google-api-client 0.32.1 → 0.40.0

data/generated/google/apis/cloudasset_v1/classes.rb

@@ -22,50 +22,66 @@ module Google
   module Apis
     module CloudassetV1
       
-      # Cloud asset. This includes all Google Cloud Platform resources,
-      # Cloud IAM policies, and other non-GCP assets.
+      # An asset in Google Cloud. An asset can be any resource in the Google Cloud
+      # [resource
+      # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-
+      # resource-hierarchy),
+      # a resource outside the Google Cloud resource hierarchy (such as Google
+      # Kubernetes Engine clusters and objects), or a Cloud IAM policy.
       class Asset
         include Google::Apis::Core::Hashable
       
-        # An `AccessLevel` is a label that can be applied to requests to GCP services,
-        # along with a list of requirements necessary for the label to be applied.
+        # An `AccessLevel` is a label that can be applied to requests to Google Cloud
+        # services, along with a list of requirements necessary for the label to be
+        # applied.
         # Corresponds to the JSON property `accessLevel`
         # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1AccessLevel]
         attr_accessor :access_level
       
         # `AccessPolicy` is a container for `AccessLevels` (which define the necessary
-        # attributes to use GCP services) and `ServicePerimeters` (which define regions
-        # of services able to freely pass data within a perimeter). An access policy is
-        # globally visible within an organization, and the restrictions it specifies
-        # apply to all projects within an organization.
+        # attributes to use Google Cloud services) and `ServicePerimeters` (which
+        # define regions of services able to freely pass data within a perimeter). An
+        # access policy is globally visible within an organization, and the
+        # restrictions it specifies apply to all projects within an organization.
         # Corresponds to the JSON property `accessPolicy`
         # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1AccessPolicy]
         attr_accessor :access_policy
       
-        # Asset's ancestry path in Cloud Resource Manager (CRM) hierarchy,
-        # represented as a list of relative resource names. Ancestry path starts with
-        # the closest CRM ancestor and ends at root. If the asset is a CRM
-        # project/folder/organization, this starts from the asset itself.
-        # Example: ["projects/123456789", "folders/5432", "organizations/1234"]
+        # The ancestry path of an asset in Google Cloud [resource
+        # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-
+        # resource-hierarchy),
+        # represented as a list of relative resource names. An ancestry path starts
+        # with the closest ancestor in the hierarchy and ends at root. If the asset
+        # is a project, folder, or organization, the ancestry path starts from the
+        # asset itself.
+        # Example: `["projects/123456789", "folders/5432", "organizations/1234"]`
         # Corresponds to the JSON property `ancestors`
         # @return [Array<String>]
         attr_accessor :ancestors
       
-        # Type of the asset. Example: "compute.googleapis.com/Disk".
+        # The type of the asset. Example: "compute.googleapis.com/Disk"
+        # See [Supported asset
+        # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types)
+        # for more information.
         # Corresponds to the JSON property `assetType`
         # @return [String]
         attr_accessor :asset_type
       
-        # Defines an Identity and Access Management (IAM) policy. It is used to
-        # specify access control policies for Cloud Platform resources.
+        # An Identity and Access Management (IAM) policy, which specifies access
+        # controls for Google Cloud resources.
         # A `Policy` is a collection of `bindings`. A `binding` binds one or more
         # `members` to a single `role`. Members can be user accounts, service accounts,
         # Google groups, and domains (such as G Suite). A `role` is a named list of
-        # permissions (defined by IAM or configured by users). A `binding` can
-        # optionally specify a `condition`, which is a logic expression that further
-        # constrains the role binding based on attributes about the request and/or
-        # target resource.
-        # **JSON Example**
+        # permissions; each `role` can be an IAM predefined role or a user-created
+        # custom role.
+        # For some types of Google Cloud resources, a `binding` can also specify a
+        # `condition`, which is a logical expression that allows access to a resource
+        # only if the expression evaluates to `true`. A condition can add constraints
+        # based on attributes of the request, the resource, or both. To learn which
+        # resources support conditions in their IAM policies, see the
+        # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-
+        # policies).
+        # **JSON example:**
         # `
         # "bindings": [
         # `
@@ -79,17 +95,21 @@ module Google
         # `,
         # `
         # "role": "roles/resourcemanager.organizationViewer",
-        # "members": ["user:eve@example.com"],
+        # "members": [
+        # "user:eve@example.com"
+        # ],
         # "condition": `
         # "title": "expirable access",
         # "description": "Does not grant access after Sep 2020",
-        # "expression": "request.time <
-        # timestamp('2020-10-01T00:00:00.000Z')",
+        # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')
+        # ",
         # `
         # `
-        # ]
+        # ],
+        # "etag": "BwWWja0YfJA=",
+        # "version": 3
         # `
-        # **YAML Example**
+        # **YAML example:**
         # bindings:
         # - members:
         # - user:mike@example.com
@@ -104,43 +124,48 @@ module Google
         # title: expirable access
         # description: Does not grant access after Sep 2020
         # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+        # - etag: BwWWja0YfJA=
+        # - version: 3
         # For a description of IAM and its features, see the
-        # [IAM developer's guide](https://cloud.google.com/iam/docs).
+        # [IAM documentation](https://cloud.google.com/iam/docs/).
         # Corresponds to the JSON property `iamPolicy`
         # @return [Google::Apis::CloudassetV1::Policy]
         attr_accessor :iam_policy
       
-        # The full name of the asset. For example:
-        # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/
-        # instance1`.
+        # The full name of the asset. Example:
+        # "//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/
+        # instance1"
         # See [Resource
-        # Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
+        # names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
         # for more information.
         # Corresponds to the JSON property `name`
         # @return [String]
         attr_accessor :name
       
-        # Representation of the Cloud Organization Policy set on an asset. For each
-        # asset, there could be multiple Organization policies with different
-        # constraints.
+        # A representation of an [organization
+        # policy](https://cloud.google.com/resource-manager/docs/organization-policy/
+        # overview#organization_policy).
+        # There can be more than one organization policy with different constraints
+        # set on a given resource.
         # Corresponds to the JSON property `orgPolicy`
         # @return [Array<Google::Apis::CloudassetV1::GoogleCloudOrgpolicyV1Policy>]
         attr_accessor :org_policy
       
-        # Representation of a cloud resource.
+        # A representation of a Google Cloud resource.
         # Corresponds to the JSON property `resource`
         # @return [Google::Apis::CloudassetV1::Resource]
         attr_accessor :resource
       
-        # `ServicePerimeter` describes a set of GCP resources which can freely import
-        # and export data amongst themselves, but not export outside of the
+        # `ServicePerimeter` describes a set of Google Cloud resources which can freely
+        # import and export data amongst themselves, but not export outside of the
         # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
         # has a target outside of the `ServicePerimeter`, the request will be blocked.
         # Otherwise the request is allowed. There are two types of Service Perimeter -
-        # Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP
-        # project can only belong to a single regular Service Perimeter. Service
-        # Perimeter Bridges can contain only GCP projects as members, a single GCP
-        # project may belong to multiple Service Perimeter Bridges.
+        # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
+        # Google Cloud project can only belong to a single regular Service Perimeter.
+        # Service Perimeter Bridges can contain only Google Cloud projects as members,
+        # a single Google Cloud project may belong to multiple Service Perimeter
+        # Bridges.
         # Corresponds to the JSON property `servicePerimeter`
         # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1ServicePerimeter]
         attr_accessor :service_perimeter
@@ -305,15 +330,15 @@ module Google
         # Required. The BigQuery dataset in format
         # "projects/projectId/datasets/datasetId", to which the snapshot result
         # should be exported. If this dataset does not exist, the export call returns
-        # an error.
+        # an INVALID_ARGUMENT error.
         # Corresponds to the JSON property `dataset`
         # @return [String]
         attr_accessor :dataset
       
