google-cloud-asset-v1 0.28.0 → 0.29.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/AUTHENTICATION.md +72 -101
- data/lib/google/cloud/asset/v1/asset_service/client.rb +100 -50
- data/lib/google/cloud/asset/v1/asset_service/operations.rb +28 -6
- data/lib/google/cloud/asset/v1/asset_service/rest/client.rb +102 -49
- data/lib/google/cloud/asset/v1/asset_service/rest/operations.rb +33 -8
- data/lib/google/cloud/asset/v1/asset_service/rest/service_stub.rb +14 -2
- data/lib/google/cloud/asset/v1/asset_service_pb.rb +1 -1
- data/lib/google/cloud/asset/v1/asset_service_services_pb.rb +1 -1
- data/lib/google/cloud/asset/v1/assets_pb.rb +1 -2
- data/lib/google/cloud/asset/v1/version.rb +1 -1
- data/proto_docs/google/api/client.rb +1 -0
- data/proto_docs/google/cloud/asset/v1/asset_service.rb +66 -40
- data/proto_docs/google/cloud/asset/v1/assets.rb +18 -17
- metadata +4 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 463db4503e7e2b31ffcd0fe5e78c4d4e81f8518320e94c7be8cc634e97220319
|
|
4
|
+
data.tar.gz: 3ed4f4d5714cf470e7e345ed19f6a47208fbdb8bc178dc469dbb44a4ce9db366
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a1eba4d4f2e0572a55c41b70174987407de2e02e09d544460b0812b28688b83a90487509e100145403a8e6613e3a80cd84731986bf80067804dad49f14926718
|
|
7
|
+
data.tar.gz: 250bf54f136348a2e12cff19d1ad4c7ae30a97ccfd621607943bed22e869f973bdcff68dbd310d74908f66d0f21282c7cfcabbe0127021abe8ea7ab9a498e3f7
|
data/AUTHENTICATION.md
CHANGED
|
@@ -1,151 +1,122 @@
|
|
|
1
1
|
# Authentication
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
[
|
|
5
|
-
|
|
6
|
-
[Google Cloud Platform environments](#google-cloud-platform-environments) the
|
|
7
|
-
credentials will be discovered automatically. When running on other
|
|
8
|
-
environments, the Service Account credentials can be specified by providing the
|
|
9
|
-
path to the
|
|
10
|
-
[JSON keyfile](https://cloud.google.com/iam/docs/managing-service-account-keys)
|
|
11
|
-
for the account (or the JSON itself) in
|
|
12
|
-
[environment variables](#environment-variables). Additionally, Cloud SDK
|
|
13
|
-
credentials can also be discovered automatically, but this is only recommended
|
|
14
|
-
during development.
|
|
3
|
+
The recommended way to authenticate to the google-cloud-asset-v1 library is to use
|
|
4
|
+
[Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials).
|
|
5
|
+
To review all of your authentication options, see [Credentials lookup](#credential-lookup).
|
|
15
6
|
|
|
16
7
|
## Quickstart
|
|
17
8
|
|
|
18
|
-
|
|
19
|
-
|
|
9
|
+
The following example shows how to set up authentication for a local development
|
|
10
|
+
environment with your user credentials.
|
|
20
11
|
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
3. Initialize the client.
|
|
12
|
+
**NOTE:** This method is _not_ recommended for running in production. User credentials
|
|
13
|
+
should be used only during development.
|
|
26
14
|
|
|
27
|
-
|
|
28
|
-
|
|
15
|
+
1. [Download and install the Google Cloud CLI](https://cloud.google.com/sdk).
|
|
16
|
+
2. Set up a local ADC file with your user credentials:
|
|
29
17
|
|
|
30
|
-
|
|
18
|
+
```sh
|
|
19
|
+
gcloud auth application-default login
|
|
31
20
|
```
|
|
32
21
|
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
The google-cloud-asset-v1 library aims to make authentication
|
|
36
|
-
as simple as possible, and provides several mechanisms to configure your system
|
|
37
|
-
without requiring **Service Account Credentials** directly in code.
|
|
38
|
-
|
|
39
|
-
**Credentials** are discovered in the following order:
|
|
40
|
-
|
|
41
|
-
1. Specify credentials in method arguments
|
|
42
|
-
2. Specify credentials in configuration
|
|
43
|
-
3. Discover credentials path in environment variables
|
|
44
|
-
4. Discover credentials JSON in environment variables
|
|
45
|
-
5. Discover credentials file in the Cloud SDK's path
|
|
46
|
-
6. Discover GCP credentials
|
|
47
|
-
|
|
48
|
-
### Google Cloud Platform environments
|
|
22
|
+
3. Write code as if already authenticated.
|
|
49
23
|
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
Functions (GCF) and Cloud Run, **Credentials** are discovered automatically.
