |
| # `ServicePerimeter`. If a request with a source within this `ServicePerimeter` |
| # has a target outside of the `ServicePerimeter`, the request will be blocked. |
| # Otherwise the request is allowed. There are two types of Service Perimeter - |
| # Regular and Bridge. Regular Service Perimeters cannot overlap, a single |
| # Google Cloud project can only belong to a single regular Service Perimeter. |
| # Service Perimeter Bridges can contain only Google Cloud projects as members, |
| # a single Google Cloud project may belong to multiple Service Perimeter |
| # Bridges. |
| "title": "A String", # Human readable title. Must be unique within the Policy. |
| "perimeterType": "A String", # Perimeter type indicator. A single project is |
| # allowed to be a member of single regular perimeter, but multiple service |
| # perimeter bridges. A project cannot be a included in a perimeter bridge |
| # without being included in regular perimeter. For perimeter bridges, |
| # the restricted service list as well as access level lists must be |
| # empty. |
| "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources, |
| # restricted services and access levels that determine perimeter |
| # content and boundaries. |
| # describe specific Service Perimeter configuration. |
| "resources": [ # A list of Google Cloud resources that are inside of the service perimeter. |
| # Currently only projects are allowed. Format: `projects/{project_number}` |
| "A String", |
| ], |
| "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter |
| # restrictions. For example, if `storage.googleapis.com` is specified, access |
| # to the storage buckets inside the perimeter must meet the perimeter's |
| # access restrictions. |
| "A String", |
| ], |
| "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the |
| # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed |
| # must be in the same policy as this `ServicePerimeter`. Referencing a |
| # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are |
| # listed, resources within the perimeter can only be accessed via Google |
| # Cloud calls with request origins within the perimeter. Example: |
| # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. |
| # For Service Perimeter Bridge, must be empty. |
| "A String", |
| ], |
| "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter. |
| # Perimeter. |
| "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty |
| # unless 'enable_restriction' is True. |
| "A String", |
| ], |
| "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of |
| # APIs specified in 'allowed_services'. |
| }, |
| }, |
| "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` |
| # component must begin with a letter and only include alphanumeric and '_'. |
| # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}` |
| "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly |
| # exists for all Service Perimeters, and that spec is identical to the |
| # status for those Service Perimeters. When this flag is set, it inhibits the |
| # generation of the implicit spec, thereby allowing the user to explicitly |
| # provide a configuration ("spec") to use in a dry-run version of the Service |
| # Perimeter. This allows the user to test changes to the enforced config |
| # ("status") without actually enforcing them. This testing is done through |
| # analyzing the differences between currently enforced and suggested |
| # restrictions. use_explicit_dry_run_spec must bet set to True if any of the |
| # fields in the spec are set to non-default values. |
| "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration |
| # allows to specify and test ServicePerimeter configuration without enforcing |
| # actual access restrictions. Only allowed to be set when the |
| # "use_explicit_dry_run_spec" flag is set. |
| # describe specific Service Perimeter configuration. |
| "resources": [ # A list of Google Cloud resources that are inside of the service perimeter. |
| # Currently only projects are allowed. Format: `projects/{project_number}` |
| "A String", |
| ], |
| "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter |
| # restrictions. For example, if `storage.googleapis.com` is specified, access |
| # to the storage buckets inside the perimeter must meet the perimeter's |
| # access restrictions. |
| "A String", |
| ], |
| "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the |
| # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed |
| # must be in the same policy as this `ServicePerimeter`. Referencing a |
| # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are |
| # listed, resources within the perimeter can only be accessed via Google |
| # Cloud calls with request origins within the perimeter. Example: |
| # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. |
| # For Service Perimeter Bridge, must be empty. |
| "A String", |
| ], |
| "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter. |
| # Perimeter. |
| "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty |
| # unless 'enable_restriction' is True. |
| "A String", |
| ], |
| "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of |
| # APIs specified in 'allowed_services'. |
| }, |
| }, |
| "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect |
| # behavior. |
| }, |
| }, |
| "priorAssetState": "A String", # State of prior_asset. |
| "window": { # A time window specified by its `start_time` and `end_time`. # The time window when the asset data and state was observed. |
| "endTime": "A String", # End time of the time window (inclusive). If not specified, the current |
| # timestamp is used instead. |
| "startTime": "A String", # Start time of the time window (exclusive). |
| }, |
| }, |
| ], |
| }</pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="exportAssets">exportAssets(parent, body=None, x__xgafv=None)</code> |
| <pre>Exports assets with time and resource types to a given Cloud Storage |
| location/BigQuery table. For Cloud Storage location destinations, the |
| output format is newline-delimited JSON. Each line represents a |
| google.cloud.asset.v1.Asset in the JSON format; for BigQuery table |
| destinations, the output table stores the fields in asset proto as columns. |
| This API implements the google.longrunning.Operation API |
| , which allows you to keep track of the export. We recommend intervals of |
| at least 2 seconds with exponential retry to poll the export operation |
| result. For regular-size resource parent, the export operation usually |
| finishes within 5 minutes. |
| |
| Args: |
| parent: string, Required. The relative name of the root asset. This can only be an |
| organization number (such as "organizations/123"), a project ID (such as |
| "projects/my-project-id"), or a project number (such as "projects/12345"), |
| or a folder number (such as "folders/123"). (required) |
| body: object, The request body. |
| The object takes the form of: |
| |
| { # Export asset request. |
| "outputConfig": { # Output configuration for export assets destination. # Required. Output configuration indicating where the results will be output to. |
| "bigqueryDestination": { # A BigQuery destination for exporting assets to. # Destination on BigQuery. The output table stores the fields in asset |
| # proto as columns in BigQuery. |
| "dataset": "A String", # Required. The BigQuery dataset in format |
| # "projects/projectId/datasets/datasetId", to which the snapshot result |
| # should be exported. If this dataset does not exist, the export call returns |
| # an INVALID_ARGUMENT error. |
| "table": "A String", # Required. The BigQuery table to which the snapshot result should be |
| # written. If this table does not exist, a new table with the given name |
| # will be created. |
| "force": True or False, # If the destination table already exists and this flag is `TRUE`, the |
| # table will be overwritten by the contents of assets snapshot. If the flag |
| # is `FALSE` or unset and the destination table already exists, the export |
| # call returns an INVALID_ARGUMEMT error. |
| }, |
| "gcsDestination": { # A Cloud Storage location. # Destination on Cloud Storage. |
| "uri": "A String", # The uri of the Cloud Storage object. It's the same uri that is used by |
| # gsutil. Example: "gs://bucket_name/object_name". See [Viewing and |
| # Editing Object |
| # Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata) |
| # for more information. |
| "uriPrefix": "A String", # The uri prefix of all generated Cloud Storage objects. Example: |
| # "gs://bucket_name/object_name_prefix". Each object uri is in format: |
| # "gs://bucket_name/object_name_prefix/<asset type>/<shard number> and only |
| # contains assets for that type. <shard number> starts from 0. Example: |
| # "gs://bucket_name/object_name_prefix/compute.googleapis.com/Disk/0" is |
| # the first shard of output objects containing all |
| # compute.googleapis.com/Disk assets. An INVALID_ARGUMENT error will be |
| # returned if file with the same name "gs://bucket_name/object_name_prefix" |
| # already exists. |
| }, |
| }, |
| "readTime": "A String", # Timestamp to take an asset snapshot. This can only be set to a timestamp |
| # between the current time and the current time minus 35 days (inclusive). |
| # If not specified, the current time will be used. Due to delays in resource |
| # data collection and indexing, there is a volatile window during which |
| # running the same query may get different results. |
| "contentType": "A String", # Asset content type. If not specified, no content but the asset name will be |
| # returned. |
| "assetTypes": [ # A list of asset types to take a snapshot for. For example: |
| # "compute.googleapis.com/Disk". |
| # |
| # Regular expressions are also supported. For example: |
| # |
| # * "compute.googleapis.com.*" snapshots resources whose asset type starts |
| # with "compute.googleapis.com". |
| # * ".*Instance" snapshots resources whose asset type ends with "Instance". |
| # * ".*Instance.*" snapshots resources whose asset type contains "Instance". |
| # |