         # If the destination table already exists and this flag is `TRUE`, the
         # table will be overwritten by the contents of assets snapshot. If the flag
-        # is not set and the destination table already exists, the export call
-        # returns an error.
+        # is `FALSE` or unset and the destination table already exists, the export
+        # call returns an INVALID_ARGUMEMT error.
         # Corresponds to the JSON property `force`
         # @return [Boolean]
         attr_accessor :force
@@ -342,10 +367,28 @@ module Google
       class Binding
         include Google::Apis::Core::Hashable
       
-        # Represents an expression text. Example:
-        # title: "User account presence"
-        # description: "Determines whether the request has a user account"
-        # expression: "size(request.user) > 0"
+        # Represents a textual expression in the Common Expression Language (CEL)
+        # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+        # are documented at https://github.com/google/cel-spec.
+        # Example (Comparison):
+        # title: "Summary size limit"
+        # description: "Determines if a summary is less than 100 chars"
+        # expression: "document.summary.size() < 100"
+        # Example (Equality):
+        # title: "Requestor is owner"
+        # description: "Determines if requestor is the document owner"
+        # expression: "document.owner == request.auth.claims.email"
+        # Example (Logic):
+        # title: "Public documents"
+        # description: "Determine whether the document should be publicly visible"
+        # expression: "document.type != 'private' && document.type != 'internal'"
+        # Example (Data Manipulation):
+        # title: "Notification string"
+        # description: "Create a notification string with a timestamp."
+        # expression: "'New message received at ' + string(document.create_time)"
+        # The exact variables and functions that may be referenced within an expression
+        # are determined by the service that evaluates it. See the service
+        # documentation for additional information.
         # Corresponds to the JSON property `condition`
         # @return [Google::Apis::CloudassetV1::Expr]
         attr_accessor :condition
@@ -362,6 +405,23 @@ module Google
         # account. For example, `my-other-app@appspot.gserviceaccount.com`.
         # * `group:`emailid``: An email address that represents a Google group.
         # For example, `admins@example.com`.
+        # * `deleted:user:`emailid`?uid=`uniqueid``: An email address (plus unique
+        # identifier) representing a user that has been recently deleted. For
+        # example, `alice@example.com?uid=123456789012345678901`. If the user is
+        # recovered, this value reverts to `user:`emailid`` and the recovered user
+        # retains the role in the binding.
+        # * `deleted:serviceAccount:`emailid`?uid=`uniqueid``: An email address (plus
+        # unique identifier) representing a service account that has been recently
+        # deleted. For example,
+        # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+        # If the service account is undeleted, this value reverts to
+        # `serviceAccount:`emailid`` and the undeleted service account retains the
+        # role in the binding.
+        # * `deleted:group:`emailid`?uid=`uniqueid``: An email address (plus unique
+        # identifier) representing a Google group that has been recently
+        # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+        # the group is recovered, this value reverts to `group:`emailid`` and the
+        # recovered group retains the role in the binding.
         # * `domain:`domain``: The G Suite domain (primary) that represents all the
         # users of that domain. For example, `google.com` or `example.com`.
         # Corresponds to the JSON property `members`
@@ -386,15 +446,88 @@ module Google
         end
       end
       
+      # Create asset feed request.
+      class CreateFeedRequest
+        include Google::Apis::Core::Hashable
+      
+        # An asset feed used to export asset updates to a destinations.
+        # An asset feed filter controls what updates are exported.
+        # The asset feed must be created within a project, organization, or
+        # folder. Supported destinations are:
+        # Pub/Sub topics.
+        # Corresponds to the JSON property `feed`
+        # @return [Google::Apis::CloudassetV1::Feed]
+        attr_accessor :feed
+      
+        # Required. This is the client-assigned asset feed identifier and it needs to
+        # be unique under a specific parent project/folder/organization.
+        # Corresponds to the JSON property `feedId`
+        # @return [String]
+        attr_accessor :feed_id
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @feed = args[:feed] if args.key?(:feed)
+          @feed_id = args[:feed_id] if args.key?(:feed_id)
+        end
+      end
+      
+      # A generic empty message that you can re-use to avoid defining duplicated
+      # empty messages in your APIs. A typical example is to use it as the request
+      # or the response type of an API method. For instance:
+      # service Foo `
+      # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
+      # `
+      # The JSON representation for `Empty` is empty JSON object ````.
+      class Empty
+        include Google::Apis::Core::Hashable
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+        end
+      end
+      
+      # Explanation about the IAM policy search result.
+      class Explanation
+        include Google::Apis::Core::Hashable
+      
+        # The map from roles to their included permissions that match the
+        # permission query (i.e., a query containing `policy.role.permissions:`).
+        # Example: if query `policy.role.permissions : "compute.disk.get"`
+        # matches a policy binding that contains owner role, the
+        # matched_permissions will be `"roles/owner": ["compute.disk.get"]`. The
+        # roles can also be found in the returned `policy` bindings. Note that the
+        # map is populated only for requests with permission queries.
+        # Corresponds to the JSON property `matchedPermissions`
+        # @return [Hash<String,Google::Apis::CloudassetV1::Permissions>]
+        attr_accessor :matched_permissions
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @matched_permissions = args[:matched_permissions] if args.key?(:matched_permissions)
+        end
+      end
+      
       # Export asset request.
       class ExportAssetsRequest
         include Google::Apis::Core::Hashable
       
-        # A list of asset types of which to take a snapshot for. For example:
+        # A list of asset types of which to take a snapshot for. Example:
         # "compute.googleapis.com/Disk". If specified, only matching assets will be
         # returned. See [Introduction to Cloud Asset
-        # Inventory](https://cloud.google.com/resource-manager/docs/cloud-asset-
-        # inventory/overview)
+        # Inventory](https://cloud.google.com/asset-inventory/docs/overview)
         # for all supported asset types.
         # Corresponds to the JSON property `assetTypes`
         # @return [Array<String>]
@@ -412,10 +545,10 @@ module Google
         attr_accessor :output_config
       
         # Timestamp to take an asset snapshot. This can only be set to a timestamp
-        # between 2018-10-02 UTC (inclusive) and the current time. If not specified,
-        # the current time will be used. Due to delays in resource data collection
-        # and indexing, there is a volatile window during which running the same
-        # query may get different results.
+        # between the current time and the current time minus 35 days (inclusive).
+        # If not specified, the current time will be used. Due to delays in resource
+        # data collection and indexing, there is a volatile window during which
+        # running the same query may get different results.
         # Corresponds to the JSON property `readTime`
         # @return [String]
         attr_accessor :read_time
@@ -433,34 +566,50 @@ module Google
         end
       end
       
-      # Represents an expression text. Example:
-      # title: "User account presence"
-      # description: "Determines whether the request has a user account"
-      # expression: "size(request.user) > 0"
+      # Represents a textual expression in the Common Expression Language (CEL)
+      # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+      # are documented at https://github.com/google/cel-spec.
+      # Example (Comparison):
+      # title: "Summary size limit"
+      # description: "Determines if a summary is less than 100 chars"
+      # expression: "document.summary.size() < 100"
+      # Example (Equality):
+      # title: "Requestor is owner"
+      # description: "Determines if requestor is the document owner"
+      # expression: "document.owner == request.auth.claims.email"
+      # Example (Logic):
+      # title: "Public documents"
+      # description: "Determine whether the document should be publicly visible"
+      # expression: "document.type != 'private' && document.type != 'internal'"
+      # Example (Data Manipulation):
+      # title: "Notification string"
+      # description: "Create a notification string with a timestamp."
+      # expression: "'New message received at ' + string(document.create_time)"
+      # The exact variables and functions that may be referenced within an expression
+      # are determined by the service that evaluates it. See the service
+      # documentation for additional information.
       class Expr
         include Google::Apis::Core::Hashable
       