|
|
53
|
-
Code should be written as if already authenticated.
|
|
24
|
+
For more information about setting up authentication for a local development environment, see
|
|
25
|
+
[Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-dev).
|
|
54
26
|
|
|
55
|
-
|
|
27
|
+
## Credential Lookup
|
|
56
28
|
|
|
57
|
-
The
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
**Credentials JSON** file can be stored in the environment variable, or the
|
|
62
|
-
**Credentials JSON** itself can be stored for environments such as Docker
|
|
63
|
-
containers where writing files is difficult or not encouraged.
|
|
29
|
+
The google-cloud-asset-v1 library provides several mechanisms to configure your system.
|
|
30
|
+
Generally, using Application Default Credentials to facilitate automatic
|
|
31
|
+
credentials discovery is the easist method. But if you need to explicitly specify
|
|
32
|
+
credentials, there are several methods available to you.
|
|
64
33
|
|
|
65
|
-
|
|
66
|
-
checks for credentials are configured on the service Credentials class (such as
|
|
67
|
-
{::Google::Cloud::Asset::V1::AssetService::Credentials}):
|
|
34
|
+
Credentials are accepted in the following ways, in the following order or precedence:
|
|
68
35
|
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
36
|
+
1. Credentials specified in method arguments
|
|
37
|
+
2. Credentials specified in configuration
|
|
38
|
+
3. Credentials pointed to or included in environment variables
|
|
39
|
+
4. Credentials found in local ADC file
|
|
40
|
+
5. Credentials returned by the metadata server for the attached service account (GCP)
|
|
74
41
|
|
|
75
|
-
|
|
76
|
-
require "google/cloud/asset/v1"
|
|
77
|
-
|
|
78
|
-
ENV["ASSET_CREDENTIALS"] = "path/to/keyfile.json"
|
|
42
|
+
### Configuration
|
|
79
43
|
|
|
80
|
-
client
|
|
81
|
-
|
|
44
|
+
You can configure a path to a JSON credentials file, either for an individual client object or
|
|
45
|
+
globally, for all client objects. The JSON file can contain credentials created for
|
|
46
|
+
[workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation),
|
|
47
|
+
[workforce identity federation](https://cloud.google.com/iam/docs/workforce-identity-federation), or a
|
|
48
|
+
[service account key](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-key).
|
|
82
49
|
|
|
83
|
-
|
|
50
|
+
Note: Service account keys are a security risk if not managed correctly. You should
|
|
51
|
+
[choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
|
|
52
|
+
whenever possible.
|
|
84
53
|
|
|
85
|
-
|
|
86
|
-
it in an environment variable. Either on an individual client initialization:
|
|
54
|
+
To configure a credentials file for an individual client initialization:
|
|
87
55
|
|
|
88
56
|
```ruby
|
|
89
57
|
require "google/cloud/asset/v1"
|
|
90
58
|
|
|
91
59
|
client = ::Google::Cloud::Asset::V1::AssetService::Client.new do |config|
|
|
92
|
-
config.credentials = "path/to/
|
|
60
|
+
config.credentials = "path/to/credentialfile.json"
|
|
93
61
|
end
|
|
94
62
|
```
|
|
95
63
|
|
|
96
|
-
|
|
64
|
+
To configure a credentials file globally for all clients:
|
|
97
65
|
|
|
98
66
|
```ruby
|
|
99
67
|
require "google/cloud/asset/v1"
|
|
100
68
|
|
|
101
69
|
::Google::Cloud::Asset::V1::AssetService::Client.configure do |config|
|
|
102
|
-
config.credentials = "path/to/
|
|
70
|
+
config.credentials = "path/to/credentialfile.json"
|
|
103
71
|
end
|
|
104
72
|
|
|
105
73
|
client = ::Google::Cloud::Asset::V1::AssetService::Client.new
|
|
106
74
|
```
|
|
107
75
|
|
|
108
|
-
###
|
|
76
|
+
### Environment Variables
|
|
109
77
|
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
78
|
+
You can also use an environment variable to provide a JSON credentials file.
|
|
79
|
+
The environment variable can contain a path to the credentials file or, for
|
|
80
|
+
environments such as Docker containers where writing files is not encouraged,
|
|
81
|
+
you can include the credentials file itself.
