google-api-client 0.32.1 → 0.40.0

data/generated/google/apis/accesscontextmanager_v1/classes.rb

@@ -22,8 +22,9 @@ module Google
   module Apis
     module AccesscontextmanagerV1
       
-      # An `AccessLevel` is a label that can be applied to requests to GCP services,
-      # along with a list of requirements necessary for the label to be applied.
+      # An `AccessLevel` is a label that can be applied to requests to Google Cloud
+      # services, along with a list of requirements necessary for the label to be
+      # applied.
       class AccessLevel
         include Google::Apis::Core::Hashable
       
@@ -32,10 +33,12 @@ module Google
         # @return [Google::Apis::AccesscontextmanagerV1::BasicLevel]
         attr_accessor :basic
       
-        # Output only. Time the `AccessLevel` was created in UTC.
-        # Corresponds to the JSON property `createTime`
-        # @return [String]
-        attr_accessor :create_time
+        # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
+        # to represent the necessary conditions for the level to apply to a request.
+        # See CEL spec at: https://github.com/google/cel-spec
+        # Corresponds to the JSON property `custom`
+        # @return [Google::Apis::AccesscontextmanagerV1::CustomLevel]
+        attr_accessor :custom
       
         # Description of the `AccessLevel` and its use. Does not affect behavior.
         # Corresponds to the JSON property `description`
@@ -44,7 +47,8 @@ module Google
       
         # Required. Resource name for the Access Level. The `short_name` component
         # must begin with a letter and only include alphanumeric and '_'. Format:
-        # `accessPolicies/`policy_id`/accessLevels/`short_name``
+        # `accessPolicies/`policy_id`/accessLevels/`short_name``. The maximum length
+        # of the `short_name` component is 50 characters.
         # Corresponds to the JSON property `name`
         # @return [String]
         attr_accessor :name
@@ -54,11 +58,6 @@ module Google
         # @return [String]
         attr_accessor :title
       
-        # Output only. Time the `AccessLevel` was updated in UTC.
-        # Corresponds to the JSON property `updateTime`
-        # @return [String]
-        attr_accessor :update_time
-      
         def initialize(**args)
            update!(**args)
         end
@@ -66,26 +65,28 @@ module Google
         # Update properties of this object
         def update!(**args)
           @basic = args[:basic] if args.key?(:basic)
-          @create_time = args[:create_time] if args.key?(:create_time)
+          @custom = args[:custom] if args.key?(:custom)
           @description = args[:description] if args.key?(:description)
           @name = args[:name] if args.key?(:name)
           @title = args[:title] if args.key?(:title)
-          @update_time = args[:update_time] if args.key?(:update_time)
         end
       end
       
       # `AccessPolicy` is a container for `AccessLevels` (which define the necessary
-      # attributes to use GCP services) and `ServicePerimeters` (which define regions
-      # of services able to freely pass data within a perimeter). An access policy is
-      # globally visible within an organization, and the restrictions it specifies
-      # apply to all projects within an organization.
+      # attributes to use Google Cloud services) and `ServicePerimeters` (which
+      # define regions of services able to freely pass data within a perimeter). An
+      # access policy is globally visible within an organization, and the
+      # restrictions it specifies apply to all projects within an organization.
       class AccessPolicy
         include Google::Apis::Core::Hashable
       
-        # Output only. Time the `AccessPolicy` was created in UTC.
-        # Corresponds to the JSON property `createTime`
+        # Output only. An opaque identifier for the current version of the
+        # `AccessPolicy`. This will always be a strongly validated etag, meaning that
+        # two Access Polices will be identical if and only if their etags are
+        # identical. Clients should not expect this to be in any specific format.
+        # Corresponds to the JSON property `etag`
         # @return [String]
-        attr_accessor :create_time
+        attr_accessor :etag
       
         # Output only. Resource name of the `AccessPolicy`. Format:
         # `accessPolicies/`policy_id``
@@ -105,22 +106,16 @@ module Google
         # @return [String]
         attr_accessor :title
       
-        # Output only. Time the `AccessPolicy` was updated in UTC.
-        # Corresponds to the JSON property `updateTime`
-        # @return [String]
-        attr_accessor :update_time
-      
         def initialize(**args)
            update!(**args)
         end
       