| # See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported |
| # regular expression syntax. If the regular expression does not match any |
| # supported asset type, an INVALID_ARGUMENT error will be returned. |
| # |
| # If specified, only matching assets will be returned, otherwise, it will |
| # snapshot all asset types. See [Introduction to Cloud Asset |
| # Inventory](https://cloud.google.com/asset-inventory/docs/overview) |
| # for all supported asset types. |
| "A String", |
| ], |
| } |
| |
| x__xgafv: string, V1 error format. |
| Allowed values |
| 1 - v1 error format |
| 2 - v2 error format |
| |
| Returns: |
| An object of the form: |
| |
| { # This resource represents a long-running operation that is the result of a |
| # network API call. |
| "response": { # The normal response of the operation in case of success. If the original |
| # method returns no data on success, such as `Delete`, the response is |
| # `google.protobuf.Empty`. If the original method is standard |
| # `Get`/`Create`/`Update`, the response should be the resource. For other |
| # methods, the response should have the type `XxxResponse`, where `Xxx` |
| # is the original method name. For example, if the original method name |
| # is `TakeSnapshot()`, the inferred response type is |
| # `TakeSnapshotResponse`. |
| "a_key": "", # Properties of the object. Contains field @type with type URL. |
| }, |
| "done": True or False, # If the value is `false`, it means the operation is still in progress. |
| # If `true`, the operation is completed, and either `error` or `response` is |
| # available. |
| "name": "A String", # The server-assigned name, which is only unique within the same service that |
| # originally returns it. If you use the default HTTP mapping, the |
| # `name` should be a resource name ending with `operations/{unique_id}`. |
| "metadata": { # Service-specific metadata associated with the operation. It typically |
| # contains progress information and common metadata such as create time. |
| # Some services might not provide such metadata. Any method that returns a |
| # long-running operation should document the metadata type, if any. |
| "a_key": "", # Properties of the object. Contains field @type with type URL. |
| }, |
| "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation. |
| # different programming environments, including REST APIs and RPC APIs. It is |
| # used by [gRPC](https://github.com/grpc). Each `Status` message contains |
| # three pieces of data: error code, error message, and error details. |
| # |
| # You can find out more about this error model and how to work with it in the |
| # [API Design Guide](https://cloud.google.com/apis/design/errors). |
| "details": [ # A list of messages that carry the error details. There is a common set of |
| # message types for APIs to use. |
| { |
| "a_key": "", # Properties of the object. Contains field @type with type URL. |
| }, |
| ], |
| "message": "A String", # A developer-facing error message, which should be in English. Any |
| # user-facing error message should be localized and sent in the |
| # google.rpc.Status.details field, or localized by the client. |
| "code": 42, # The status code, which should be an enum value of google.rpc.Code. |
| }, |
| }</pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="searchAllIamPolicies">searchAllIamPolicies(scope, query=None, pageToken=None, pageSize=None, x__xgafv=None)</code> |
| <pre>Searches all the IAM policies within the given accessible scope (e.g., a |
| project, a folder or an organization). Callers should have |
| `cloud.assets.SearchAllIamPolicies` permission upon the requested scope, |
| otherwise the request will be rejected. |
| |
| Args: |
| scope: string, Required. A scope can be a project, a folder or an organization. The search is |
| limited to the IAM policies within the `scope`. |
| |
| The allowed values are: |
| |
| * projects/{PROJECT_ID} |
| * projects/{PROJECT_NUMBER} |
| * folders/{FOLDER_NUMBER} |
| * organizations/{ORGANIZATION_NUMBER} (required) |
| query: string, Optional. The query statement. An empty query can be specified to search all the IAM |
| policies within the given `scope`. |
| |
| Examples: |
| |
| * `policy : "amy@gmail.com"` to find Cloud IAM policy bindings that |
| specify user "amy@gmail.com". |
| * `policy : "roles/compute.admin"` to find Cloud IAM policy bindings that |
| specify the Compute Admin role. |
| * `policy.role.permissions : "storage.buckets.update"` to find Cloud IAM |
| policy bindings that specify a role containing "storage.buckets.update" |
| permission. |
| * `resource : "organizations/123"` to find Cloud IAM policy bindings that |
| are set on "organizations/123". |
| * `(resource : ("organizations/123" OR "folders/1234") AND policy : "amy")` |
| to find Cloud IAM policy bindings that are set on "organizations/123" or |
| "folders/1234", and also specify user "amy". |
| |
| See [how to construct a |
| query](https://cloud.google.com/asset-inventory/docs/searching-iam-policies#how_to_construct_a_query) |
