google-cloud-asset-v1 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,84 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2020 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Identity
22
+ module AccessContextManager
23
+ module Type
24
+ # The encryption state of the device.
25
+ module DeviceEncryptionStatus
26
+ # The encryption status of the device is not specified or not known.
27
+ ENCRYPTION_UNSPECIFIED = 0
28
+
29
+ # The device does not support encryption.
30
+ ENCRYPTION_UNSUPPORTED = 1
31
+
32
+ # The device supports encryption, but is currently unencrypted.
33
+ UNENCRYPTED = 2
34
+
35
+ # The device is encrypted.
36
+ ENCRYPTED = 3
37
+ end
38
+
39
+ # The operating system type of the device.
40
+ # Next id: 7
41
+ module OsType
42
+ # The operating system of the device is not specified or not known.
43
+ OS_UNSPECIFIED = 0
44
+
45
+ # A desktop Mac operating system.
46
+ DESKTOP_MAC = 1
47
+
48
+ # A desktop Windows operating system.
49
+ DESKTOP_WINDOWS = 2
50
+
51
+ # A desktop Linux operating system.
52
+ DESKTOP_LINUX = 3
53
+
54
+ # A desktop ChromeOS operating system.
55
+ DESKTOP_CHROME_OS = 6
56
+
57
+ # An Android operating system.
58
+ ANDROID = 4
59
+
60
+ # An iOS operating system.
61
+ IOS = 5
62
+ end
63
+
64
+ # The degree to which the device is managed by the Cloud organization.
65
+ module DeviceManagementLevel
66
+ # The device's management level is not specified or not known.
67
+ MANAGEMENT_UNSPECIFIED = 0
68
+
69
+ # The device is not managed.
70
+ NONE = 1
71
+
72
+ # Basic management is enabled, which is generally limited to monitoring and
73
+ # wiping the corporate account.
74
+ BASIC = 2
75
+
76
+ # Complete device management. This includes more thorough monitoring and the
77
+ # ability to directly manage the device (such as remote wiping). This can be
78
+ # enabled through the Android Enterprise Platform.
79
+ COMPLETE = 3
80
+ end
81
+ end
82
+ end
83
+ end
84
+ end
@@ -0,0 +1,197 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2020 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Identity
22
+ module AccessContextManager
23
+ module V1
24
+ # An `AccessLevel` is a label that can be applied to requests to Google Cloud
25
+ # services, along with a list of requirements necessary for the label to be
26
+ # applied.
27
+ # @!attribute [rw] name
28
+ # @return [String]
29
+ # Required. Resource name for the Access Level. The `short_name` component
30
+ # must begin with a letter and only include alphanumeric and '_'. Format:
31
+ # `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length
32
+ # of the `short_name` component is 50 characters.
33
+ # @!attribute [rw] title
34
+ # @return [String]
35
+ # Human readable title. Must be unique within the Policy.
36
+ # @!attribute [rw] description
37
+ # @return [String]
38
+ # Description of the `AccessLevel` and its use. Does not affect behavior.
39
+ # @!attribute [rw] basic
40
+ # @return [Google::Identity::AccessContextManager::V1::BasicLevel]
41
+ # A `BasicLevel` composed of `Conditions`.
42
+ # @!attribute [rw] custom
43
+ # @return [Google::Identity::AccessContextManager::V1::CustomLevel]
44
+ # A `CustomLevel` written in the Common Expression Language.
45
+ # @!attribute [rw] create_time
46
+ # @return [Google::Protobuf::Timestamp]
47
+ # Output only. Time the `AccessLevel` was created in UTC.
48
+ # @!attribute [rw] update_time
49
+ # @return [Google::Protobuf::Timestamp]
50
+ # Output only. Time the `AccessLevel` was updated in UTC.
51
+ class AccessLevel
52
+ include Google::Protobuf::MessageExts
53
+ extend Google::Protobuf::MessageExts::ClassMethods
54
+ end
55
+
56
+ # `BasicLevel` is an `AccessLevel` using a set of recommended features.