         # Update properties of this object
         def update!(**args)
-          @create_time = args[:create_time] if args.key?(:create_time)
+          @etag = args[:etag] if args.key?(:etag)
           @name = args[:name] if args.key?(:name)
           @parent = args[:parent] if args.key?(:parent)
           @title = args[:title] if args.key?(:title)
-          @update_time = args[:update_time] if args.key?(:update_time)
         end
       end
       
@@ -166,6 +161,52 @@ module Google
         end
       end
       
+      # A request to commit dry-run specs in all Service Perimeters belonging to
+      # an Access Policy.
+      class CommitServicePerimetersRequest
+        include Google::Apis::Core::Hashable
+      
+        # Optional. The etag for the version of the Access Policy that this
+        # commit operation is to be performed on. If, at the time of commit, the
+        # etag for the Access Policy stored in Access Context Manager is different
+        # from the specified etag, then the commit operation will not be performed
+        # and the call will fail. This field is not required. If etag is not
+        # provided, the operation will be performed as if a valid etag is provided.
+        # Corresponds to the JSON property `etag`
+        # @return [String]
+        attr_accessor :etag
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @etag = args[:etag] if args.key?(:etag)
+        end
+      end
+      
+      # A response to CommitServicePerimetersRequest. This will be put inside of
+      # Operation.response field.
+      class CommitServicePerimetersResponse
+        include Google::Apis::Core::Hashable
+      
+        # List of all the Service Perimeter instances in
+        # the Access Policy.
+        # Corresponds to the JSON property `servicePerimeters`
+        # @return [Array<Google::Apis::AccesscontextmanagerV1::ServicePerimeter>]
+        attr_accessor :service_perimeters
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @service_perimeters = args[:service_perimeters] if args.key?(:service_perimeters)
+        end
+      end
+      
       # A condition necessary for an `AccessLevel` to be granted. The Condition is an
       # AND over its fields. So a Condition is true if: 1) the request IP is from one
       # of the listed subnetworks AND 2) the originating device complies with the
@@ -247,6 +288,48 @@ module Google
         end
       end
       
+      # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
+      # to represent the necessary conditions for the level to apply to a request.
+      # See CEL spec at: https://github.com/google/cel-spec
+      class CustomLevel
+        include Google::Apis::Core::Hashable
+      
+        # Represents a textual expression in the Common Expression Language (CEL)
+        # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+        # are documented at https://github.com/google/cel-spec.
+        # Example (Comparison):
+        # title: "Summary size limit"
+        # description: "Determines if a summary is less than 100 chars"
+        # expression: "document.summary.size() < 100"
+        # Example (Equality):
+        # title: "Requestor is owner"
+        # description: "Determines if requestor is the document owner"
+        # expression: "document.owner == request.auth.claims.email"
+        # Example (Logic):
+        # title: "Public documents"
+        # description: "Determine whether the document should be publicly visible"
+        # expression: "document.type != 'private' && document.type != 'internal'"
+        # Example (Data Manipulation):
+        # title: "Notification string"
+        # description: "Create a notification string with a timestamp."
+        # expression: "'New message received at ' + string(document.create_time)"
+        # The exact variables and functions that may be referenced within an expression
+        # are determined by the service that evaluates it. See the service
+        # documentation for additional information.
+        # Corresponds to the JSON property `expr`
+        # @return [Google::Apis::AccesscontextmanagerV1::Expr]
+        attr_accessor :expr
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @expr = args[:expr] if args.key?(:expr)
+        end
+      end
+      
       # `DevicePolicy` specifies device specific restrictions necessary to acquire a
       # given access level. A `DevicePolicy` specifies requirements for requests from
       # devices to be granted access levels, it does not do any enforcement on the
@@ -328,6 +411,69 @@ module Google
         end
       end
       