| for more details. |
| pageToken: string, Optional. If present, retrieve the next batch of results from the preceding call to |
| this method. `page_token` must be the value of `next_page_token` from the |
| previous response. The values of all other method parameters must be |
| identical to those in the previous call. |
| pageSize: integer, Optional. The page size for search result pagination. Page size is capped at 500 even |
| if a larger value is given. If set to zero, server will pick an appropriate |
| default. Returned results may be fewer than requested. When this happens, |
| there could be more results as long as `next_page_token` is returned. |
| x__xgafv: string, V1 error format. |
| Allowed values |
| 1 - v1 error format |
| 2 - v2 error format |
| |
| Returns: |
| An object of the form: |
| |
| { # Search all IAM policies response. |
| "results": [ # A list of IamPolicy that match the search query. Related information such |
| # as the associated resource is returned along with the policy. |
| { # A result of IAM Policy search, containing information of an IAM policy. |
| "project": "A String", # The project that the associated GCP resource belongs to, in the form of |
| # projects/{PROJECT_NUMBER}. If an IAM policy is set on a resource (like VM |
| # instance, Cloud Storage bucket), the project field will indicate the |
| # project that contains the resource. If an IAM policy is set on a folder or |
| # orgnization, the project field will be empty. |
| # |
| # To search against the `project`: |
| # |
| # * specify the `scope` field as this project in your search request. |
| "resource": "A String", # The full resource name of the resource associated with this IAM policy. |
| # Example: |
| # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. |
| # See [Cloud Asset Inventory Resource Name |
| # Format](https://cloud.google.com/asset-inventory/docs/resource-name-format) |
| # for more information. |
| # |
| # To search against the `resource`: |
| # |
| # * use a field query. Example: `resource : "organizations/123"` |
| "explanation": { # Explanation about the IAM policy search result. # Explanation about the IAM policy search result. It contains additional |
| # information to explain why the search result matches the query. |
| "matchedPermissions": { # The map from roles to their included permissions that match the |
| # permission query (i.e., a query containing `policy.role.permissions:`). |
| # Example: if query `policy.role.permissions : "compute.disk.get"` |
| # matches a policy binding that contains owner role, the |
| # matched_permissions will be `{"roles/owner": ["compute.disk.get"]}`. The |
| # roles can also be found in the returned `policy` bindings. Note that the |
| # map is populated only for requests with permission queries. |
| "a_key": { # IAM permissions |
| "permissions": [ # A list of permissions. A sample permission string: `compute.disk.get`. |
| "A String", |
| ], |
| }, |
| }, |
| }, |
| "policy": { # An Identity and Access Management (IAM) policy, which specifies access # The IAM policy directly set on the given resource. Note that the original |
| # IAM policy can contain multiple bindings. This only contains the bindings |
| # that match the given query. For queries that don't contain a constrain on |
| # policies (e.g., an empty query), this contains all the bindings. |
| # |
| # To search against the `policy` bindings: |
| # |
| # * use a field query, as following: |
| # - query by the policy contained members. Example: |
| # `policy : "amy@gmail.com"` |
| # - query by the policy contained roles. Example: |
| # `policy : "roles/compute.admin"` |
| # - query by the policy contained roles' implied permissions. Example: |
| # `policy.role.permissions : "compute.instances.create"` |
| # controls for Google Cloud resources. |
| # |
| # |
| # A `Policy` is a collection of `bindings`. A `binding` binds one or more |
| # `members` to a single `role`. Members can be user accounts, service accounts, |
| # Google groups, and domains (such as G Suite). A `role` is a named list of |
| # permissions; each `role` can be an IAM predefined role or a user-created |
| # custom role. |
| # |
| # For some types of Google Cloud resources, a `binding` can also specify a |
| # `condition`, which is a logical expression that allows access to a resource |
| # only if the expression evaluates to `true`. A condition can add constraints |
| # based on attributes of the request, the resource, or both. To learn which |
| # resources support conditions in their IAM policies, see the |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| # |
| # **JSON example:** |
| # |
| # { |
| # "bindings": [ |
| # { |
| # "role": "roles/resourcemanager.organizationAdmin", |
| # "members": [ |
| # "user:mike@example.com", |
| # "group:admins@example.com", |
| # "domain:google.com", |
| # "serviceAccount:my-project-id@appspot.gserviceaccount.com" |
| # ] |
| # }, |
| # { |
| # "role": "roles/resourcemanager.organizationViewer", |
| # "members": [ |