|
|
113
82
|
|
|
114
|
-
|
|
83
|
+
The JSON file can contain credentials created for
|
|
84
|
+
[workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation),
|
|
85
|
+
[workforce identity federation](https://cloud.google.com/iam/docs/workforce-identity-federation), or a
|
|
86
|
+
[service account key](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-key).
|
|
115
87
|
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
88
|
+
Note: Service account keys are a security risk if not managed correctly. You should
|
|
89
|
+
[choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
|
|
90
|
+
whenever possible.
|
|
91
|
+
|
|
92
|
+
The environment variables that google-cloud-asset-v1
|
|
93
|
+
checks for credentials are:
|
|
119
94
|
|
|
120
|
-
|
|
121
|
-
*
|
|
95
|
+
* `GOOGLE_CLOUD_CREDENTIALS` - Path to JSON file, or JSON contents
|
|
96
|
+
* `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
|
|
122
97
|
|
|
123
|
-
|
|
98
|
+
```ruby
|
|
99
|
+
require "google/cloud/asset/v1"
|
|
124
100
|
|
|
125
|
-
|
|
126
|
-
connect to the APIs. You will use the **JSON key file** to
|
|
127
|
-
connect to most services with google-cloud-asset-v1.
|
|
101
|
+
ENV["GOOGLE_APPLICATION_CREDENTIALS"] = "path/to/credentialfile.json"
|
|
128
102
|
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
need a Google Developers service account.
|
|
103
|
+
client = ::Google::Cloud::Asset::V1::AssetService::Client.new
|
|
104
|
+
```
|
|
132
105
|
|
|
133
|
-
|
|
134
|
-
2. Create a new project or click on an existing project.
|
|
135
|
-
3. Activate the menu in the upper left and select **APIs & Services**. From
|
|
136
|
-
here, you will enable the APIs that your application requires.
|
|
106
|
+
### Local ADC file
|
|
137
107
|
|
|
138
|
-
|
|
108
|
+
You can set up a local ADC file with your user credentials for authentication during
|
|
109
|
+
development. If credentials are not provided in code or in environment variables,
|
|
110
|
+
then the local ADC credentials are discovered.
|
|
139
111
|
|
|
140
|
-
|
|
112
|
+
Follow the steps in [Quickstart](#quickstart) to set up a local ADC file.
|
|
141
113
|
|
|
142
|
-
|
|
143
|
-
"Service account" to be guided through downloading a new JSON key file.
|
|
114
|
+
### Google Cloud Platform environments
|
|
144
115
|
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
116
|
+
When running on Google Cloud Platform (GCP), including Google Compute Engine
|
|
117
|
+
(GCE), Google Kubernetes Engine (GKE), Google App Engine (GAE), Google Cloud
|
|
118
|
+
Functions (GCF) and Cloud Run, credentials are retrieved from the attached
|
|
119
|
+
service account automatically. Code should be written as if already authenticated.
|
|
149
120
|
|
|
150
|
-
|
|
151
|
-
|
|
121
|
+
For more information, see
|
|
122
|
+
[Set up ADC for Google Cloud services](https://cloud.google.com/docs/authentication/provide-credentials-adc#attached-sa).
|
|
@@ -30,6 +30,9 @@ module Google
|
|
|
30
30
|
# Asset service definition.
|
|
31
31
|
#
|
|
32
32
|
class Client
|
|
33
|
+
# @private
|
|
34
|
+
DEFAULT_ENDPOINT_TEMPLATE = "cloudasset.$UNIVERSE_DOMAIN$"