57
+ # @!attribute [rw] conditions
58
+ # @return [Array<Google::Identity::AccessContextManager::V1::Condition>]
59
+ # Required. A list of requirements for the `AccessLevel` to be granted.
60
+ # @!attribute [rw] combining_function
61
+ # @return [Google::Identity::AccessContextManager::V1::BasicLevel::ConditionCombiningFunction]
62
+ # How the `conditions` list should be combined to determine if a request is
63
+ # granted this `AccessLevel`. If AND is used, each `Condition` in
64
+ # `conditions` must be satisfied for the `AccessLevel` to be applied. If OR
65
+ # is used, at least one `Condition` in `conditions` must be satisfied for the
66
+ # `AccessLevel` to be applied. Default behavior is AND.
67
+ class BasicLevel
68
+ include Google::Protobuf::MessageExts
69
+ extend Google::Protobuf::MessageExts::ClassMethods
70
+
71
+ # Options for how the `conditions` list should be combined to determine if
72
+ # this `AccessLevel` is applied. Default is AND.
73
+ module ConditionCombiningFunction
74
+ # All `Conditions` must be true for the `BasicLevel` to be true.
75
+ AND = 0
76
+
77
+ # If at least one `Condition` is true, then the `BasicLevel` is true.
78
+ OR = 1
79
+ end
80
+ end
81
+
82
+ # A condition necessary for an `AccessLevel` to be granted. The Condition is an
83
+ # AND over its fields. So a Condition is true if: 1) the request IP is from one
84
+ # of the listed subnetworks AND 2) the originating device complies with the
85
+ # listed device policy AND 3) all listed access levels are granted AND 4) the
86
+ # request was sent at a time allowed by the DateTimeRestriction.
87
+ # @!attribute [rw] ip_subnetworks
88
+ # @return [Array<String>]
89
+ # CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for
90
+ # a CIDR IP address block, the specified IP address portion must be properly
91
+ # truncated (i.e. all the host bits must be zero) or the input is considered
92
+ # malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is
93
+ # not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas
94
+ # "2001:db8::1/32" is not. The originating IP of a request must be in one of
95
+ # the listed subnets in order for this Condition to be true. If empty, all IP
96
+ # addresses are allowed.
97
+ # @!attribute [rw] device_policy
98
+ # @return [Google::Identity::AccessContextManager::V1::DevicePolicy]
99
+ # Device specific restrictions, all restrictions must hold for the
100
+ # Condition to be true. If not specified, all devices are allowed.
101
+ # @!attribute [rw] required_access_levels
102
+ # @return [Array<String>]
103
+ # A list of other access levels defined in the same `Policy`, referenced by
104
+ # resource name. Referencing an `AccessLevel` which does not exist is an
105
+ # error. All access levels listed must be granted for the Condition
106
+ # to be true. Example:
107
+ # "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
108
+ # @!attribute [rw] negate
109
+ # @return [Boolean]
110
+ # Whether to negate the Condition. If true, the Condition becomes a NAND over
111
+ # its non-empty fields, each field must be false for the Condition overall to
112
+ # be satisfied. Defaults to false.
113
+ # @!attribute [rw] members
114
+ # @return [Array<String>]
115
+ # The request must be made by one of the provided user or service
116
+ # accounts. Groups are not supported.
117
+ # Syntax:
118
+ # `user:{emailid}`
119
+ # `serviceAccount:{emailid}`
120
+ # If not specified, a request may come from any user.
121
+ # @!attribute [rw] regions
122
+ # @return [Array<String>]
123
+ # The request must originate from one of the provided countries/regions.
124
+ # Must be valid ISO 3166-1 alpha-2 codes.
125
+ class Condition
126
+ include Google::Protobuf::MessageExts
127
+ extend Google::Protobuf::MessageExts::ClassMethods
128
+ end
129
+
130
+ # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
131
+ # to represent the necessary conditions for the level to apply to a request.
132
+ # See CEL spec at: https://github.com/google/cel-spec
133
+ # @!attribute [rw] expr
134
+ # @return [Google::Type::Expr]
135
+ # Required. A Cloud CEL expression evaluating to a boolean.