-        # An optional description of the expression. This is a longer text which
+        # Optional. Description of the expression. This is a longer text which
         # describes the expression, e.g. when hovered over it in a UI.
         # Corresponds to the JSON property `description`
         # @return [String]
         attr_accessor :description
       
-        # Textual representation of an expression in
-        # Common Expression Language syntax.
-        # The application context of the containing message determines which
-        # well-known feature set of CEL is supported.
+        # Textual representation of an expression in Common Expression Language
+        # syntax.
         # Corresponds to the JSON property `expression`
         # @return [String]
         attr_accessor :expression
       
-        # An optional string indicating the location of the expression for error
+        # Optional. String indicating the location of the expression for error
         # reporting, e.g. a file name and a position in the file.
         # Corresponds to the JSON property `location`
         # @return [String]
         attr_accessor :location
       
-        # An optional title for the expression, i.e. a short string describing
+        # Optional. Title for the expression, i.e. a short string describing
         # its purpose. This can be used e.g. in UIs which allow to enter the
         # expression.
         # Corresponds to the JSON property `title`
@@ -480,12 +629,98 @@ module Google
         end
       end
       
+      # An asset feed used to export asset updates to a destinations.
+      # An asset feed filter controls what updates are exported.
+      # The asset feed must be created within a project, organization, or
+      # folder. Supported destinations are:
+      # Pub/Sub topics.
+      class Feed
+        include Google::Apis::Core::Hashable
+      
+        # A list of the full names of the assets to receive updates. You must specify
+        # either or both of asset_names and asset_types. Only asset updates matching
+        # specified asset_names or asset_types are exported to the feed.
+        # Example:
+        # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/
+        # instance1`.
+        # See [Resource
+        # Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
+        # for more info.
+        # Corresponds to the JSON property `assetNames`
+        # @return [Array<String>]
+        attr_accessor :asset_names
+      
+        # A list of types of the assets to receive updates. You must specify either
+        # or both of asset_names and asset_types. Only asset updates matching
+        # specified asset_names or asset_types are exported to the feed.
+        # Example: `"compute.googleapis.com/Disk"`
+        # See [this
+        # topic](https://cloud.google.com/asset-inventory/docs/supported-asset-types)
+        # for a list of all supported asset types.
+        # Corresponds to the JSON property `assetTypes`
+        # @return [Array<String>]
+        attr_accessor :asset_types
+      
+        # Asset content type. If not specified, no content but the asset name and
+        # type will be returned.
+        # Corresponds to the JSON property `contentType`
+        # @return [String]
+        attr_accessor :content_type
+      
+        # Output configuration for asset feed destination.
+        # Corresponds to the JSON property `feedOutputConfig`
+        # @return [Google::Apis::CloudassetV1::FeedOutputConfig]
+        attr_accessor :feed_output_config
+      
+        # Required. The format will be
+        # projects/`project_number`/feeds/`client-assigned_feed_identifier` or
+        # folders/`folder_number`/feeds/`client-assigned_feed_identifier` or
+        # organizations/`organization_number`/feeds/`client-assigned_feed_identifier`
+        # The client-assigned feed identifier must be unique within the parent
+        # project/folder/organization.
+        # Corresponds to the JSON property `name`
+        # @return [String]
+        attr_accessor :name
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @asset_names = args[:asset_names] if args.key?(:asset_names)
+          @asset_types = args[:asset_types] if args.key?(:asset_types)
+          @content_type = args[:content_type] if args.key?(:content_type)
+          @feed_output_config = args[:feed_output_config] if args.key?(:feed_output_config)
+          @name = args[:name] if args.key?(:name)
+        end
+      end
+      
+      # Output configuration for asset feed destination.
+      class FeedOutputConfig
+        include Google::Apis::Core::Hashable
+      
+        # A Pub/Sub destination.
+        # Corresponds to the JSON property `pubsubDestination`
+        # @return [Google::Apis::CloudassetV1::PubsubDestination]
+        attr_accessor :pubsub_destination
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @pubsub_destination = args[:pubsub_destination] if args.key?(:pubsub_destination)
+        end
+      end
+      
       # A Cloud Storage location.
       class GcsDestination
         include Google::Apis::Core::Hashable
       
         # The uri of the Cloud Storage object. It's the same uri that is used by
-        # gsutil. For example: "gs://bucket_name/object_name". See [Viewing and
+        # gsutil. Example: "gs://bucket_name/object_name". See [Viewing and
         # Editing Object
         # Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata)
         # for more information.
@@ -493,10 +728,10 @@ module Google
         # @return [String]
         attr_accessor :uri
       
-        # The uri prefix of all generated Cloud Storage objects. For example:
+        # The uri prefix of all generated Cloud Storage objects. Example:
         # "gs://bucket_name/object_name_prefix". Each object uri is in format:
         # "gs://bucket_name/object_name_prefix/<asset type>/<shard number> and only
-        # contains assets for that type. <shard number> starts from 0. For example:
+        # contains assets for that type. <shard number> starts from 0. Example:
         # "gs://bucket_name/object_name_prefix/compute.googleapis.com/Disk/0" is
         # the first shard of output objects containing all
         # compute.googleapis.com/Disk assets. An INVALID_ARGUMENT error will be
@@ -587,9 +822,9 @@ module Google
       # if the value contains a ":". Values prefixed with "is:" are treated the
       # same as values with no prefix.
       # Ancestry subtrees must be in one of the following formats:
-      # - “projects/<project-id>”, e.g. “projects/tokyo-rain-123”
-      # - “folders/<folder-id>”, e.g. “folders/1234”
-      # - “organizations/<organization-id>”, e.g. “organizations/1234”
+      # - "projects/<project-id>", e.g. "projects/tokyo-rain-123"
+      # - "folders/<folder-id>", e.g. "folders/1234"
+      # - "organizations/<organization-id>", e.g. "organizations/1234"
       # The `supports_under` field of the associated `Constraint`  defines whether
       # ancestry prefixes can be used. You can set `allowed_values` and
       # `denied_values` in the same `Policy` if `all_values` is
@@ -640,16 +875,16 @@ module Google
         # `projects/bar` parented by `organizations/foo`:
         # Example 1 (no inherited values):
         # `organizations/foo` has a `Policy` with values:
-        # `allowed_values: “E1” allowed_values:”E2”`
+        # `allowed_values: "E1" allowed_values:"E2"`
         # `projects/bar` has `inherit_from_parent` `false` and values:
         # `allowed_values: "E3" allowed_values: "E4"`
         # The accepted values at `organizations/foo` are `E1`, `E2`.
         # The accepted values at `projects/bar` are `E3`, and `E4`.
         # Example 2 (inherited values):
         # `organizations/foo` has a `Policy` with values:
-        # `allowed_values: “E1” allowed_values:”E2”`
+        # `allowed_values: "E1" allowed_values:"E2"`
         # `projects/bar` has a `Policy` with values:
-        # `value: “E3” value: ”E4” inherit_from_parent: true`
+        # `value: "E3" value: "E4" inherit_from_parent: true`
         # The accepted values at `organizations/foo` are `E1`, `E2`.
         # The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.
         # Example 3 (inheriting both allowed and denied values):
@@ -661,7 +896,7 @@ module Google
         # The value accepted at `projects/bar` is `E2`.
         # Example 4 (RestoreDefault):
         # `organizations/foo` has a `Policy` with values:
-        # `allowed_values: “E1” allowed_values:”E2”`
+        # `allowed_values: "E1" allowed_values:"E2"`
         # `projects/bar` has a `Policy` with values:
         # `RestoreDefault: ```
         # The accepted values at `organizations/foo` are `E1`, `E2`.
@@ -676,14 +911,14 @@ module Google
         # `DENY`, none).
         # Example 6 (ListConstraint allowing all):
         # `organizations/foo` has a `Policy` with values:
-        # `allowed_values: “E1” allowed_values: ”E2”`
+        # `allowed_values: "E1" allowed_values: "E2"`
         # `projects/bar` has a `Policy` with:
         # `all: ALLOW`
         # The accepted values at `organizations/foo` are `E1`, E2`.
         # Any value is accepted at `projects/bar`.
         # Example 7 (ListConstraint allowing none):
         # `organizations/foo` has a `Policy` with values:
-        # `allowed_values: “E1” allowed_values: ”E2”`
+        # `allowed_values: "E1" allowed_values: "E2"`
         # `projects/bar` has a `Policy` with:
         # `all: DENY`
         # The accepted values at `organizations/foo` are `E1`, E2`.
@@ -774,9 +1009,9 @@ module Google
         # if the value contains a ":". Values prefixed with "is:" are treated the
         # same as values with no prefix.
         # Ancestry subtrees must be in one of the following formats:
-        # - “projects/<project-id>”, e.g. “projects/tokyo-rain-123”
-        # - “folders/<folder-id>”, e.g. “folders/1234”
-        # - “organizations/<organization-id>”, e.g. “organizations/1234”
+        # - "projects/<project-id>", e.g. "projects/tokyo-rain-123"
+        # - "folders/<folder-id>", e.g. "folders/1234"
+        # - "organizations/<organization-id>", e.g. "organizations/1234"
         # The `supports_under` field of the associated `Constraint`  defines whether
         # ancestry prefixes can be used. You can set `allowed_values` and
         # `denied_values` in the same `Policy` if `all_values` is
@@ -854,8 +1089,9 @@ module Google
         end
       end
       