|
|
35
|
+
|
|
33
36
|
include Paths
|
|
34
37
|
|
|
35
38
|
# @private
|
|
@@ -182,6 +185,15 @@ module Google
|
|
|
182
185
|
@config
|
|
183
186
|
end
|
|
184
187
|
|
|
188
|
+
##
|
|
189
|
+
# The effective universe domain
|
|
190
|
+
#
|
|
191
|
+
# @return [String]
|
|
192
|
+
#
|
|
193
|
+
def universe_domain
|
|
194
|
+
@asset_service_stub.universe_domain
|
|
195
|
+
end
|
|
196
|
+
|
|
185
197
|
##
|
|
186
198
|
# Create a new AssetService client object.
|
|
187
199
|
#
|
|
@@ -215,8 +227,9 @@ module Google
|
|
|
215
227
|
credentials = @config.credentials
|
|
216
228
|
# Use self-signed JWT if the endpoint is unchanged from default,
|
|
217
229
|
# but only if the default endpoint does not have a region prefix.
|
|
218
|
-
enable_self_signed_jwt = @config.endpoint
|
|
219
|
-
|
|
230
|
+
enable_self_signed_jwt = @config.endpoint.nil? ||
|
|
231
|
+
(@config.endpoint == Configuration::DEFAULT_ENDPOINT &&
|
|
232
|
+
!@config.endpoint.split(".").first.include?("-"))
|
|
220
233
|
credentials ||= Credentials.default scope: @config.scope,
|
|
221
234
|
enable_self_signed_jwt: enable_self_signed_jwt
|
|
222
235
|
if credentials.is_a?(::String) || credentials.is_a?(::Hash)
|
|
@@ -229,12 +242,15 @@ module Google
|
|
|
229
242
|
config.credentials = credentials
|
|
230
243
|
config.quota_project = @quota_project_id
|
|
231
244
|
config.endpoint = @config.endpoint
|
|
245
|
+
config.universe_domain = @config.universe_domain
|
|
232
246
|
end
|
|
233
247
|
|
|
234
248
|
@asset_service_stub = ::Gapic::ServiceStub.new(
|
|
235
249
|
::Google::Cloud::Asset::V1::AssetService::Stub,
|
|
236
|
-
credentials:
|
|
237
|
-
endpoint:
|
|
250
|
+
credentials: credentials,
|
|
251
|
+
endpoint: @config.endpoint,
|
|
252
|
+
endpoint_template: DEFAULT_ENDPOINT_TEMPLATE,
|
|
253
|
+
universe_domain: @config.universe_domain,
|
|
238
254
|
channel_args: @config.channel_args,
|
|
239
255
|
interceptors: @config.interceptors,
|
|
240
256
|
channel_pool_config: @config.channel_pool
|
|
@@ -1188,31 +1204,31 @@ module Google
|
|
|
1188
1204
|
# * `labels.env:*` to find Google Cloud resources that have a label `env`.
|
|
1189
1205
|
# * `tagKeys:env` to find Google Cloud resources that have directly
|
|
1190
1206
|
# attached tags where the
|
|
1191
|
-
# [`TagKey`](https://cloud.google.com/resource-manager/reference/rest/v3/tagKeys#resource:-tagkey)
|
|
1192
|
-
#
|
|
1207
|
+
# [`TagKey.namespacedName`](https://cloud.google.com/resource-manager/reference/rest/v3/tagKeys#resource:-tagkey)
|
|
1208
|
+
# contains `env`.
|
|
1193
1209
|
# * `tagValues:prod*` to find Google Cloud resources that have directly
|
|
1194
1210
|
# attached tags where the
|
|
1195
|
-
# [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1196
|
-
#
|
|
1211
|
+
# [`TagValue.namespacedName`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1212
|
+
# contains a word prefixed by `prod`.
|
|
1197
1213
|
# * `tagValueIds=tagValues/123` to find Google Cloud resources that have
|
|
1198
1214
|
# directly attached tags where the
|
|
1199
|
-
# [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1200
|
-
#
|
|
1215
|
+
# [`TagValue.name`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1216
|
+
# is exactly `tagValues/123`.
|
|
1201
1217
|
# * `effectiveTagKeys:env` to find Google Cloud resources that have
|
|
1202
1218
|
# directly attached or inherited tags where the
|
|
1203
|
-
# [`TagKey`](https://cloud.google.com/resource-manager/reference/rest/v3/tagKeys#resource:-tagkey)
|
|
1204
|
-
#
|
|
1219
|
+
# [`TagKey.namespacedName`](https://cloud.google.com/resource-manager/reference/rest/v3/tagKeys#resource:-tagkey)
|
|
1220
|
+
# contains `env`.
|
|
1205
1221
|
# * `effectiveTagValues:prod*` to find Google Cloud resources that have
|
|
1206
1222
|
# directly attached or inherited tags where the
|
|
1207
|
-
# [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1208
|
-
#
|
|
1223
|
+
# [`TagValue.namespacedName`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1224
|
+
# contains a word prefixed by `prod`.
|
|
1209
1225
|
# * `effectiveTagValueIds=tagValues/123` to find Google Cloud resources that
|
|
1210
1226
|
# have directly attached or inherited tags where the
|
|
1211
|
-
# [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1212
|
-
#
|
|
1227
|
+
# [`TagValue.name`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
|
|
1228
|
+
# is exactly `tagValues/123`.
|
|
1213
1229
|
# * `kmsKey:key` to find Google Cloud resources encrypted with a
|
|
1214
1230
|
# customer-managed encryption key whose name contains `key` as a word. This
|
|
1215
|
-
# field is deprecated.
|
|
1231
|
+
# field is deprecated. Use the `kmsKeys` field to retrieve Cloud KMS
|
|
1216
1232
|
# key information.
|
|
1217
1233
|
# * `kmsKeys:key` to find Google Cloud resources encrypted with
|
|
1218
1234
|
# customer-managed encryption keys whose name contains the word `key`.
|
|
@@ -1224,6 +1240,10 @@ module Google
|
|
|
1224
1240
|
# Compute Engine instances that have relationships with `instance-group-1`
|
|
1225
1241
|
# in the Compute Engine instance group resource name, for relationship type
|
|
1226
1242
|
# `INSTANCE_TO_INSTANCEGROUP`.
|
|
1243
|
+
# * `sccSecurityMarks.key=value` to find Cloud resources that are attached
|
|
1244
|
+
# with security marks whose key is `key` and value is `value`.
|
|
1245
|
+
# * `sccSecurityMarks.key:*` to find Cloud resources that are attached with
|
|
1246
|
+
# security marks whose key is `key`.
|
|
1227
1247
|
# * `state:ACTIVE` to find Google Cloud resources whose state contains
|
|
1228
1248
|
# `ACTIVE` as a word.
|
|
1229
1249
|
# * `NOT state:ACTIVE` to find Google Cloud resources whose state doesn't
|
|
@@ -1245,7 +1265,7 @@ module Google
|
|
|
1245
1265
|
# @param asset_types [::Array<::String>]
|
|
1246
1266
|
# Optional. A list of asset types that this request searches for. If empty,
|
|
1247
1267
|
# it will search all the [searchable asset
|
|
1248
|
-
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types
|
|
1268
|
+
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types).
|
|
1249
1269
|
#
|
|
1250
1270
|
# Regular expressions are also supported. For example:
|
|
1251
1271
|
#
|
|
@@ -1480,7 +1500,7 @@ module Google
|
|
|
1480
1500
|
# Optional. A list of asset types that the IAM policies are attached to. If
|
|
1481
1501
|
# empty, it will search the IAM policies that are attached to all the
|
|
1482
1502
|
# [searchable asset
|
|
1483
|
-
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types
|
|
1503
|
+
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types).
|
|
1484
1504
|
#
|
|
1485
1505
|
# Regular expressions are also supported. For example:
|
|
1486
1506
|
#
|
|
@@ -1606,7 +1626,7 @@ module Google
|
|
|
1606
1626
|
# If both `analysis_query` and `saved_analysis_query` are provided, they
|
|
1607
1627
|
# will be merged together with the `saved_analysis_query` as base and
|
|
1608
1628
|
# the `analysis_query` as overrides. For more details of the merge behavior,
|
|
1609
|
-
#
|
|
1629
|
+
# refer to the
|
|
1610
1630
|
# [MergeFrom](https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.message#Message.MergeFrom.details)
|
|
1611
1631
|
# page.
|
|
1612
1632
|
#
|
|
@@ -1729,7 +1749,7 @@ module Google
|
|
|
1729
1749
|
# If both `analysis_query` and `saved_analysis_query` are provided, they
|
|
1730
1750
|
# will be merged together with the `saved_analysis_query` as base and
|
|
1731
1751
|
# the `analysis_query` as overrides. For more details of the merge behavior,
|
|
1732
|
-
#
|
|
1752
|
+
# refer to the
|
|
1733
1753
|
# [MergeFrom](https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.message#Message.MergeFrom.details)
|
|
1734
1754
|
# doc.
|
|
1735
1755
|
#
|
|
@@ -2583,7 +2603,7 @@ module Google
|
|
|
2583
2603
|
# Required. The names refer to the [full_resource_names]
|
|
2584
2604
|
# (https://cloud.google.com/asset-inventory/docs/resource-name-format)
|
|
2585
2605
|
# of [searchable asset
|
|
2586
|
-
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types
|
|
2606
|
+
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types).
|
|
2587
2607
|
# A maximum of 20 resources' effective policies can be retrieved in a batch.
|
|
2588
2608
|
#
|
|
2589
2609
|
# @yield [response, operation] Access the result along with the RPC operation
|
|
@@ -2680,12 +2700,15 @@ module Google
|
|
|
2680
2700
|
# @param filter [::String]
|
|
2681
2701
|
# The expression to filter
|
|
2682
2702
|
# {::Google::Cloud::Asset::V1::AnalyzeOrgPoliciesResponse#org_policy_results AnalyzeOrgPoliciesResponse.org_policy_results}.