| # "user:eve@example.com" |
| # ], |
| # "condition": { |
| # "title": "expirable access", |
| # "description": "Does not grant access after Sep 2020", |
| # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", |
| # } |
| # } |
| # ], |
| # "etag": "BwWWja0YfJA=", |
| # "version": 3 |
| # } |
| # |
| # **YAML example:** |
| # |
| # bindings: |
| # - members: |
| # - user:mike@example.com |
| # - group:admins@example.com |
| # - domain:google.com |
| # - serviceAccount:my-project-id@appspot.gserviceaccount.com |
| # role: roles/resourcemanager.organizationAdmin |
| # - members: |
| # - user:eve@example.com |
| # role: roles/resourcemanager.organizationViewer |
| # condition: |
| # title: expirable access |
| # description: Does not grant access after Sep 2020 |
| # expression: request.time < timestamp('2020-10-01T00:00:00.000Z') |
| # - etag: BwWWja0YfJA= |
| # - version: 3 |
| # |
| # For a description of IAM and its features, see the |
| # [IAM documentation](https://cloud.google.com/iam/docs/). |
| "version": 42, # Specifies the format of the policy. |
| # |
| # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value |
| # are rejected. |
| # |
| # Any operation that affects conditional role bindings must specify version |
| # `3`. This requirement applies to the following operations: |
| # |
| # * Getting a policy that includes a conditional role binding |
| # * Adding a conditional role binding to a policy |
| # * Changing a conditional role binding in a policy |
| # * Removing any role binding, with or without a condition, from a policy |
| # that includes conditions |
| # |
| # **Important:** If you use IAM Conditions, you must include the `etag` field |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows |
| # you to overwrite a version `3` policy with a version `1` policy, and all of |
| # the conditions in the version `3` policy are lost. |
| # |
| # If a policy does not include any conditions, operations on that policy may |
| # specify any valid version or leave the field unset. |
| # |
| # To learn which resources support conditions in their IAM policies, see the |
| # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| "auditConfigs": [ # Specifies cloud audit logging configuration for this policy. |
| { # Specifies the audit configuration for a service. |
| # The configuration determines which permission types are logged, and what |
| # identities, if any, are exempted from logging. |
| # An AuditConfig must have one or more AuditLogConfigs. |
| # |
| # If there are AuditConfigs for both `allServices` and a specific service, |
| # the union of the two AuditConfigs is used for that service: the log_types |
| # specified in each AuditConfig are enabled, and the exempted_members in each |
| # AuditLogConfig are exempted. |
| # |
| # Example Policy with multiple AuditConfigs: |
| # |
| # { |
| # "audit_configs": [ |
| # { |
| # "service": "allServices", |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ", |
| # "exempted_members": [ |
| # "user:jose@example.com" |
| # ] |
| # }, |
| # { |
| # "log_type": "DATA_WRITE" |
| # }, |
| # { |
| # "log_type": "ADMIN_READ" |
| # } |
| # ] |
| # }, |
| # { |
| # "service": "sampleservice.googleapis.com", |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ" |
| # }, |
| # { |
| # "log_type": "DATA_WRITE", |
| # "exempted_members": [ |
| # "user:aliya@example.com" |
| # ] |
| # } |
| # ] |
| # } |
| # ] |
| # } |
| # |
| # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ |
| # logging. It also exempts jose@example.com from DATA_READ logging, and |
| # aliya@example.com from DATA_WRITE logging. |
| "service": "A String", # Specifies a service that will be enabled for audit logging. |
| # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. |
| # `allServices` is a special value that covers all services. |
| "auditLogConfigs": [ # The configuration for logging of each type of permission. |
| { # Provides the configuration for logging a type of permissions. |
| # Example: |
| # |
| # { |
| # "audit_log_configs": [ |
| # { |
| # "log_type": "DATA_READ", |
| # "exempted_members": [ |
| # "user:jose@example.com" |
| # ] |
| # }, |
| # { |
| # "log_type": "DATA_WRITE" |
| # } |
| # ] |
| # } |
| # |
| # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting |
| # jose@example.com from DATA_READ logging. |
| "logType": "A String", # The log type that this config enables. |
| "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of |
| # permission. |
| # Follows the same format of Binding.members. |
| "A String", |
| ], |
| }, |
| ], |
| }, |
| ], |
| "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a |
| # `condition` that determines how and when the `bindings` are applied. Each |
| # of the `bindings` must contain at least one member. |
| { # Associates `members` with a `role`. |
| "role": "A String", # Role that is assigned to `members`. |
| # For example, `roles/viewer`, `roles/editor`, or `roles/owner`. |
| "members": [ # Specifies the identities requesting access for a Cloud Platform resource. |
