google-cloud-network_security-v1 0.a → 0.1.0

data/proto_docs/google/cloud/networksecurity/v1/authz_policy.rb

@@ -0,0 +1,735 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module NetworkSecurity
+      module V1
+        # `AuthzPolicy` is a resource that allows to forward traffic to a
+        # callout backend designed to scan the traffic for security purposes.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. Identifier. Name of the `AuthzPolicy` resource in the following
+        #     format:
+        #     `projects/{project}/locations/{location}/authzPolicies/{authz_policy}`.
+        # @!attribute [r] create_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The timestamp when the resource was created.
+        # @!attribute [r] update_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The timestamp when the resource was updated.
+        # @!attribute [rw] description
+        #   @return [::String]
+        #     Optional. A human-readable description of the resource.
+        # @!attribute [rw] labels
+        #   @return [::Google::Protobuf::Map{::String => ::String}]
+        #     Optional. Set of labels associated with the `AuthzPolicy` resource.
+        #
+        #     The format must comply with [the following
+        #     requirements](/compute/docs/labeling-resources#requirements).
+        # @!attribute [rw] target
+        #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::Target]
+        #     Required. Specifies the set of resources to which this policy should be
+        #     applied to.
+        # @!attribute [rw] http_rules
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule>]
+        #     Optional. A list of authorization HTTP rules to match against the incoming
+        #     request. A policy match occurs when at least one HTTP rule matches the
+        #     request or when no HTTP rules are specified in the policy.
+        #     At least one HTTP Rule is required for Allow or Deny Action. Limited
+        #     to 5 rules.
+        # @!attribute [rw] network_rules
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule>]
+        #     Optional. A list of authorization network rules to match against the
+        #     incoming request. A policy match occurs when at least one network rule
+        #     matches the request.
+        #     At least one network rule is required for Allow or Deny Action if no HTTP
+        #     rules are provided. Network rules are mutually exclusive with HTTP rules.
+        #     Limited to 5 rules.
+        # @!attribute [rw] action
+        #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzAction]
+        #     Required. Can be one of `ALLOW`, `DENY`, `CUSTOM`.
+        #
+        #     When the action is `CUSTOM`, `customProvider` must be specified.
+        #
+        #     When the action is `ALLOW`, only requests matching the policy will
+        #     be allowed.
+        #
+        #     When the action is `DENY`, only requests matching the policy will be
+        #     denied.
+        #
+        #     When a request arrives, the policies are evaluated in the following order:
+        #
+        #     1. If there is a `CUSTOM` policy that matches the request, the `CUSTOM`
+        #     policy is evaluated using the custom authorization providers and the
+        #     request is denied if the provider rejects the request.
+        #
+        #     2. If there are any `DENY` policies that match the request, the request
+        #     is denied.
+        #
+        #     3. If there are no `ALLOW` policies for the resource or if any of the
+        #     `ALLOW` policies match the request, the request is allowed.
+        #
+        #     4. Else the request is denied by default if none of the configured
+        #     AuthzPolicies with `ALLOW` action match the request.
+        # @!attribute [rw] custom_provider
+        #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::CustomProvider]
+        #     Optional. Required if the action is `CUSTOM`. Allows delegating
+        #     authorization decisions to Cloud IAP or to Service Extensions. One of
+        #     `cloudIap` or `authzExtension` must be specified.
+        # @!attribute [rw] policy_profile
+        #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::PolicyProfile]
+        #     Optional. Immutable. Defines the type of authorization being performed.
+        #     If not specified, `REQUEST_AUTHZ` is applied. This field cannot be changed
+        #     once AuthzPolicy is created.
+        class AuthzPolicy
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # Specifies the set of targets to which this policy should be applied to.
+          # @!attribute [rw] load_balancing_scheme
+          #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::LoadBalancingScheme]
+          #     Optional. All gateways and forwarding rules referenced by this policy and
+          #     extensions must share the same load balancing scheme. Required only when
+          #     targeting forwarding rules. If targeting Secure Web Proxy, this field
+          #     must be `INTERNAL_MANAGED` or not specified. Must not be specified
+          #     when targeting Agent Gateway. Supported values:
+          #     `INTERNAL_MANAGED` and `EXTERNAL_MANAGED`. For more information, refer
+          #     to [Backend services
+          #     overview](https://cloud.google.com/load-balancing/docs/backend-service).
+          # @!attribute [rw] resources
+          #   @return [::Array<::String>]
+          #     Required. A list of references to the Forwarding Rules, Secure Web Proxy
+          #     Gateways, or Agent Gateways on which this policy will be applied.
+          class Target
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # Conditions to match against the incoming request.