|
|
2683
|
-
#
|
|
2684
|
-
#
|
|
2703
|
+
# Filtering is currently available for bare literal values and the following
|
|
2704
|
+
# fields:
|
|
2705
|
+
# * consolidated_policy.attached_resource
|
|
2706
|
+
# * consolidated_policy.rules.enforce
|
|
2685
2707
|
#
|
|
2686
|
-
#
|
|
2708
|
+
# When filtering by a specific field, the only supported operator is `=`.
|
|
2709
|
+
# For example, filtering by
|
|
2687
2710
|
# consolidated_policy.attached_resource="//cloudresourcemanager.googleapis.com/folders/001"
|
|
2688
|
-
# will return the
|
|
2711
|
+
# will return all the Organization Policy results attached to "folders/001".
|
|
2689
2712
|
# @param page_size [::Integer]
|
|
2690
2713
|
# The maximum number of items to return per page. If unspecified,
|
|
2691
2714
|
# {::Google::Cloud::Asset::V1::AnalyzeOrgPoliciesResponse#org_policy_results AnalyzeOrgPoliciesResponse.org_policy_results}
|
|
@@ -2793,13 +2816,17 @@ module Google
|
|
|
2793
2816
|
# The analysis only contains organization policies for the provided
|
|
2794
2817
|
# constraint.
|
|
2795
2818
|
# @param filter [::String]
|
|
2796
|
-
# The expression to filter
|
|
2797
|
-
#
|
|
2798
|
-
#
|
|
2799
|
-
#
|
|
2800
|
-
#
|
|
2801
|
-
#
|
|
2802
|
-
#
|
|
2819
|
+
# The expression to filter
|
|
2820
|
+
# {::Google::Cloud::Asset::V1::AnalyzeOrgPolicyGovernedContainersResponse#governed_containers AnalyzeOrgPolicyGovernedContainersResponse.governed_containers}.
|
|
2821
|
+
# Filtering is currently available for bare literal values and the following
|
|
2822
|
+
# fields:
|
|
2823
|
+
# * parent
|
|
2824
|
+
# * consolidated_policy.rules.enforce
|
|
2825
|
+
#
|
|
2826
|
+
# When filtering by a specific field, the only supported operator is `=`.
|
|
2827
|
+
# For example, filtering by
|
|
2828
|
+
# parent="//cloudresourcemanager.googleapis.com/folders/001"
|
|
2829
|
+
# will return all the containers under "folders/001".
|
|
2803
2830
|
# @param page_size [::Integer]
|
|
2804
2831
|
# The maximum number of items to return per page. If unspecified,
|
|
2805
2832
|
# {::Google::Cloud::Asset::V1::AnalyzeOrgPolicyGovernedContainersResponse#governed_containers AnalyzeOrgPolicyGovernedContainersResponse.governed_containers}
|
|
@@ -2894,7 +2921,7 @@ module Google
|
|
|
2894
2921
|
#
|
|
2895
2922
|
# This RPC only returns either resources of types supported by [searchable
|
|
2896
2923
|
# asset
|
|
2897
|
-
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types
|
|
2924
|
+
# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types),
|
|
2898
2925
|
# or IAM policies.
|
|
2899
2926
|
#
|
|
2900
2927
|
# @overload analyze_org_policy_governed_assets(request, options = nil)
|
|
@@ -2924,18 +2951,33 @@ module Google
|
|
|
2924
2951
|
# analysis only contains analyzed organization policies for the provided
|
|
2925
2952
|
# constraint.
|
|
2926
2953
|
# @param filter [::String]
|
|
2927
|
-
# The expression to filter
|
|
2928
|
-
#
|
|
2929
|
-
#
|
|
2930
|
-
#
|
|
2931
|
-
#
|
|
2932
|
-
#
|
|
2933
|
-
#
|
|
2934
|
-
#
|
|
2935
|
-
#
|
|
2936
|
-
#
|
|
2937
|
-
#
|
|
2938
|
-
#
|
|
2954
|
+
# The expression to filter
|
|
2955
|
+
# {::Google::Cloud::Asset::V1::AnalyzeOrgPolicyGovernedAssetsResponse#governed_assets AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets}.