| # `members` can have the following values: |
| # |
| # * `allUsers`: A special identifier that represents anyone who is |
| # on the internet; with or without a Google account. |
| # |
| # * `allAuthenticatedUsers`: A special identifier that represents anyone |
| # who is authenticated with a Google account or a service account. |
| # |
| # * `user:{emailid}`: An email address that represents a specific Google |
| # account. For example, `alice@example.com` . |
| # |
| # |
| # * `serviceAccount:{emailid}`: An email address that represents a service |
| # account. For example, `my-other-app@appspot.gserviceaccount.com`. |
| # |
| # * `group:{emailid}`: An email address that represents a Google group. |
| # For example, `admins@example.com`. |
| # |
| # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique |
| # identifier) representing a user that has been recently deleted. For |
| # example, `alice@example.com?uid=123456789012345678901`. If the user is |
| # recovered, this value reverts to `user:{emailid}` and the recovered user |
| # retains the role in the binding. |
| # |
| # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus |
| # unique identifier) representing a service account that has been recently |
| # deleted. For example, |
| # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. |
| # If the service account is undeleted, this value reverts to |
| # `serviceAccount:{emailid}` and the undeleted service account retains the |
| # role in the binding. |
| # |
| # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique |
| # identifier) representing a Google group that has been recently |
| # deleted. For example, `admins@example.com?uid=123456789012345678901`. If |
| # the group is recovered, this value reverts to `group:{emailid}` and the |
| # recovered group retains the role in the binding. |
| # |
| # |
| # * `domain:{domain}`: The G Suite domain (primary) that represents all the |
| # users of that domain. For example, `google.com` or `example.com`. |
| # |
| "A String", |
| ], |
| "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding. |
| # |
| # If the condition evaluates to `true`, then this binding applies to the |
| # current request. |
| # |
| # If the condition evaluates to `false`, then this binding does not apply to |
| # the current request. However, a different role binding might grant the same |
| # role to one or more of the members in this binding. |
| # |
| # To learn which resources support conditions in their IAM policies, see the |
| # [IAM |
| # documentation](https://cloud.google.com/iam/help/conditions/resource-policies). |
| # syntax. CEL is a C-like expression language. The syntax and semantics of CEL |
| # are documented at https://github.com/google/cel-spec. |
| # |
| # Example (Comparison): |
| # |
| # title: "Summary size limit" |
| # description: "Determines if a summary is less than 100 chars" |
| # expression: "document.summary.size() < 100" |
| # |
| # Example (Equality): |
| # |
| # title: "Requestor is owner" |
| # description: "Determines if requestor is the document owner" |
| # expression: "document.owner == request.auth.claims.email" |
| # |
| # Example (Logic): |
| # |
| # title: "Public documents" |
| # description: "Determine whether the document should be publicly visible" |
| # expression: "document.type != 'private' && document.type != 'internal'" |
| # |
| # Example (Data Manipulation): |
| # |
| # title: "Notification string" |
| # description: "Create a notification string with a timestamp." |
| # expression: "'New message received at ' + string(document.create_time)" |
| # |
| # The exact variables and functions that may be referenced within an expression |
| # are determined by the service that evaluates it. See the service |
| # documentation for additional information. |
| "description": "A String", # Optional. Description of the expression. This is a longer text which |
| # describes the expression, e.g. when hovered over it in a UI. |
| "location": "A String", # Optional. String indicating the location of the expression for error |
| # reporting, e.g. a file name and a position in the file. |
| "expression": "A String", # Textual representation of an expression in Common Expression Language |
| # syntax. |
| "title": "A String", # Optional. Title for the expression, i.e. a short string describing |
| # its purpose. This can be used e.g. in UIs which allow to enter the |
| # expression. |
| }, |
| }, |
| ], |
| "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help |
| # prevent simultaneous updates of a policy from overwriting each other. |
| # It is strongly suggested that systems make use of the `etag` in the |
| # read-modify-write cycle to perform policy updates in order to avoid race |
| # conditions: An `etag` is returned in the response to `getIamPolicy`, and |
| # systems are expected to put that etag in the request to `setIamPolicy` to |
| # ensure that their change will be applied to the same version of the policy. |
| # |