+          # @!attribute [rw] from
+          #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::From]
+          #     Optional. Describes properties of a source of a request.
+          # @!attribute [rw] to
+          #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To]
+          #     Optional. Describes properties of a target of a request.
+          # @!attribute [rw] when
+          #   @return [::String]
+          #     Optional. CEL expression that describes the conditions to be satisfied
+          #     for the action. The result of the CEL expression is ANDed with the from
+          #     and to. Refer to the CEL language reference for a list of available
+          #     attributes.
+          class AuthzRule
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Determines how a string value should be matched.
+            # @!attribute [rw] exact
+            #   @return [::String]
+            #     The input string must match exactly the string specified here.
+            #
+            #     Examples:
+            #
+            #     * ``abc`` only matches the value ``abc``.
+            #
+            #     Note: The following fields are mutually exclusive: `exact`, `prefix`, `suffix`, `contains`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+            # @!attribute [rw] prefix
+            #   @return [::String]
+            #     The input string must have the prefix specified here.
+            #     Note: empty prefix is not allowed, please use regex instead.
+            #
+            #     Examples:
+            #
+            #     * ``abc`` matches the value ``abc.xyz``
+            #
+            #     Note: The following fields are mutually exclusive: `prefix`, `exact`, `suffix`, `contains`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+            # @!attribute [rw] suffix
+            #   @return [::String]
+            #     The input string must have the suffix specified here.
+            #     Note: empty prefix is not allowed, please use regex instead.
+            #
+            #     Examples:
+            #
+            #     * ``abc`` matches the value ``xyz.abc``
+            #
+            #     Note: The following fields are mutually exclusive: `suffix`, `exact`, `prefix`, `contains`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+            # @!attribute [rw] contains
+            #   @return [::String]
+            #     The input string must have the substring specified here.
+            #     Note: empty contains match is not allowed, please use regex instead.
+            #
+            #     Examples:
+            #
+            #     * ``abc`` matches the value ``xyz.abc.def``
+            #
+            #     Note: The following fields are mutually exclusive: `contains`, `exact`, `prefix`, `suffix`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+            # @!attribute [rw] ignore_case
+            #   @return [::Boolean]
+            #     If true, indicates the exact/prefix/suffix/contains matching should be
+            #     case insensitive. For example, the matcher ``data`` will match both
+            #     input string ``Data`` and ``data`` if set to true.
+            class StringMatch
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # Represents a range of IP Addresses.
+            # @!attribute [rw] prefix
+            #   @return [::String]
+            #     Required. The address prefix.
+            # @!attribute [rw] length
+            #   @return [::Integer]
+            #     Required. The length of the address range.
+            class IpBlock
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # Describes the properties of a client VM resource accessing the internal
+            # application load balancers.
+            # @!attribute [rw] tag_value_id_set
+            #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::RequestResource::TagValueIdSet]
+            #     Optional. A list of resource tag value permanent IDs to match against
+            #     the resource manager tags value associated with the source VM of a
+            #     request.
+            # @!attribute [rw] iam_service_account
+            #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch]
+            #     Optional. An IAM service account to match against the source
+            #     service account of the VM sending the request.
+            class RequestResource
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+
+              # Describes a set of resource tag value permanent IDs to match against
+              # the resource manager tags value associated with the source VM of a
+              # request.
+              # @!attribute [rw] ids
+              #   @return [::Array<::Integer>]
+              #     Required. A list of resource tag value permanent IDs to match against
+              #     the resource manager tags value associated with the source VM of a
+              #     request. The match follows AND semantics which means all
+              #     the ids must match. Limited to 5 ids in the Tag value id set.
+              class TagValueIdSet
+                include ::Google::Protobuf::MessageExts
+                extend ::Google::Protobuf::MessageExts::ClassMethods
+              end
+            end
+
+            # Determines how a HTTP header should be matched.
+            # @!attribute [rw] name
+            #   @return [::String]
+            #     Optional. Specifies the name of the header in the request.
+            # @!attribute [rw] value
+            #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch]
+            #     Optional. Specifies how the header match will be performed.
+            class HeaderMatch
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # Describes the properties of a principal to be matched against.
+            # @!attribute [rw] principal_selector
+            #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::Principal::PrincipalSelector]
+            #     Optional. An enum to decide what principal value the principal rule
+            #     will match against. If not specified, the PrincipalSelector is
+            #     CLIENT_CERT_URI_SAN.
+            # @!attribute [rw] principal
+            #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch]
+            #     Required. A non-empty string whose value is matched against the
+            #     principal value based on the principal_selector. Only exact match can
+            #     be applied for CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN,
+            #     CLIENT_CERT_COMMON_NAME selectors.