-      # An `AccessLevel` is a label that can be applied to requests to GCP services,
-      # along with a list of requirements necessary for the label to be applied.
+      # An `AccessLevel` is a label that can be applied to requests to Google Cloud
+      # services, along with a list of requirements necessary for the label to be
+      # applied.
       class GoogleIdentityAccesscontextmanagerV1AccessLevel
         include Google::Apis::Core::Hashable
       
@@ -864,10 +1100,12 @@ module Google
         # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1BasicLevel]
         attr_accessor :basic
       
-        # Output only. Time the `AccessLevel` was created in UTC.
-        # Corresponds to the JSON property `createTime`
-        # @return [String]
-        attr_accessor :create_time
+        # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
+        # to represent the necessary conditions for the level to apply to a request.
+        # See CEL spec at: https://github.com/google/cel-spec
+        # Corresponds to the JSON property `custom`
+        # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1CustomLevel]
+        attr_accessor :custom
       
         # Description of the `AccessLevel` and its use. Does not affect behavior.
         # Corresponds to the JSON property `description`
@@ -876,7 +1114,8 @@ module Google
       
         # Required. Resource name for the Access Level. The `short_name` component
         # must begin with a letter and only include alphanumeric and '_'. Format:
-        # `accessPolicies/`policy_id`/accessLevels/`short_name``
+        # `accessPolicies/`policy_id`/accessLevels/`short_name``. The maximum length
+        # of the `short_name` component is 50 characters.
         # Corresponds to the JSON property `name`
         # @return [String]
         attr_accessor :name
@@ -886,11 +1125,6 @@ module Google
         # @return [String]
         attr_accessor :title
       
-        # Output only. Time the `AccessLevel` was updated in UTC.
-        # Corresponds to the JSON property `updateTime`
-        # @return [String]
-        attr_accessor :update_time
-      
         def initialize(**args)
            update!(**args)
         end
@@ -898,26 +1132,28 @@ module Google
         # Update properties of this object
         def update!(**args)
           @basic = args[:basic] if args.key?(:basic)
-          @create_time = args[:create_time] if args.key?(:create_time)
+          @custom = args[:custom] if args.key?(:custom)
           @description = args[:description] if args.key?(:description)
           @name = args[:name] if args.key?(:name)
           @title = args[:title] if args.key?(:title)
-          @update_time = args[:update_time] if args.key?(:update_time)
         end
       end
       
       # `AccessPolicy` is a container for `AccessLevels` (which define the necessary
-      # attributes to use GCP services) and `ServicePerimeters` (which define regions
-      # of services able to freely pass data within a perimeter). An access policy is
-      # globally visible within an organization, and the restrictions it specifies
-      # apply to all projects within an organization.
+      # attributes to use Google Cloud services) and `ServicePerimeters` (which
+      # define regions of services able to freely pass data within a perimeter). An
+      # access policy is globally visible within an organization, and the
+      # restrictions it specifies apply to all projects within an organization.
       class GoogleIdentityAccesscontextmanagerV1AccessPolicy
         include Google::Apis::Core::Hashable
       
-        # Output only. Time the `AccessPolicy` was created in UTC.
-        # Corresponds to the JSON property `createTime`
+        # Output only. An opaque identifier for the current version of the
+        # `AccessPolicy`. This will always be a strongly validated etag, meaning that
+        # two Access Polices will be identical if and only if their etags are
+        # identical. Clients should not expect this to be in any specific format.
+        # Corresponds to the JSON property `etag`
         # @return [String]
-        attr_accessor :create_time
+        attr_accessor :etag
       
         # Output only. Resource name of the `AccessPolicy`. Format:
         # `accessPolicies/`policy_id``
@@ -937,22 +1173,16 @@ module Google
         # @return [String]
         attr_accessor :title
       
-        # Output only. Time the `AccessPolicy` was updated in UTC.
-        # Corresponds to the JSON property `updateTime`
-        # @return [String]
-        attr_accessor :update_time
-      
         def initialize(**args)
            update!(**args)
         end
       
         # Update properties of this object
         def update!(**args)
-          @create_time = args[:create_time] if args.key?(:create_time)
+          @etag = args[:etag] if args.key?(:etag)
           @name = args[:name] if args.key?(:name)
           @parent = args[:parent] if args.key?(:parent)
           @title = args[:title] if args.key?(:title)
-          @update_time = args[:update_time] if args.key?(:update_time)
         end
       end
       
@@ -1066,6 +1296,48 @@ module Google
         end
       end
       
+      # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
+      # to represent the necessary conditions for the level to apply to a request.
+      # See CEL spec at: https://github.com/google/cel-spec
+      class GoogleIdentityAccesscontextmanagerV1CustomLevel
+        include Google::Apis::Core::Hashable
+      
+        # Represents a textual expression in the Common Expression Language (CEL)
+        # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+        # are documented at https://github.com/google/cel-spec.
+        # Example (Comparison):
+        # title: "Summary size limit"
+        # description: "Determines if a summary is less than 100 chars"
+        # expression: "document.summary.size() < 100"
+        # Example (Equality):
+        # title: "Requestor is owner"
+        # description: "Determines if requestor is the document owner"
+        # expression: "document.owner == request.auth.claims.email"
+        # Example (Logic):
+        # title: "Public documents"
+        # description: "Determine whether the document should be publicly visible"
+        # expression: "document.type != 'private' && document.type != 'internal'"
+        # Example (Data Manipulation):
+        # title: "Notification string"
+        # description: "Create a notification string with a timestamp."
+        # expression: "'New message received at ' + string(document.create_time)"
+        # The exact variables and functions that may be referenced within an expression
+        # are determined by the service that evaluates it. See the service
+        # documentation for additional information.
+        # Corresponds to the JSON property `expr`
+        # @return [Google::Apis::CloudassetV1::Expr]
+        attr_accessor :expr
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @expr = args[:expr] if args.key?(:expr)
+        end
+      end
+      
       # `DevicePolicy` specifies device specific restrictions necessary to acquire a
       # given access level. A `DevicePolicy` specifies requirements for requests from
       # devices to be granted access levels, it does not do any enforcement on the
@@ -1146,7 +1418,7 @@ module Google
       