136
+ class CustomLevel
137
+ include Google::Protobuf::MessageExts
138
+ extend Google::Protobuf::MessageExts::ClassMethods
139
+ end
140
+
141
+ # `DevicePolicy` specifies device specific restrictions necessary to acquire a
142
+ # given access level. A `DevicePolicy` specifies requirements for requests from
143
+ # devices to be granted access levels, it does not do any enforcement on the
144
+ # device. `DevicePolicy` acts as an AND over all specified fields, and each
145
+ # repeated field is an OR over its elements. Any unset fields are ignored. For
146
+ # example, if the proto is { os_type : DESKTOP_WINDOWS, os_type :
147
+ # DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be
148
+ # true for requests originating from encrypted Linux desktops and encrypted
149
+ # Windows desktops.
150
+ # @!attribute [rw] require_screenlock
151
+ # @return [Boolean]
152
+ # Whether or not screenlock is required for the DevicePolicy to be true.
153
+ # Defaults to `false`.
154
+ # @!attribute [rw] allowed_encryption_statuses
155
+ # @return [Array<Google::Identity::AccessContextManager::Type::DeviceEncryptionStatus>]
156
+ # Allowed encryptions statuses, an empty list allows all statuses.
157
+ # @!attribute [rw] os_constraints
158
+ # @return [Array<Google::Identity::AccessContextManager::V1::OsConstraint>]
159
+ # Allowed OS versions, an empty list allows all types and all versions.
160
+ # @!attribute [rw] allowed_device_management_levels
161
+ # @return [Array<Google::Identity::AccessContextManager::Type::DeviceManagementLevel>]
162
+ # Allowed device management levels, an empty list allows all management
163
+ # levels.
164
+ # @!attribute [rw] require_admin_approval
165
+ # @return [Boolean]
166
+ # Whether the device needs to be approved by the customer admin.
167
+ # @!attribute [rw] require_corp_owned
168
+ # @return [Boolean]
169
+ # Whether the device needs to be corp owned.
170
+ class DevicePolicy
171
+ include Google::Protobuf::MessageExts
172
+ extend Google::Protobuf::MessageExts::ClassMethods
173
+ end
174
+
175
+ # A restriction on the OS type and version of devices making requests.
176
+ # @!attribute [rw] os_type
177
+ # @return [Google::Identity::AccessContextManager::Type::OsType]
178
+ # Required. The allowed OS type.
179
+ # @!attribute [rw] minimum_version
180
+ # @return [String]
181
+ # The minimum allowed OS version. If not set, any version of this OS
182
+ # satisfies the constraint. Format: `"major.minor.patch"`.
183
+ # Examples: `"10.5.301"`, `"9.2.1"`.
184
+ # @!attribute [rw] require_verified_chrome_os
185
+ # @return [Boolean]
186
+ # Only allows requests from devices with a verified Chrome OS.
187
+ # Verifications includes requirements that the device is enterprise-managed,
188
+ # conformant to domain policies, and the caller has permission to call
189
+ # the API targeted by the request.
190
+ class OsConstraint
191
+ include Google::Protobuf::MessageExts
192
+ extend Google::Protobuf::MessageExts::ClassMethods
193
+ end
194
+ end
195
+ end
196
+ end
197
+ end
@@ -0,0 +1,60 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2020 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Identity
22
+ module AccessContextManager
23
+ module V1
24
+ # `AccessPolicy` is a container for `AccessLevels` (which define the necessary
25
+ # attributes to use Google Cloud services) and `ServicePerimeters` (which
26
+ # define regions of services able to freely pass data within a perimeter). An
27
+ # access policy is globally visible within an organization, and the
28
+ # restrictions it specifies apply to all projects within an organization.
29
+ # @!attribute [rw] name
30
+ # @return [String]
31
+ # Output only. Resource name of the `AccessPolicy`. Format:
32
+ # `accessPolicies/{policy_id}`
33
+ # @!attribute [rw] parent
34
+ # @return [String]
35
+ # Required. The parent of this `AccessPolicy` in the Cloud Resource
36
+ # Hierarchy. Currently immutable once created. Format:
37
+ # `organizations/{organization_id}`
38
+ # @!attribute [rw] title
39
+ # @return [String]
40
+ # Required. Human readable title. Does not affect behavior.