+            class Principal
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+
+              # The principal value the principal rule will match against.
+              module PrincipalSelector
+                # Unspecified principal selector. It will be treated as
+                # CLIENT_CERT_URI_SAN by default.
+                PRINCIPAL_SELECTOR_UNSPECIFIED = 0
+
+                # The principal rule is matched against a list of URI SANs in the
+                # validated client's certificate. A match happens when there is any
+                # exact URI SAN value match. This is the default principal selector.
+                CLIENT_CERT_URI_SAN = 1
+
+                # The principal rule is matched against a list of DNS Name SANs in the
+                # validated client's certificate. A match happens when there is any
+                # exact DNS Name SAN value match.
+                # This is only applicable for Application Load Balancers
+                # except for classic Global External Application load balancer.
+                # CLIENT_CERT_DNS_NAME_SAN is not supported for INTERNAL_SELF_MANAGED
+                # load balancing scheme.
+                CLIENT_CERT_DNS_NAME_SAN = 2
+
+                # The principal rule is matched against the common name in the client's
+                # certificate. Authorization against multiple common names in the
+                # client certificate is not supported. Requests with multiple common
+                # names in the client certificate will be rejected if
+                # CLIENT_CERT_COMMON_NAME is set as the principal selector. A match
+                # happens when there is an exact common name value match.
+                # This is only applicable for Application Load Balancers
+                # except for global external Application Load Balancer and
+                # classic Application Load Balancer.
+                # CLIENT_CERT_COMMON_NAME is not supported for INTERNAL_SELF_MANAGED
+                # load balancing scheme.
+                CLIENT_CERT_COMMON_NAME = 3
+              end
+            end
+
+            # Describes properties of one or more sources of a request.
+            # @!attribute [rw] sources
+            #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::From::RequestSource>]
+            #     Optional. Describes the properties of a request's sources. At least one
+            #     of sources or notSources must be specified. Limited to 1 source.
+            #     A match occurs when ANY source (in sources or notSources) matches the
+            #     request. Within a single source, the match follows AND semantics
+            #     across fields and OR semantics within a single field, i.e. a match
+            #     occurs when ANY principal matches AND ANY ipBlocks match.
+            # @!attribute [rw] not_sources
+            #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::From::RequestSource>]
+            #     Optional. Describes the negated properties of request sources. Matches
+            #     requests from sources that do not match the criteria specified in this
+            #     field. At least one of sources or notSources must be specified.
+            class From
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+
+              # Describes the properties of a single source.
+              # @!attribute [rw] principals
+              #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::Principal>]
+              #     Optional. A list of identities derived from the client's certificate.
+              #     This field will not match on a request unless frontend mutual TLS is
+              #     enabled for the forwarding rule or Gateway and the client certificate
+              #     has been successfully validated by mTLS.
+              #     Each identity is a string whose value is matched against a list of
+              #     URI SANs, DNS Name SANs, or the common name in the client's
+              #     certificate. A match happens when any principal matches with the
+              #     rule. Limited to 50 principals per Authorization Policy for regional
+              #     internal Application Load Balancers, regional external Application
+              #     Load Balancers, cross-region internal Application Load Balancers, and
+              #     Cloud Service Mesh. This field is not supported for global external
+              #     Application Load Balancers.
+              # @!attribute [rw] ip_blocks
+              #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::IpBlock>]
+              #     Optional. A list of IP addresses or IP address ranges to match
+              #     against the source IP address of the request. Limited to 10 ip_blocks
+              #     per Authorization Policy
+              # @!attribute [rw] resources
+              #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::RequestResource>]
+              #     Optional. A list of resources to match against the resource of the
+              #     source VM of a request. Limited to 10 resources per Authorization
+              #     Policy.
+              class RequestSource
+                include ::Google::Protobuf::MessageExts
+                extend ::Google::Protobuf::MessageExts::ClassMethods
+              end
+            end
+
+            # Describes properties of one or more targets of a request.
+            # @!attribute [rw] operations
+            #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To::RequestOperation>]
+            #     Optional. Describes properties of one or more targets of a request. At
+            #     least one of operations or notOperations must be specified. Limited to
+            #     1 operation. A match occurs when ANY operation (in operations or
+            #     notOperations) matches. Within an operation, the match follows AND
+            #     semantics across fields and OR semantics within a field, i.e. a match
+            #     occurs when ANY path matches AND ANY header matches and ANY method
+            #     matches.
+            # @!attribute [rw] not_operations
+            #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To::RequestOperation>]
+            #     Optional. Describes the negated properties of the targets of a request.
+            #     Matches requests for operations that do not match the criteria
+            #     specified in this field. At least one of operations or notOperations
+            #     must be specified.