         # Only allows requests from devices with a verified Chrome OS.
         # Verifications includes requirements that the device is enterprise-managed,
-        # conformant to Dasher domain policies, and the caller has permission to call
+        # conformant to domain policies, and the caller has permission to call
         # the API targeted by the request.
         # Corresponds to the JSON property `requireVerifiedChromeOs`
         # @return [Boolean]
@@ -1165,23 +1437,19 @@ module Google
         end
       end
       
-      # `ServicePerimeter` describes a set of GCP resources which can freely import
-      # and export data amongst themselves, but not export outside of the
+      # `ServicePerimeter` describes a set of Google Cloud resources which can freely
+      # import and export data amongst themselves, but not export outside of the
       # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
       # has a target outside of the `ServicePerimeter`, the request will be blocked.
       # Otherwise the request is allowed. There are two types of Service Perimeter -
-      # Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP
-      # project can only belong to a single regular Service Perimeter. Service
-      # Perimeter Bridges can contain only GCP projects as members, a single GCP
-      # project may belong to multiple Service Perimeter Bridges.
+      # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
+      # Google Cloud project can only belong to a single regular Service Perimeter.
+      # Service Perimeter Bridges can contain only Google Cloud projects as members,
+      # a single Google Cloud project may belong to multiple Service Perimeter
+      # Bridges.
       class GoogleIdentityAccesscontextmanagerV1ServicePerimeter
         include Google::Apis::Core::Hashable
       
-        # Output only. Time the `ServicePerimeter` was created in UTC.
-        # Corresponds to the JSON property `createTime`
-        # @return [String]
-        attr_accessor :create_time
-      
         # Description of the `ServicePerimeter` and its use. Does not affect
         # behavior.
         # Corresponds to the JSON property `description`
@@ -1205,8 +1473,14 @@ module Google
         # @return [String]
         attr_accessor :perimeter_type
       
-        # `ServicePerimeterConfig` specifies a set of GCP resources that describe
-        # specific Service Perimeter configuration.
+        # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
+        # describe specific Service Perimeter configuration.
+        # Corresponds to the JSON property `spec`
+        # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1ServicePerimeterConfig]
+        attr_accessor :spec
+      
+        # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
+        # describe specific Service Perimeter configuration.
         # Corresponds to the JSON property `status`
         # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1ServicePerimeterConfig]
         attr_accessor :status
@@ -1216,10 +1490,20 @@ module Google
         # @return [String]
         attr_accessor :title
       
-        # Output only. Time the `ServicePerimeter` was updated in UTC.
-        # Corresponds to the JSON property `updateTime`
-        # @return [String]
-        attr_accessor :update_time
+        # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
+        # exists  for all Service Perimeters, and that spec is identical to the
+        # status for those Service Perimeters. When this flag is set, it inhibits the
+        # generation of the implicit spec, thereby allowing the user to explicitly
+        # provide a configuration ("spec") to use in a dry-run version of the Service
+        # Perimeter. This allows the user to test changes to the enforced config
+        # ("status") without actually enforcing them. This testing is done through
+        # analyzing the differences between currently enforced and suggested
+        # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
+        # fields in the spec are set to non-default values.
+        # Corresponds to the JSON property `useExplicitDryRunSpec`
+        # @return [Boolean]
+        attr_accessor :use_explicit_dry_run_spec
+        alias_method :use_explicit_dry_run_spec?, :use_explicit_dry_run_spec
       
         def initialize(**args)
            update!(**args)
@@ -1227,18 +1511,18 @@ module Google
       
         # Update properties of this object
         def update!(**args)
-          @create_time = args[:create_time] if args.key?(:create_time)
           @description = args[:description] if args.key?(:description)
           @name = args[:name] if args.key?(:name)
           @perimeter_type = args[:perimeter_type] if args.key?(:perimeter_type)
+          @spec = args[:spec] if args.key?(:spec)
           @status = args[:status] if args.key?(:status)
           @title = args[:title] if args.key?(:title)
-          @update_time = args[:update_time] if args.key?(:update_time)
+          @use_explicit_dry_run_spec = args[:use_explicit_dry_run_spec] if args.key?(:use_explicit_dry_run_spec)
         end
       end
       
-      # `ServicePerimeterConfig` specifies a set of GCP resources that describe
-      # specific Service Perimeter configuration.
+      # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
+      # describe specific Service Perimeter configuration.
       class GoogleIdentityAccesscontextmanagerV1ServicePerimeterConfig
         include Google::Apis::Core::Hashable
       
@@ -1246,27 +1530,34 @@ module Google
         # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
         # must be in the same policy as this `ServicePerimeter`. Referencing a
         # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
-        # listed, resources within the perimeter can only be accessed via GCP calls
-        # with request origins within the perimeter. Example:
+        # listed, resources within the perimeter can only be accessed via Google
+        # Cloud calls with request origins within the perimeter. Example:
         # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
         # For Service Perimeter Bridge, must be empty.
         # Corresponds to the JSON property `accessLevels`
         # @return [Array<String>]
         attr_accessor :access_levels
       
-        # A list of GCP resources that are inside of the service perimeter.
+        # A list of Google Cloud resources that are inside of the service perimeter.
         # Currently only projects are allowed. Format: `projects/`project_number``
         # Corresponds to the JSON property `resources`
         # @return [Array<String>]
         attr_accessor :resources
       
-        # GCP services that are subject to the Service Perimeter restrictions. For
-        # example, if `storage.googleapis.com` is specified, access to the storage
-        # buckets inside the perimeter must meet the perimeter's access restrictions.
+        # Google Cloud services that are subject to the Service Perimeter
+        # restrictions. For example, if `storage.googleapis.com` is specified, access
+        # to the storage buckets inside the perimeter must meet the perimeter's
+        # access restrictions.
         # Corresponds to the JSON property `restrictedServices`
         # @return [Array<String>]
         attr_accessor :restricted_services
       