41
+ # @!attribute [rw] create_time
42
+ # @return [Google::Protobuf::Timestamp]
43
+ # Output only. Time the `AccessPolicy` was created in UTC.
44
+ # @!attribute [rw] update_time
45
+ # @return [Google::Protobuf::Timestamp]
46
+ # Output only. Time the `AccessPolicy` was updated in UTC.
47
+ # @!attribute [rw] etag
48
+ # @return [String]
49
+ # Output only. An opaque identifier for the current version of the
50
+ # `AccessPolicy`. This will always be a strongly validated etag, meaning that
51
+ # two Access Polices will be identical if and only if their etags are
52
+ # identical. Clients should not expect this to be in any specific format.
53
+ class AccessPolicy
54
+ include Google::Protobuf::MessageExts
55
+ extend Google::Protobuf::MessageExts::ClassMethods
56
+ end
57
+ end
58
+ end
59
+ end
60
+ end
@@ -0,0 +1,158 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2020 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Identity
22
+ module AccessContextManager
23
+ module V1
24
+ # `ServicePerimeter` describes a set of Google Cloud resources which can freely
25
+ # import and export data amongst themselves, but not export outside of the
26
+ # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
27
+ # has a target outside of the `ServicePerimeter`, the request will be blocked.
28
+ # Otherwise the request is allowed. There are two types of Service Perimeter -
29
+ # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
30
+ # Google Cloud project can only belong to a single regular Service Perimeter.
31
+ # Service Perimeter Bridges can contain only Google Cloud projects as members,
32
+ # a single Google Cloud project may belong to multiple Service Perimeter
33
+ # Bridges.
34
+ # @!attribute [rw] name
35
+ # @return [String]
36
+ # Required. Resource name for the ServicePerimeter. The `short_name`
37
+ # component must begin with a letter and only include alphanumeric and '_'.
38
+ # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
39
+ # @!attribute [rw] title
40
+ # @return [String]
41
+ # Human readable title. Must be unique within the Policy.
42
+ # @!attribute [rw] description
43
+ # @return [String]
44
+ # Description of the `ServicePerimeter` and its use. Does not affect
45
+ # behavior.
46
+ # @!attribute [rw] create_time
47
+ # @return [Google::Protobuf::Timestamp]
48
+ # Output only. Time the `ServicePerimeter` was created in UTC.
49
+ # @!attribute [rw] update_time
50
+ # @return [Google::Protobuf::Timestamp]
51
+ # Output only. Time the `ServicePerimeter` was updated in UTC.
52
+ # @!attribute [rw] perimeter_type
53
+ # @return [Google::Identity::AccessContextManager::V1::ServicePerimeter::PerimeterType]
54
+ # Perimeter type indicator. A single project is
55
+ # allowed to be a member of single regular perimeter, but multiple service
56
+ # perimeter bridges. A project cannot be a included in a perimeter bridge
57
+ # without being included in regular perimeter. For perimeter bridges,
58
+ # the restricted service list as well as access level lists must be
59
+ # empty.
60
+ # @!attribute [rw] status
61
+ # @return [Google::Identity::AccessContextManager::V1::ServicePerimeterConfig]
62
+ # Current ServicePerimeter configuration. Specifies sets of resources,
63
+ # restricted services and access levels that determine perimeter
64
+ # content and boundaries.
65
+ # @!attribute [rw] spec
66
+ # @return [Google::Identity::AccessContextManager::V1::ServicePerimeterConfig]
67
+ # Proposed (or dry run) ServicePerimeter configuration. This configuration
68
+ # allows to specify and test ServicePerimeter configuration without enforcing
69
+ # actual access restrictions. Only allowed to be set when the
70
+ # "use_explicit_dry_run_spec" flag is set.