+      # Represents a textual expression in the Common Expression Language (CEL)
+      # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+      # are documented at https://github.com/google/cel-spec.
+      # Example (Comparison):
+      # title: "Summary size limit"
+      # description: "Determines if a summary is less than 100 chars"
+      # expression: "document.summary.size() < 100"
+      # Example (Equality):
+      # title: "Requestor is owner"
+      # description: "Determines if requestor is the document owner"
+      # expression: "document.owner == request.auth.claims.email"
+      # Example (Logic):
+      # title: "Public documents"
+      # description: "Determine whether the document should be publicly visible"
+      # expression: "document.type != 'private' && document.type != 'internal'"
+      # Example (Data Manipulation):
+      # title: "Notification string"
+      # description: "Create a notification string with a timestamp."
+      # expression: "'New message received at ' + string(document.create_time)"
+      # The exact variables and functions that may be referenced within an expression
+      # are determined by the service that evaluates it. See the service
+      # documentation for additional information.
+      class Expr
+        include Google::Apis::Core::Hashable
+      
+        # Optional. Description of the expression. This is a longer text which
+        # describes the expression, e.g. when hovered over it in a UI.
+        # Corresponds to the JSON property `description`
+        # @return [String]
+        attr_accessor :description
+      
+        # Textual representation of an expression in Common Expression Language
+        # syntax.
+        # Corresponds to the JSON property `expression`
+        # @return [String]
+        attr_accessor :expression
+      
+        # Optional. String indicating the location of the expression for error
+        # reporting, e.g. a file name and a position in the file.
+        # Corresponds to the JSON property `location`
+        # @return [String]
+        attr_accessor :location
+      
+        # Optional. Title for the expression, i.e. a short string describing
+        # its purpose. This can be used e.g. in UIs which allow to enter the
+        # expression.
+        # Corresponds to the JSON property `title`
+        # @return [String]
+        attr_accessor :title
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @description = args[:description] if args.key?(:description)
+          @expression = args[:expression] if args.key?(:expression)
+          @location = args[:location] if args.key?(:location)
+          @title = args[:title] if args.key?(:title)
+        end
+      end
+      
       # A response to `ListAccessLevelsRequest`.
       class ListAccessLevelsResponse
         include Google::Apis::Core::Hashable
@@ -513,7 +659,7 @@ module Google
       
         # Only allows requests from devices with a verified Chrome OS.
         # Verifications includes requirements that the device is enterprise-managed,
-        # conformant to Dasher domain policies, and the caller has permission to call
+        # conformant to domain policies, and the caller has permission to call
         # the API targeted by the request.
         # Corresponds to the JSON property `requireVerifiedChromeOs`
         # @return [Boolean]
@@ -532,23 +678,125 @@ module Google
         end
       end
       