+        # Specifies how APIs are allowed to communicate within the Service
+        # Perimeter.
+        # Corresponds to the JSON property `vpcAccessibleServices`
+        # @return [Google::Apis::CloudassetV1::GoogleIdentityAccesscontextmanagerV1VpcAccessibleServices]
+        attr_accessor :vpc_accessible_services
+      
         def initialize(**args)
            update!(**args)
         end
@@ -1276,6 +1567,166 @@ module Google
           @access_levels = args[:access_levels] if args.key?(:access_levels)
           @resources = args[:resources] if args.key?(:resources)
           @restricted_services = args[:restricted_services] if args.key?(:restricted_services)
+          @vpc_accessible_services = args[:vpc_accessible_services] if args.key?(:vpc_accessible_services)
+        end
+      end
+      
+      # Specifies how APIs are allowed to communicate within the Service
+      # Perimeter.
+      class GoogleIdentityAccesscontextmanagerV1VpcAccessibleServices
+        include Google::Apis::Core::Hashable
+      
+        # The list of APIs usable within the Service Perimeter. Must be empty
+        # unless 'enable_restriction' is True.
+        # Corresponds to the JSON property `allowedServices`
+        # @return [Array<String>]
+        attr_accessor :allowed_services
+      
+        # Whether to restrict API calls within the Service Perimeter to the list of
+        # APIs specified in 'allowed_services'.
+        # Corresponds to the JSON property `enableRestriction`
+        # @return [Boolean]
+        attr_accessor :enable_restriction
+        alias_method :enable_restriction?, :enable_restriction
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @allowed_services = args[:allowed_services] if args.key?(:allowed_services)
+          @enable_restriction = args[:enable_restriction] if args.key?(:enable_restriction)
+        end
+      end
+      
+      # A result of IAM Policy search, containing information of an IAM policy.
+      class IamPolicySearchResult
+        include Google::Apis::Core::Hashable
+      
+        # Explanation about the IAM policy search result.
+        # Corresponds to the JSON property `explanation`
+        # @return [Google::Apis::CloudassetV1::Explanation]
+        attr_accessor :explanation
+      
+        # An Identity and Access Management (IAM) policy, which specifies access
+        # controls for Google Cloud resources.
+        # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+        # `members` to a single `role`. Members can be user accounts, service accounts,
+        # Google groups, and domains (such as G Suite). A `role` is a named list of
+        # permissions; each `role` can be an IAM predefined role or a user-created
+        # custom role.
+        # For some types of Google Cloud resources, a `binding` can also specify a
+        # `condition`, which is a logical expression that allows access to a resource
+        # only if the expression evaluates to `true`. A condition can add constraints
+        # based on attributes of the request, the resource, or both. To learn which
+        # resources support conditions in their IAM policies, see the
+        # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-
+        # policies).
+        # **JSON example:**
+        # `
+        # "bindings": [
+        # `
+        # "role": "roles/resourcemanager.organizationAdmin",
+        # "members": [
+        # "user:mike@example.com",
+        # "group:admins@example.com",
+        # "domain:google.com",
+        # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+        # ]
+        # `,
+        # `
+        # "role": "roles/resourcemanager.organizationViewer",
+        # "members": [
+        # "user:eve@example.com"
+        # ],
+        # "condition": `
+        # "title": "expirable access",
+        # "description": "Does not grant access after Sep 2020",
+        # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')
+        # ",
+        # `
+        # `
+        # ],
+        # "etag": "BwWWja0YfJA=",
+        # "version": 3
+        # `
+        # **YAML example:**
+        # bindings:
+        # - members:
+        # - user:mike@example.com
+        # - group:admins@example.com
+        # - domain:google.com
+        # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+        # role: roles/resourcemanager.organizationAdmin
+        # - members:
+        # - user:eve@example.com
+        # role: roles/resourcemanager.organizationViewer
+        # condition:
+        # title: expirable access
+        # description: Does not grant access after Sep 2020
+        # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+        # - etag: BwWWja0YfJA=
+        # - version: 3
+        # For a description of IAM and its features, see the
+        # [IAM documentation](https://cloud.google.com/iam/docs/).
+        # Corresponds to the JSON property `policy`
+        # @return [Google::Apis::CloudassetV1::Policy]
+        attr_accessor :policy
+      
+        # The project that the associated GCP resource belongs to, in the form of
+        # projects/`PROJECT_NUMBER`. If an IAM policy is set on a resource (like VM
+        # instance, Cloud Storage bucket), the project field will indicate the
+        # project that contains the resource. If an IAM policy is set on a folder or
+        # orgnization, the project field will be empty.
+        # To search against the `project`:
+        # * specify the `scope` field as this project in your search request.
+        # Corresponds to the JSON property `project`
+        # @return [String]
+        attr_accessor :project
+      
+        # The full resource name of the resource associated with this IAM policy.
+        # Example:
+        # "//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/
+        # instance1".
+        # See [Cloud Asset Inventory Resource Name
+        # Format](https://cloud.google.com/asset-inventory/docs/resource-name-format)
+        # for more information.
+        # To search against the `resource`:
+        # * use a field query. Example: `resource : "organizations/123"`
+        # Corresponds to the JSON property `resource`
+        # @return [String]
+        attr_accessor :resource
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @explanation = args[:explanation] if args.key?(:explanation)
+          @policy = args[:policy] if args.key?(:policy)
+          @project = args[:project] if args.key?(:project)
+          @resource = args[:resource] if args.key?(:resource)
+        end
+      end
+      
+      # 
+      class ListFeedsResponse
+        include Google::Apis::Core::Hashable
+      
+        # A list of feeds.
+        # Corresponds to the JSON property `feeds`
+        # @return [Array<Google::Apis::CloudassetV1::Feed>]
+        attr_accessor :feeds
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @feeds = args[:feeds] if args.key?(:feeds)
         end
       end
       
@@ -1368,16 +1819,40 @@ module Google
         end
       end
       
-      # Defines an Identity and Access Management (IAM) policy. It is used to
-      # specify access control policies for Cloud Platform resources.
+      # IAM permissions
+      class Permissions
+        include Google::Apis::Core::Hashable
+      
+        # A list of permissions. A sample permission string: "compute.disk.get".
+        # Corresponds to the JSON property `permissions`
+        # @return [Array<String>]
+        attr_accessor :permissions
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @permissions = args[:permissions] if args.key?(:permissions)
+        end
+      end
+      
+      # An Identity and Access Management (IAM) policy, which specifies access
+      # controls for Google Cloud resources.
       # A `Policy` is a collection of `bindings`. A `binding` binds one or more
       # `members` to a single `role`. Members can be user accounts, service accounts,
       # Google groups, and domains (such as G Suite). A `role` is a named list of
-      # permissions (defined by IAM or configured by users). A `binding` can
-      # optionally specify a `condition`, which is a logic expression that further
-      # constrains the role binding based on attributes about the request and/or
-      # target resource.
-      # **JSON Example**
+      # permissions; each `role` can be an IAM predefined role or a user-created
+      # custom role.
+      # For some types of Google Cloud resources, a `binding` can also specify a
+      # `condition`, which is a logical expression that allows access to a resource
+      # only if the expression evaluates to `true`. A condition can add constraints
+      # based on attributes of the request, the resource, or both. To learn which
+      # resources support conditions in their IAM policies, see the
+      # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-
+      # policies).
+      # **JSON example:**
       # `
       # "bindings": [
       # `
@@ -1391,17 +1866,21 @@ module Google
       # `,
       # `
       # "role": "roles/resourcemanager.organizationViewer",
-      # "members": ["user:eve@example.com"],
+      # "members": [
+      # "user:eve@example.com"
+      # ],
       # "condition": `
       # "title": "expirable access",
       # "description": "Does not grant access after Sep 2020",
-      # "expression": "request.time <
-      # timestamp('2020-10-01T00:00:00.000Z')",
+      # "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')
+      # ",
       # `
       # `
-      # ]
+      # ],
+      # "etag": "BwWWja0YfJA=",
+      # "version": 3
       # `
-      # **YAML Example**
+      # **YAML example:**
       # bindings:
       # - members:
       # - user:mike@example.com
@@ -1416,8 +1895,10 @@ module Google
       # title: expirable access
       # description: Does not grant access after Sep 2020
       # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+      # - etag: BwWWja0YfJA=
+      # - version: 3
       # For a description of IAM and its features, see the
-      # [IAM developer's guide](https://cloud.google.com/iam/docs).
+      # [IAM documentation](https://cloud.google.com/iam/docs/).
       class Policy
         include Google::Apis::Core::Hashable
       
@@ -1426,9 +1907,9 @@ module Google
         # @return [Array<Google::Apis::CloudassetV1::AuditConfig>]
         attr_accessor :audit_configs
       