| # **Important:** If you use IAM Conditions, you must include the `etag` field |
| # whenever you call `setIamPolicy`. If you omit this field, then IAM allows |
| # you to overwrite a version `3` policy with a version `1` policy, and all of |
| # the conditions in the version `3` policy are lost. |
| }, |
| }, |
| ], |
| "nextPageToken": "A String", # Set if there are more results than those appearing in this response; to get |
| # the next set of results, call this method again, using this value as the |
| # `page_token`. |
| }</pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="searchAllIamPolicies_next">searchAllIamPolicies_next(previous_request, previous_response)</code> |
| <pre>Retrieves the next page of results. |
| |
| Args: |
| previous_request: The request for the previous page. (required) |
| previous_response: The response from the request for the previous page. (required) |
| |
| Returns: |
| A request object that you can call 'execute()' on to request the next |
| page. Returns None if there are no more items in the collection. |
| </pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="searchAllResources">searchAllResources(scope, orderBy=None, query=None, assetTypes=None, pageToken=None, pageSize=None, x__xgafv=None)</code> |
| <pre>Searches all the resources within the given accessible scope (e.g., a |
| project, a folder or an organization). Callers should have |
| `cloud.assets.SearchAllResources` permission upon the requested scope, |
| otherwise the request will be rejected. |
| |
| Args: |
| scope: string, Required. A scope can be a project, a folder or an organization. The search is |
| limited to the resources within the `scope`. |
| |
| The allowed values are: |
| |
| * projects/{PROJECT_ID} |
| * projects/{PROJECT_NUMBER} |
| * folders/{FOLDER_NUMBER} |
| * organizations/{ORGANIZATION_NUMBER} (required) |
| orderBy: string, Optional. A comma separated list of fields specifying the sorting order of the |
| results. The default order is ascending. Add " DESC" after the field name |
| to indicate descending order. Redundant space characters are ignored. |
| Example: "location DESC, name". Only string fields in the response are |
| sortable, including `name`, `displayName`, `description`, `location`. All |
| the other fields such as repeated fields (e.g., `networkTags`), map |
| fields (e.g., `labels`) and struct fields (e.g., `additionalAttributes`) |
| are not supported. |
| query: string, Optional. The query statement. An empty query can be specified to search all the |
| resources of certain `asset_types` within the given `scope`. |
| |
| Examples: |
| |
| * `name : "Important"` to find Cloud resources whose name contains |
| "Important" as a word. |
| * `displayName : "Impor*"` to find Cloud resources whose display name |
| contains "Impor" as a word prefix. |
| * `description : "*por*"` to find Cloud resources whose description |
| contains "por" as a substring. |
| * `location : "us-west*"` to find Cloud resources whose location is |
| prefixed with "us-west". |
| * `labels : "prod"` to find Cloud resources whose labels contain "prod" as |
| a key or value. |
| * `labels.env : "prod"` to find Cloud resources which have a label "env" |
| and its value is "prod". |
| * `labels.env : *` to find Cloud resources which have a label "env". |
| * `"Important"` to find Cloud resources which contain "Important" as a word |
| in any of the searchable fields. |
| * `"Impor*"` to find Cloud resources which contain "Impor" as a word prefix |
| in any of the searchable fields. |
| * `"*por*"` to find Cloud resources which contain "por" as a substring in |
| any of the searchable fields. |
| * `("Important" AND location : ("us-west1" OR "global"))` to find Cloud |
| resources which contain "Important" as a word in any of the searchable |
| fields and are also located in the "us-west1" region or the "global" |
| location. |
| |
| See [how to construct a |
| query](https://cloud.google.com/asset-inventory/docs/searching-resources#how_to_construct_a_query) |
| for more details. |
| assetTypes: string, Optional. A list of asset types that this request searches for. If empty, it will |
| search all the [searchable asset |
| types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types). (repeated) |
| pageToken: string, Optional. If present, then retrieve the next batch of results from the preceding call |
| to this method. `page_token` must be the value of `next_page_token` from |
| the previous response. The values of all other method parameters, must be |
| identical to those in the previous call. |
| pageSize: integer, Optional. The page size for search result pagination. Page size is capped at 500 even |
| if a larger value is given. If set to zero, server will pick an appropriate |
| default. Returned results may be fewer than requested. When this happens, |
| there could be more results as long as `next_page_token` is returned. |
| x__xgafv: string, V1 error format. |
| Allowed values |
| 1 - v1 error format |
| 2 - v2 error format |
| |
| Returns: |