-      # `ServicePerimeter` describes a set of GCP resources which can freely import
-      # and export data amongst themselves, but not export outside of the
+      # A request to replace all existing Access Levels in an Access Policy with
+      # the Access Levels provided. This is done atomically.
+      class ReplaceAccessLevelsRequest
+        include Google::Apis::Core::Hashable
+      
+        # Required. The desired Access Levels that should
+        # replace all existing Access Levels in the
+        # Access Policy.
+        # Corresponds to the JSON property `accessLevels`
+        # @return [Array<Google::Apis::AccesscontextmanagerV1::AccessLevel>]
+        attr_accessor :access_levels
+      
+        # Optional. The etag for the version of the Access Policy that this
+        # replace operation is to be performed on. If, at the time of replace, the
+        # etag for the Access Policy stored in Access Context Manager is different
+        # from the specified etag, then the replace operation will not be performed
+        # and the call will fail. This field is not required. If etag is not
+        # provided, the operation will be performed as if a valid etag is provided.
+        # Corresponds to the JSON property `etag`
+        # @return [String]
+        attr_accessor :etag
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @access_levels = args[:access_levels] if args.key?(:access_levels)
+          @etag = args[:etag] if args.key?(:etag)
+        end
+      end
+      
+      # A response to ReplaceAccessLevelsRequest. This will be put inside of
+      # Operation.response field.
+      class ReplaceAccessLevelsResponse
+        include Google::Apis::Core::Hashable
+      
+        # List of the Access Level instances.
+        # Corresponds to the JSON property `accessLevels`
+        # @return [Array<Google::Apis::AccesscontextmanagerV1::AccessLevel>]
+        attr_accessor :access_levels
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @access_levels = args[:access_levels] if args.key?(:access_levels)
+        end
+      end
+      
+      # A request to replace all existing Service Perimeters in an Access Policy
+      # with the Service Perimeters provided. This is done atomically.
+      class ReplaceServicePerimetersRequest
+        include Google::Apis::Core::Hashable
+      
+        # Optional. The etag for the version of the Access Policy that this
+        # replace operation is to be performed on. If, at the time of replace, the
+        # etag for the Access Policy stored in Access Context Manager is different
+        # from the specified etag, then the replace operation will not be performed
+        # and the call will fail. This field is not required. If etag is not
+        # provided, the operation will be performed as if a valid etag is provided.
+        # Corresponds to the JSON property `etag`
+        # @return [String]
+        attr_accessor :etag
+      
+        # Required. The desired Service Perimeters that should
+        # replace all existing Service Perimeters in the
+        # Access Policy.
+        # Corresponds to the JSON property `servicePerimeters`
+        # @return [Array<Google::Apis::AccesscontextmanagerV1::ServicePerimeter>]
+        attr_accessor :service_perimeters
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @etag = args[:etag] if args.key?(:etag)
+          @service_perimeters = args[:service_perimeters] if args.key?(:service_perimeters)
+        end
+      end
+      
+      # A response to ReplaceServicePerimetersRequest. This will be put inside of
+      # Operation.response field.
+      class ReplaceServicePerimetersResponse
+        include Google::Apis::Core::Hashable
+      
+        # List of the Service Perimeter instances.
+        # Corresponds to the JSON property `servicePerimeters`
+        # @return [Array<Google::Apis::AccesscontextmanagerV1::ServicePerimeter>]
+        attr_accessor :service_perimeters
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @service_perimeters = args[:service_perimeters] if args.key?(:service_perimeters)
+        end
+      end
+      
+      # `ServicePerimeter` describes a set of Google Cloud resources which can freely
+      # import and export data amongst themselves, but not export outside of the
       # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
       # has a target outside of the `ServicePerimeter`, the request will be blocked.
       # Otherwise the request is allowed. There are two types of Service Perimeter -
-      # Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP
-      # project can only belong to a single regular Service Perimeter. Service
-      # Perimeter Bridges can contain only GCP projects as members, a single GCP
-      # project may belong to multiple Service Perimeter Bridges.
+      # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
+      # Google Cloud project can only belong to a single regular Service Perimeter.
+      # Service Perimeter Bridges can contain only Google Cloud projects as members,
+      # a single Google Cloud project may belong to multiple Service Perimeter
+      # Bridges.
       class ServicePerimeter
         include Google::Apis::Core::Hashable
       
-        # Output only. Time the `ServicePerimeter` was created in UTC.
-        # Corresponds to the JSON property `createTime`
-        # @return [String]
-        attr_accessor :create_time
-      
         # Description of the `ServicePerimeter` and its use. Does not affect
         # behavior.
         # Corresponds to the JSON property `description`
@@ -572,8 +820,14 @@ module Google
         # @return [String]
         attr_accessor :perimeter_type
       
-        # `ServicePerimeterConfig` specifies a set of GCP resources that describe
-        # specific Service Perimeter configuration.
+        # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
+        # describe specific Service Perimeter configuration.
+        # Corresponds to the JSON property `spec`
+        # @return [Google::Apis::AccesscontextmanagerV1::ServicePerimeterConfig]
+        attr_accessor :spec
+      
+        # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
+        # describe specific Service Perimeter configuration.
         # Corresponds to the JSON property `status`
         # @return [Google::Apis::AccesscontextmanagerV1::ServicePerimeterConfig]
         attr_accessor :status
@@ -583,10 +837,20 @@ module Google
         # @return [String]
         attr_accessor :title
       
-        # Output only. Time the `ServicePerimeter` was updated in UTC.
-        # Corresponds to the JSON property `updateTime`
-        # @return [String]
-        attr_accessor :update_time
+        # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
+        # exists  for all Service Perimeters, and that spec is identical to the
+        # status for those Service Perimeters. When this flag is set, it inhibits the
+        # generation of the implicit spec, thereby allowing the user to explicitly
+        # provide a configuration ("spec") to use in a dry-run version of the Service
+        # Perimeter. This allows the user to test changes to the enforced config
+        # ("status") without actually enforcing them. This testing is done through
+        # analyzing the differences between currently enforced and suggested
+        # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
+        # fields in the spec are set to non-default values.
+        # Corresponds to the JSON property `useExplicitDryRunSpec`
+        # @return [Boolean]
+        attr_accessor :use_explicit_dry_run_spec
+        alias_method :use_explicit_dry_run_spec?, :use_explicit_dry_run_spec
       
         def initialize(**args)
            update!(**args)
@@ -594,18 +858,18 @@ module Google
       