71
+ # @!attribute [rw] use_explicit_dry_run_spec
72
+ # @return [Boolean]
73
+ # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
74
+ # exists for all Service Perimeters, and that spec is identical to the
75
+ # status for those Service Perimeters. When this flag is set, it inhibits the
76
+ # generation of the implicit spec, thereby allowing the user to explicitly
77
+ # provide a configuration ("spec") to use in a dry-run version of the Service
78
+ # Perimeter. This allows the user to test changes to the enforced config
79
+ # ("status") without actually enforcing them. This testing is done through
80
+ # analyzing the differences between currently enforced and suggested
81
+ # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
82
+ # fields in the spec are set to non-default values.
83
+ class ServicePerimeter
84
+ include Google::Protobuf::MessageExts
85
+ extend Google::Protobuf::MessageExts::ClassMethods
86
+
87
+ # Specifies the type of the Perimeter. There are two types: regular and
88
+ # bridge. Regular Service Perimeter contains resources, access levels, and
89
+ # restricted services. Every resource can be in at most ONE
90
+ # regular Service Perimeter.
91
+ #
92
+ # In addition to being in a regular service perimeter, a resource can also
93
+ # be in zero or more perimeter bridges. A perimeter bridge only contains
94
+ # resources. Cross project operations are permitted if all effected
95
+ # resources share some perimeter (whether bridge or regular). Perimeter
96
+ # Bridge does not contain access levels or services: those are governed
97
+ # entirely by the regular perimeter that resource is in.
98
+ #
99
+ # Perimeter Bridges are typically useful when building more complex toplogies
100
+ # with many independent perimeters that need to share some data with a common
101
+ # perimeter, but should not be able to share data among themselves.
102
+ module PerimeterType
103
+ # Regular Perimeter.
104
+ PERIMETER_TYPE_REGULAR = 0
105
+
106
+ # Perimeter Bridge.
107
+ PERIMETER_TYPE_BRIDGE = 1
108
+ end
109
+ end
110
+
111
+ # `ServicePerimeterConfig` specifies a set of Google Cloud resources that
112
+ # describe specific Service Perimeter configuration.
113
+ # @!attribute [rw] resources
114
+ # @return [Array<String>]
115
+ # A list of Google Cloud resources that are inside of the service perimeter.
116
+ # Currently only projects are allowed. Format: `projects/{project_number}`
117
+ # @!attribute [rw] access_levels
118
+ # @return [Array<String>]
119
+ # A list of `AccessLevel` resource names that allow resources within the
120
+ # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
121
+ # must be in the same policy as this `ServicePerimeter`. Referencing a
122
+ # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
123
+ # listed, resources within the perimeter can only be accessed via Google
124
+ # Cloud calls with request origins within the perimeter. Example:
125
+ # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
126
+ # For Service Perimeter Bridge, must be empty.
127
+ # @!attribute [rw] restricted_services
128
+ # @return [Array<String>]
129
+ # Google Cloud services that are subject to the Service Perimeter
130
+ # restrictions. For example, if `storage.googleapis.com` is specified, access
131
+ # to the storage buckets inside the perimeter must meet the perimeter's
132
+ # access restrictions.
133
+ # @!attribute [rw] vpc_accessible_services
134
+ # @return [Google::Identity::AccessContextManager::V1::ServicePerimeterConfig::VpcAccessibleServices]
135
+ # Configuration for APIs allowed within Perimeter.
136
+ class ServicePerimeterConfig
137
+ include Google::Protobuf::MessageExts
138
+ extend Google::Protobuf::MessageExts::ClassMethods
139
+
140
+ # Specifies how APIs are allowed to communicate within the Service
141
+ # Perimeter.
142
+ # @!attribute [rw] enable_restriction
143
+ # @return [Boolean]
144
+ # Whether to restrict API calls within the Service Perimeter to the list of
145
+ # APIs specified in 'allowed_services'.
146
+ # @!attribute [rw] allowed_services
147
+ # @return [Array<String>]
148
+ # The list of APIs usable within the Service Perimeter. Must be empty
149
+ # unless 'enable_restriction' is True.
150
+ class VpcAccessibleServices
151
+ include Google::Protobuf::MessageExts
152
+ extend Google::Protobuf::MessageExts::ClassMethods
153
+ end
154
+ end
155
+ end
156
+ end
157
+ end
158
+ end