|
|
2956
|
+
#
|
|
2957
|
+
# For governed resources, filtering is currently available for bare literal
|
|
2958
|
+
# values and the following fields:
|
|
2959
|
+
# * governed_resource.project
|
|
2960
|
+
# * governed_resource.folders
|
|
2961
|
+
# * consolidated_policy.rules.enforce
|
|
2962
|
+
# When filtering by `governed_resource.project` or
|
|
2963
|
+
# `consolidated_policy.rules.enforce`, the only supported operator is `=`.
|
|
2964
|
+
# When filtering by `governed_resource.folders`, the supported operators
|
|
2965
|
+
# are `=` and `:`.
|
|
2966
|
+
# For example, filtering by `governed_resource.project="projects/12345678"`
|
|
2967
|
+
# will return all the governed resources under "projects/12345678",
|
|
2968
|
+
# including the project itself if applicable.
|
|
2969
|
+
#
|
|
2970
|
+
# For governed IAM policies, filtering is currently available for bare
|
|
2971
|
+
# literal values and the following fields:
|
|
2972
|
+
# * governed_iam_policy.project
|
|
2973
|
+
# * governed_iam_policy.folders
|
|
2974
|
+
# * consolidated_policy.rules.enforce
|
|
2975
|
+
# When filtering by `governed_iam_policy.project` or
|
|
2976
|
+
# `consolidated_policy.rules.enforce`, the only supported operator is `=`.
|
|
2977
|
+
# When filtering by `governed_iam_policy.folders`, the supported operators
|
|
2978
|
+
# are `=` and `:`.
|
|
2979
|
+
# For example, filtering by `governed_iam_policy.folders:"folders/12345678"`
|
|
2980
|
+
# will return all the governed IAM policies under "folders/001".
|
|
2939
2981
|
# @param page_size [::Integer]
|
|
2940
2982
|
# The maximum number of items to return per page. If unspecified,
|
|
2941
2983
|
# {::Google::Cloud::Asset::V1::AnalyzeOrgPolicyGovernedAssetsResponse#governed_assets AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets}
|
|
@@ -3042,9 +3084,9 @@ module Google
|
|
|
3042
3084
|
# end
|
|
3043
3085
|
#
|
|
3044
3086
|
# @!attribute [rw] endpoint
|
|
3045
|
-
#
|
|
3046
|
-
#
|
|
3047
|
-
# @return [::String]
|
|
3087
|
+
# A custom service endpoint, as a hostname or hostname:port. The default is
|
|
3088
|
+
# nil, indicating to use the default endpoint in the current universe domain.
|
|
3089
|
+
# @return [::String,nil]
|
|
3048
3090
|
# @!attribute [rw] credentials
|
|
3049
3091
|
# Credentials to send with calls. You may provide any of the following types:
|
|
3050
3092
|
# * (`String`) The path to a service account key file in JSON format
|
|
@@ -3090,13 +3132,20 @@ module Google
|
|
|
3090
3132
|
# @!attribute [rw] quota_project
|
|
3091
3133
|
# A separate project against which to charge quota.
|
|
3092
3134
|
# @return [::String]
|
|
3135
|
+
# @!attribute [rw] universe_domain
|
|
3136
|
+
# The universe domain within which to make requests. This determines the
|
|
3137
|
+
# default endpoint URL. The default value of nil uses the environment
|
|
3138
|
+
# universe (usually the default "googleapis.com" universe).
|
|
3139
|
+
# @return [::String,nil]
|
|
3093
3140
|
#
|
|
3094
3141
|
class Configuration
|
|
3095
3142
|
extend ::Gapic::Config
|
|
3096
3143
|
|
|
3144
|
+
# @private
|
|
3145
|
+
# The endpoint specific to the default "googleapis.com" universe. Deprecated.
|
|
3097
3146
|
DEFAULT_ENDPOINT = "cloudasset.googleapis.com"
|
|
3098
3147
|
|
|
3099
|
-
config_attr :endpoint,
|
|
3148
|
+
config_attr :endpoint, nil, ::String, nil
|
|
3100
3149
|
config_attr :credentials, nil do |value|
|
|
3101
3150
|
allowed = [::String, ::Hash, ::Proc, ::Symbol, ::Google::Auth::Credentials, ::Signet::OAuth2::Client, nil]
|
|
3102
3151
|
allowed += [::GRPC::Core::Channel, ::GRPC::Core::ChannelCredentials] if defined? ::GRPC