         # Update properties of this object
         def update!(**args)
-          @create_time = args[:create_time] if args.key?(:create_time)
           @description = args[:description] if args.key?(:description)
           @name = args[:name] if args.key?(:name)
           @perimeter_type = args[:perimeter_type] if args.key?(:perimeter_type)
+          @spec = args[:spec] if args.key?(:spec)
           @status = args[:status] if args.key?(:status)
           @title = args[:title] if args.key?(:title)
-          @update_time = args[:update_time] if args.key?(:update_time)
+          @use_explicit_dry_run_spec = args[:use_explicit_dry_run_spec] if args.key?(:use_explicit_dry_run_spec)
         end
       end
       
-      # `ServicePerimeterConfig` specifies a set of GCP resources that describe
-      # specific Service Perimeter configuration.
+      # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
+      # describe specific Service Perimeter configuration.
       class ServicePerimeterConfig
         include Google::Apis::Core::Hashable
       
@@ -613,27 +877,34 @@ module Google
         # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
         # must be in the same policy as this `ServicePerimeter`. Referencing a
         # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
-        # listed, resources within the perimeter can only be accessed via GCP calls
-        # with request origins within the perimeter. Example:
+        # listed, resources within the perimeter can only be accessed via Google
+        # Cloud calls with request origins within the perimeter. Example:
         # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
         # For Service Perimeter Bridge, must be empty.
         # Corresponds to the JSON property `accessLevels`
         # @return [Array<String>]
         attr_accessor :access_levels
       
-        # A list of GCP resources that are inside of the service perimeter.
+        # A list of Google Cloud resources that are inside of the service perimeter.
         # Currently only projects are allowed. Format: `projects/`project_number``
         # Corresponds to the JSON property `resources`
         # @return [Array<String>]
         attr_accessor :resources
       
-        # GCP services that are subject to the Service Perimeter restrictions. For
-        # example, if `storage.googleapis.com` is specified, access to the storage
-        # buckets inside the perimeter must meet the perimeter's access restrictions.
+        # Google Cloud services that are subject to the Service Perimeter
+        # restrictions. For example, if `storage.googleapis.com` is specified, access
+        # to the storage buckets inside the perimeter must meet the perimeter's
+        # access restrictions.
         # Corresponds to the JSON property `restrictedServices`
         # @return [Array<String>]
         attr_accessor :restricted_services
       
+        # Specifies how APIs are allowed to communicate within the Service
+        # Perimeter.
+        # Corresponds to the JSON property `vpcAccessibleServices`
+        # @return [Google::Apis::AccesscontextmanagerV1::VpcAccessibleServices]
+        attr_accessor :vpc_accessible_services
+      
         def initialize(**args)
            update!(**args)
         end
@@ -643,6 +914,7 @@ module Google
           @access_levels = args[:access_levels] if args.key?(:access_levels)
           @resources = args[:resources] if args.key?(:resources)
           @restricted_services = args[:restricted_services] if args.key?(:restricted_services)
+          @vpc_accessible_services = args[:vpc_accessible_services] if args.key?(:vpc_accessible_services)
         end
       end
       
@@ -684,6 +956,35 @@ module Google
           @message = args[:message] if args.key?(:message)
         end
       end
+      
+      # Specifies how APIs are allowed to communicate within the Service
+      # Perimeter.
+      class VpcAccessibleServices
+        include Google::Apis::Core::Hashable
+      
+        # The list of APIs usable within the Service Perimeter. Must be empty
+        # unless 'enable_restriction' is True.
+        # Corresponds to the JSON property `allowedServices`
+        # @return [Array<String>]
+        attr_accessor :allowed_services
+      
+        # Whether to restrict API calls within the Service Perimeter to the list of
+        # APIs specified in 'allowed_services'.
+        # Corresponds to the JSON property `enableRestriction`
+        # @return [Boolean]
+        attr_accessor :enable_restriction
+        alias_method :enable_restriction?, :enable_restriction
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @allowed_services = args[:allowed_services] if args.key?(:allowed_services)
+          @enable_restriction = args[:enable_restriction] if args.key?(:enable_restriction)
+        end
+      end
     end
   end
 end