| An object of the form: |
| |
| { # Search all resources response. |
| "nextPageToken": "A String", # If there are more results than those appearing in this response, then |
| # `next_page_token` is included. To get the next set of results, call this |
| # method again using the value of `next_page_token` as `page_token`. |
| "results": [ # A list of Resources that match the search query. It contains the resource |
| # standard metadata information. |
| { # A result of Resource Search, containing information of a cloud resoure. |
| "networkTags": [ # Network tags associated with this resource. Like labels, network tags are a |
| # type of annotations used to group GCP resources. See [Labelling GCP |
| # resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources) |
| # for more information. |
| # |
| # To search against the `network_tags`: |
| # |
| # * use a field query. Example: `networkTags : "internal"` |
| # * use a free text query. Example: `"internal"` |
| "A String", |
| ], |
| "assetType": "A String", # The type of this resource. Example: `compute.googleapis.com/Disk`. |
| # |
| # To search against the `asset_type`: |
| # |
| # * specify the `asset_type` field in your search request. |
| "displayName": "A String", # The display name of this resource. |
| # |
| # To search against the `display_name`: |
| # |
| # * use a field query. Example: `displayName : "My Instance"` |
| # * use a free text query. Example: `"My Instance"` |
| "name": "A String", # The full resource name of this resource. Example: |
| # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. |
| # See [Cloud Asset Inventory Resource Name |
| # Format](https://cloud.google.com/asset-inventory/docs/resource-name-format) |
| # for more information. |
| # |
| # To search against the `name`: |
| # |
| # * use a field query. Example: `name : "instance1"` |
| # * use a free text query. Example: `"instance1"` |
| "description": "A String", # One or more paragraphs of text description of this resource. Maximum length |
| # could be up to 1M bytes. |
| # |
| # To search against the `description`: |
| # |
| # * use a field query. Example: `description : "*important instance*"` |
| # * use a free text query. Example: `"*important instance*"` |
| "project": "A String", # The project that this resource belongs to, in the form of |
| # projects/{PROJECT_NUMBER}. |
| # |
| # To search against the `project`: |
| # |
| # * specify the `scope` field as this project in your search request. |
| "location": "A String", # Location can be `global`, regional like `us-east1`, or zonal like |
| # `us-west1-b`. |
| # |
| # To search against the `location`: |
| # |
| # * use a field query. Example: `location : "us-west*"` |
| # * use a free text query. Example: `"us-west*"` |
| "additionalAttributes": { # The additional attributes of this resource. The attributes may vary from |
| # one resource type to another. Examples: `projectId` for Project, |
| # `dnsName` for DNS ManagedZone. This field contains a subset of the resource |
| # metadata fields that are returned by the List or Get APIs provided by the |
| # corresponding GCP service (e.g., Compute Engine). see [API |
| # references](https://cloud.google.com/asset-inventory/docs/supported-asset-types#supported_resource_types) |
| # of CAIS supported resource types. You can search values of these fields |
| # through free text search. However, you should not consume the field |
| # programically as the field names and values may change as the GCP service |
| # (e.g., Compute Engine) updates to a new incompatible API version. |
| # |
| # To search against the `additional_attributes`: |
| # |
| # * use a free text query to match the attributes values. Example: to search |
| # `additional_attributes = { dnsName: "foobar" }`, you can issue a query |
| # `"foobar"`. |
| "a_key": "", # Properties of the object. |
| }, |
| "labels": { # Labels associated with this resource. See [Labelling and grouping GCP |
| # resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources) |
| # for more information. |
| # |
| # To search against the `labels`: |
| # |
| # * use a field query, as following: |
| # - query on any label's key or value. Example: `labels : "prod"` |
| # - query by a given label. Example: `labels.env : "prod"` |
| # - query by a given label'sexistence. Example: `labels.env : *` |
| # * use a free text query. Example: `"prod"` |
| "a_key": "A String", |
| }, |
| }, |
| ], |
| }</pre> |
| </div> |
| |
| <div class="method"> |
| <code class="details" id="searchAllResources_next">searchAllResources_next(previous_request, previous_response)</code> |
| <pre>Retrieves the next page of results. |
| |
| Args: |
| previous_request: The request for the previous page. (required) |
| previous_response: The response from the request for the previous page. (required) |
| |
| Returns: |
| A request object that you can call 'execute()' on to request the next |
| page. Returns None if there are no more items in the collection. |
| </pre> |
| </div> |
| |
| </body></html> |