-        # Associates a list of `members` to a `role`. Optionally may specify a
-        # `condition` that determines when binding is in effect.
-        # `bindings` with no members will result in an error.
+        # Associates a list of `members` to a `role`. Optionally, may specify a
+        # `condition` that determines how and when the `bindings` are applied. Each
+        # of the `bindings` must contain at least one member.
         # Corresponds to the JSON property `bindings`
         # @return [Array<Google::Apis::CloudassetV1::Binding>]
         attr_accessor :bindings
@@ -1440,25 +1921,34 @@ module Google
         # conditions: An `etag` is returned in the response to `getIamPolicy`, and
         # systems are expected to put that etag in the request to `setIamPolicy` to
         # ensure that their change will be applied to the same version of the policy.
-        # If no `etag` is provided in the call to `setIamPolicy`, then the existing
-        # policy is overwritten. Due to blind-set semantics of an etag-less policy,
-        # 'setIamPolicy' will not fail even if either of incoming or stored policy
-        # does not meet the version requirements.
+        # **Important:** If you use IAM Conditions, you must include the `etag` field
+        # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+        # you to overwrite a version `3` policy with a version `1` policy, and all of
+        # the conditions in the version `3` policy are lost.
         # Corresponds to the JSON property `etag`
         # NOTE: Values are automatically base64 encoded/decoded in the client library.
         # @return [String]
         attr_accessor :etag
       
         # Specifies the format of the policy.
-        # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
-        # rejected.
-        # Operations affecting conditional bindings must specify version 3. This can
-        # be either setting a conditional policy, modifying a conditional binding,
-        # or removing a conditional binding from the stored conditional policy.
-        # Operations on non-conditional policies may specify any valid value or
-        # leave the field unset.
-        # If no etag is provided in the call to `setIamPolicy`, any version
-        # compliance checks on the incoming and/or stored policy is skipped.
+        # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
+        # are rejected.
+        # Any operation that affects conditional role bindings must specify version
+        # `3`. This requirement applies to the following operations:
+        # * Getting a policy that includes a conditional role binding
+        # * Adding a conditional role binding to a policy
+        # * Changing a conditional role binding in a policy
+        # * Removing any role binding, with or without a condition, from a policy
+        # that includes conditions
+        # **Important:** If you use IAM Conditions, you must include the `etag` field
+        # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+        # you to overwrite a version `3` policy with a version `1` policy, and all of
+        # the conditions in the version `3` policy are lost.
+        # If a policy does not include any conditions, operations on that policy may
+        # specify any valid version or leave the field unset.
+        # To learn which resources support conditions in their IAM policies, see the
+        # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-
+        # policies).
         # Corresponds to the JSON property `version`
         # @return [Fixnum]
         attr_accessor :version
@@ -1476,55 +1966,82 @@ module Google
         end
       end
       
-      # Representation of a cloud resource.
+      # A Pub/Sub destination.
+      class PubsubDestination
+        include Google::Apis::Core::Hashable
+      
+        # The name of the Pub/Sub topic to publish to.
+        # Example: `projects/PROJECT_ID/topics/TOPIC_ID`.
+        # Corresponds to the JSON property `topic`
+        # @return [String]
+        attr_accessor :topic
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @topic = args[:topic] if args.key?(:topic)
+        end
+      end
+      
+      # A representation of a Google Cloud resource.
       class Resource
         include Google::Apis::Core::Hashable
       
-        # The content of the resource, in which some sensitive fields are scrubbed
-        # away and may not be present.
+        # The content of the resource, in which some sensitive fields are removed
+        # and may not be present.
         # Corresponds to the JSON property `data`
         # @return [Hash<String,Object>]
         attr_accessor :data
       
         # The URL of the discovery document containing the resource's JSON schema.
-        # For example:
-        # `"https://www.googleapis.com/discovery/v1/apis/compute/v1/rest"`.
-        # It will be left unspecified for resources without a discovery-based API,
-        # such as Cloud Bigtable.
+        # Example:
+        # "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest"
+        # This value is unspecified for resources that do not have an API based on a
+        # discovery document, such as Cloud Bigtable.
         # Corresponds to the JSON property `discoveryDocumentUri`
         # @return [String]
         attr_accessor :discovery_document_uri
       
-        # The JSON schema name listed in the discovery document.
-        # Example: "Project". It will be left unspecified for resources (such as
-        # Cloud Bigtable) without a discovery-based API.
+        # The JSON schema name listed in the discovery document. Example:
+        # "Project"
+        # This value is unspecified for resources that do not have an API based on a
+        # discovery document, such as Cloud Bigtable.
         # Corresponds to the JSON property `discoveryName`
         # @return [String]
         attr_accessor :discovery_name
       
+        # The location of the resource in Google Cloud, such as its zone and region.
+        # For more information, see https://cloud.google.com/about/locations/.
+        # Corresponds to the JSON property `location`
+        # @return [String]
+        attr_accessor :location
+      
         # The full name of the immediate parent of this resource. See
         # [Resource
         # Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
         # for more information.
-        # For GCP assets, it is the parent resource defined in the [Cloud IAM policy
+        # For Google Cloud assets, this value is the parent resource defined in the
+        # [Cloud IAM policy
         # hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy).
-        # For example:
-        # `"//cloudresourcemanager.googleapis.com/projects/my_project_123"`.
-        # For third-party assets, it is up to the users to define.
+        # Example:
+        # "//cloudresourcemanager.googleapis.com/projects/my_project_123"
+        # For third-party assets, this field may be set differently.
         # Corresponds to the JSON property `parent`
         # @return [String]
         attr_accessor :parent
       
-        # The REST URL for accessing the resource. An HTTP GET operation using this
-        # URL returns the resource itself.
-        # Example:
-        # `https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123`.
-        # It will be left unspecified for resources without a REST API.
+        # The REST URL for accessing the resource. An HTTP `GET` request using this
+        # URL returns the resource itself. Example:
+        # "https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123"
+        # This value is unspecified for resources without a REST API.
         # Corresponds to the JSON property `resourceUrl`
         # @return [String]
         attr_accessor :resource_url
       
-        # The API version. Example: "v1".
+        # The API version. Example: "v1"
         # Corresponds to the JSON property `version`
         # @return [String]
         attr_accessor :version
@@ -1538,12 +2055,182 @@ module Google
           @data = args[:data] if args.key?(:data)
           @discovery_document_uri = args[:discovery_document_uri] if args.key?(:discovery_document_uri)
           @discovery_name = args[:discovery_name] if args.key?(:discovery_name)
+          @location = args[:location] if args.key?(:location)
           @parent = args[:parent] if args.key?(:parent)
           @resource_url = args[:resource_url] if args.key?(:resource_url)
           @version = args[:version] if args.key?(:version)
         end
       end
       