|
|
@@ -3111,6 +3160,7 @@ module Google
|
|
|
3111
3160
|
config_attr :metadata, nil, ::Hash, nil
|
|
3112
3161
|
config_attr :retry_policy, nil, ::Hash, ::Proc, nil
|
|
3113
3162
|
config_attr :quota_project, nil, ::String, nil
|
|
3163
|
+
config_attr :universe_domain, nil, ::String, nil
|
|
3114
3164
|
|
|
3115
3165
|
# @private
|
|
3116
3166
|
def initialize parent_config = nil
|
|
@@ -26,6 +26,9 @@ module Google
|
|
|
26
26
|
module AssetService
|
|
27
27
|
# Service that implements Longrunning Operations API.
|
|
28
28
|
class Operations
|
|
29
|
+
# @private
|
|
30
|
+
DEFAULT_ENDPOINT_TEMPLATE = "cloudasset.$UNIVERSE_DOMAIN$"
|
|
31
|
+
|
|
29
32
|
# @private
|
|
30
33
|
attr_reader :operations_stub
|
|
31
34
|
|
|
@@ -60,6 +63,15 @@ module Google
|
|
|
60
63
|
@config
|
|
61
64
|
end
|
|
62
65
|
|
|
66
|
+
##
|
|
67
|
+
# The effective universe domain
|
|
68
|
+
#
|
|
69
|
+
# @return [String]
|
|
70
|
+
#
|
|
71
|
+
def universe_domain
|
|
72
|
+
@operations_stub.universe_domain
|
|
73
|
+
end
|
|
74
|
+
|
|
63
75
|
##
|
|
64
76
|
# Create a new Operations client object.
|
|
65
77
|
#
|
|
@@ -90,8 +102,10 @@ module Google
|
|
|
90
102
|
|
|
91
103
|
@operations_stub = ::Gapic::ServiceStub.new(
|
|
92
104
|
::Google::Longrunning::Operations::Stub,
|
|
93
|
-
credentials:
|
|
94
|
-
endpoint:
|
|
105
|
+
credentials: credentials,
|
|
106
|
+
endpoint: @config.endpoint,
|
|
107
|
+
endpoint_template: DEFAULT_ENDPOINT_TEMPLATE,
|
|
108
|
+
universe_domain: @config.universe_domain,
|
|
95
109
|
channel_args: @config.channel_args,
|
|
96
110
|
interceptors: @config.interceptors,
|
|
97
111
|
channel_pool_config: @config.channel_pool
|
|
@@ -613,9 +627,9 @@ module Google
|
|
|
613
627
|
# end
|
|
614
628
|
#
|
|
615
629
|
# @!attribute [rw] endpoint
|
|
616
|
-
#
|
|
617
|
-
#
|
|
618
|
-
# @return [::String]
|
|
630
|
+
# A custom service endpoint, as a hostname or hostname:port. The default is
|
|
631
|
+
# nil, indicating to use the default endpoint in the current universe domain.
|
|
632
|
+
# @return [::String,nil]
|
|
619
633
|
# @!attribute [rw] credentials
|
|
620
634
|
# Credentials to send with calls. You may provide any of the following types:
|
|
621
635
|
# * (`String`) The path to a service account key file in JSON format
|
|
@@ -661,13 +675,20 @@ module Google
|
|
|
661
675
|
# @!attribute [rw] quota_project
|
|
662
676
|
# A separate project against which to charge quota.
|
|
663
677
|
# @return [::String]
|
|
678
|
+
# @!attribute [rw] universe_domain
|
|
679
|
+
# The universe domain within which to make requests. This determines the
|
|
680
|
+
# default endpoint URL. The default value of nil uses the environment
|
|
681
|
+
# universe (usually the default "googleapis.com" universe).
|
|
682
|
+
# @return [::String,nil]
|
|
664
683
|
#
|
|
665
684
|
class Configuration
|
|
666
685
|
extend ::Gapic::Config
|
|
667
686
|
|
|
687
|
+
# @private
|
|
688
|
+
# The endpoint specific to the default "googleapis.com" universe. Deprecated.
|
|
668
689
|
DEFAULT_ENDPOINT = "cloudasset.googleapis.com"
|
|
669
690
|
|
|
670
|
-
config_attr :endpoint,
|
|
691
|
+
config_attr :endpoint, nil, ::String, nil
|
|
671
692
|
config_attr :credentials, nil do |value|
|
|
672
693
|
allowed = [::String, ::Hash, ::Proc, ::Symbol, ::Google::Auth::Credentials, ::Signet::OAuth2::Client, nil]
|
|
673
694
|
allowed += [::GRPC::Core::Channel, ::GRPC::Core::ChannelCredentials] if defined? ::GRPC
|
|
@@ -682,6 +703,7 @@ module Google
|
|
|
682
703
|
config_attr :metadata, nil, ::Hash, nil
|
|
683
704
|
config_attr :retry_policy, nil, ::Hash, ::Proc, nil
|
|
684
705
|
config_attr :quota_project, nil, ::String, nil
|
|
706
|
+
config_attr :universe_domain, nil, ::String, nil
|
|
685
707
|
|
|
686
708
|
# @private
|
|
687
709
|
def initialize parent_config = nil
|