+      # A result of Resource Search, containing information of a cloud resoure.
+      class ResourceSearchResult
+        include Google::Apis::Core::Hashable
+      
+        # The additional attributes of this resource. The attributes may vary from
+        # one resource type to another. Examples: "projectId" for Project,
+        # "dnsName" for DNS ManagedZone.
+        # To search against the `additional_attributes`:
+        # * use a free text query to match the attributes values. Example: to search
+        # additional_attributes = ` dnsName: "foobar" `, you can issue a query
+        # `"foobar"`.
+        # Corresponds to the JSON property `additionalAttributes`
+        # @return [Hash<String,Object>]
+        attr_accessor :additional_attributes
+      
+        # The type of this resource. Example: "compute.googleapis.com/Disk".
+        # To search against the `asset_type`:
+        # * specify the `asset_type` field in your search request.
+        # Corresponds to the JSON property `assetType`
+        # @return [String]
+        attr_accessor :asset_type
+      
+        # One or more paragraphs of text description of this resource. Maximum length
+        # could be up to 1M bytes.
+        # To search against the `description`:
+        # * use a field query. Example: `description : "*important instance*"`
+        # * use a free text query. Example: `"*important instance*"`
+        # Corresponds to the JSON property `description`
+        # @return [String]
+        attr_accessor :description
+      
+        # The display name of this resource.
+        # To search against the `display_name`:
+        # * use a field query. Example: `displayName : "My Instance"`
+        # * use a free text query. Example: `"My Instance"`
+        # Corresponds to the JSON property `displayName`
+        # @return [String]
+        attr_accessor :display_name
+      
+        # Labels associated with this resource. See [Labelling and grouping GCP
+        # resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-
+        # your-google-cloud-platform-resources)
+        # for more information.
+        # To search against the `labels`:
+        # * use a field query, as following:
+        # - query on any label's key or value. Example: `labels : "prod"`
+        # - query by a given label. Example: `labels.env : "prod"`
+        # - query by a given label'sexistence. Example: `labels.env : *`
+        # * use a free text query. Example: `"prod"`
+        # Corresponds to the JSON property `labels`
+        # @return [Hash<String,String>]
+        attr_accessor :labels
+      
+        # Location can be "global", regional like "us-east1", or zonal like
+        # "us-west1-b".
+        # To search against the `location`:
+        # * use a field query. Example: `location : "us-west*"`
+        # * use a free text query. Example: `"us-west*"`
+        # Corresponds to the JSON property `location`
+        # @return [String]
+        attr_accessor :location
+      
+        # The full resource name of this resource. Example:
+        # "//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/
+        # instance1".
+        # See [Cloud Asset Inventory Resource Name
+        # Format](https://cloud.google.com/asset-inventory/docs/resource-name-format)
+        # for more information.
+        # To search against the `name`:
+        # * use a field query. Example: `name : "instance1"`
+        # * use a free text query. Example: `"instance1"`
+        # Corresponds to the JSON property `name`
+        # @return [String]
+        attr_accessor :name
+      
+        # Network tags associated with this resource. Like labels, network tags are a
+        # type of annotations used to group GCP resources. See [Labelling GCP
+        # resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-
+        # your-google-cloud-platform-resources)
+        # for more information.
+        # To search against the `network_tags`:
+        # * use a field query. Example: `networkTags : "internal"`
+        # * use a free text query. Example: `"internal"`
+        # Corresponds to the JSON property `networkTags`
+        # @return [Array<String>]
+        attr_accessor :network_tags
+      
+        # The project that this resource belongs to, in the form of
+        # projects/`PROJECT_NUMBER`.
+        # To search against the `project`:
+        # * specify the `scope` field as this project in your search request.
+        # Corresponds to the JSON property `project`
+        # @return [String]
+        attr_accessor :project
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @additional_attributes = args[:additional_attributes] if args.key?(:additional_attributes)
+          @asset_type = args[:asset_type] if args.key?(:asset_type)
+          @description = args[:description] if args.key?(:description)
+          @display_name = args[:display_name] if args.key?(:display_name)
+          @labels = args[:labels] if args.key?(:labels)
+          @location = args[:location] if args.key?(:location)
+          @name = args[:name] if args.key?(:name)
+          @network_tags = args[:network_tags] if args.key?(:network_tags)
+          @project = args[:project] if args.key?(:project)
+        end
+      end
+      
+      # Search all IAM policies response.
+      class SearchAllIamPoliciesResponse
+        include Google::Apis::Core::Hashable
+      
+        # Set if there are more results than those appearing in this response; to get
+        # the next set of results, call this method again, using this value as the
+        # `page_token`.
+        # Corresponds to the JSON property `nextPageToken`
+        # @return [String]
+        attr_accessor :next_page_token
+      
+        # A list of IamPolicy that match the search query. Related information such
+        # as the associated resource is returned along with the policy.
+        # Corresponds to the JSON property `results`
+        # @return [Array<Google::Apis::CloudassetV1::IamPolicySearchResult>]
+        attr_accessor :results
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @next_page_token = args[:next_page_token] if args.key?(:next_page_token)
+          @results = args[:results] if args.key?(:results)
+        end
+      end
+      
+      # Search all resources response.
+      class SearchAllResourcesResponse
+        include Google::Apis::Core::Hashable
+      
+        # If there are more results than those appearing in this response, then
+        # `next_page_token` is included. To get the next set of results, call this
+        # method again using the value of `next_page_token` as `page_token`.
+        # Corresponds to the JSON property `nextPageToken`
+        # @return [String]
+        attr_accessor :next_page_token
+      
+        # A list of Resources that match the search query. It contains the resource
+        # standard metadata information.
+        # Corresponds to the JSON property `results`
+        # @return [Array<Google::Apis::CloudassetV1::ResourceSearchResult>]
+        attr_accessor :results
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @next_page_token = args[:next_page_token] if args.key?(:next_page_token)
+          @results = args[:results] if args.key?(:results)
+        end
+      end
+      
       # The `Status` type defines a logical error model that is suitable for
       # different programming environments, including REST APIs and RPC APIs. It is
       # used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -1583,24 +2270,28 @@ module Google
         end
       end
       
-      # Temporal asset. In addition to the asset, the temporal asset includes the
-      # status of the asset and valid from and to time of it.
+      # An asset in Google Cloud and its temporal metadata, including the time window
+      # when it was observed and its status during that window.
       class TemporalAsset
         include Google::Apis::Core::Hashable
       
-        # Cloud asset. This includes all Google Cloud Platform resources,
-        # Cloud IAM policies, and other non-GCP assets.
+        # An asset in Google Cloud. An asset can be any resource in the Google Cloud
+        # [resource
+        # hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-
+        # resource-hierarchy),
+        # a resource outside the Google Cloud resource hierarchy (such as Google
+        # Kubernetes Engine clusters and objects), or a Cloud IAM policy.
         # Corresponds to the JSON property `asset`
         # @return [Google::Apis::CloudassetV1::Asset]
         attr_accessor :asset
       
-        # If the asset is deleted or not.
+        # Whether the asset has been deleted or not.
         # Corresponds to the JSON property `deleted`
         # @return [Boolean]
         attr_accessor :deleted
         alias_method :deleted?, :deleted
       
-        # A time window of (start_time, end_time].
+        # A time window specified by its "start_time" and "end_time".
         # Corresponds to the JSON property `window`
         # @return [Google::Apis::CloudassetV1::TimeWindow]
         attr_accessor :window
@@ -1617,12 +2308,12 @@ module Google
         end
       end
       
-      # A time window of (start_time, end_time].
+      # A time window specified by its "start_time" and "end_time".
       class TimeWindow
         include Google::Apis::Core::Hashable
       
-        # End time of the time window (inclusive).
-        # Current timestamp if not specified.
+        # End time of the time window (inclusive). If not specified, the current
+        # timestamp is used instead.
         # Corresponds to the JSON property `endTime`
         # @return [String]
         attr_accessor :end_time
@@ -1642,6 +2333,37 @@ module Google
           @start_time = args[:start_time] if args.key?(:start_time)
         end
       end
+      
+      # Update asset feed request.
+      class UpdateFeedRequest
+        include Google::Apis::Core::Hashable
+      
+        # An asset feed used to export asset updates to a destinations.
+        # An asset feed filter controls what updates are exported.
+        # The asset feed must be created within a project, organization, or
+        # folder. Supported destinations are:
+        # Pub/Sub topics.
+        # Corresponds to the JSON property `feed`
+        # @return [Google::Apis::CloudassetV1::Feed]
+        attr_accessor :feed
+      
+        # Required. Only updates the `feed` fields indicated by this mask.
+        # The field mask must not be empty, and it must not contain fields that
+        # are immutable or only set by the server.
+        # Corresponds to the JSON property `updateMask`
+        # @return [String]
+        attr_accessor :update_mask
+      
+        def initialize(**args)
+           update!(**args)
+        end
+      
+        # Update properties of this object
+        def update!(**args)
+          @feed = args[:feed] if args.key?(:feed)
+          @update_mask = args[:update_mask] if args.key?(:update_mask)
+        end
+      end
     end
   end
 end