+            class To
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+
+              # Describes properties of one or more targets of a request.
+              # @!attribute [rw] header_set
+              #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To::RequestOperation::HeaderSet]
+              #     Optional. A list of headers to match against in http header.
+              # @!attribute [rw] hosts
+              #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch>]
+              #     Optional. A list of HTTP Hosts to match against. The match can be one
+              #     of exact, prefix, suffix, or contains (substring match). Matches are
+              #     always case sensitive unless the ignoreCase is set. Limited to 10
+              #     hosts per Authorization Policy.
+              # @!attribute [rw] paths
+              #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch>]
+              #     Optional. A list of paths to match against. The match can be one of
+              #     exact, prefix, suffix, or contains (substring match). Matches are
+              #     always case sensitive unless the ignoreCase is set. Limited to 10
+              #     paths per Authorization Policy.
+              #     Note that this path match includes the query parameters. For gRPC
+              #     services, this should be a fully-qualified name of the form
+              #     /package.service/method.
+              # @!attribute [rw] methods
+              #   @return [::Array<::String>]
+              #     Optional. A list of HTTP methods to match against. Each entry must be
+              #     a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE,
+              #     OPTIONS). It only allows exact match and is always case sensitive.
+              #     Limited to 10 methods per Authorization Policy.
+              # @!attribute [rw] mcp
+              #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To::RequestOperation::MCP]
+              #     Optional. Defines the MCP protocol attributes to match on. If the MCP
+              #     payload in the request body cannot be successfully parsed, the
+              #     request will be denied. This field can be set only for AuthzPolicies
+              #     targeting AgentGateway resources.
+              # @!attribute [rw] snis
+              #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch>]
+              #     Optional. A list of SNIs to match against. The match can be one of
+              #     exact, prefix, suffix, or contains (substring match). If there is no
+              #     SNI (i.e. plaintext HTTP traffic), the request will be denied.
+              #     Matches are always case sensitive unless the ignoreCase is set.
+              #     Limited to 10 SNIs per Authorization Policy.
+              class RequestOperation
+                include ::Google::Protobuf::MessageExts
+                extend ::Google::Protobuf::MessageExts::ClassMethods
+
+                # Describes a set of HTTP headers to match against.
+                # @!attribute [rw] headers
+                #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::HeaderMatch>]
+                #     Required. A list of headers to match against in http header.
+                #     The match can be one of exact, prefix, suffix, or contains
+                #     (substring match). The match follows AND semantics which means all
+                #     the headers must match. Matches are always case sensitive unless
+                #     the ignoreCase is set. Limited to 10 headers per Authorization
+                #     Policy.
+                class HeaderSet
+                  include ::Google::Protobuf::MessageExts
+                  extend ::Google::Protobuf::MessageExts::ClassMethods
+                end
+
+                # Describes a set of MCP methods to match against.
+                # @!attribute [rw] name
+                #   @return [::String]
+                #     Required. The MCP method to match against. Allowed values are as
+                #     follows:
+                #     1. `tools`, `prompts`, `resources` - these will match against all
+                #        sub methods under the respective methods.
+                #     2. `prompts/list`, `tools/list`, `resources/list`,
+                #        `resources/templates/list`
+                #     3. `prompts/get`, `tools/call`, `resources/subscribe`,
+                #        `resources/unsubscribe`, `resources/read`
+                #     Params cannot be specified for categories 1 and 2.
+                # @!attribute [rw] params
+                #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::StringMatch>]
+                #     Optional. A list of MCP method parameters to match against. The
+                #     match can be one of exact, prefix, suffix, or contains (substring
+                #     match). Matches are always case sensitive unless the ignoreCase is
+                #     set. Limited to 10 MCP method parameters per Authorization Policy.
+                class MCPMethod
+                  include ::Google::Protobuf::MessageExts
+                  extend ::Google::Protobuf::MessageExts::ClassMethods
+                end
+
+                # Describes a set of MCP protocol attributes to match against for a
+                # given MCP request.
+                # @!attribute [rw] base_protocol_methods_option
+                #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To::RequestOperation::BaseProtocolMethodsOption]
+                #     Optional. If specified, matches on the MCP protocol’s non-access
+                #     specific methods namely:
+                #     * initialize
+                #     * completion/
+                #     * logging/
+                #     * notifications/
+                #     * ping
+                #     Defaults to SKIP_BASE_PROTOCOL_METHODS if not specified.
+                # @!attribute [rw] methods
+                #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::AuthzRule::To::RequestOperation::MCPMethod>]
+                #     Optional. A list of MCP methods and associated parameters to match
+                #     on. It is recommended to use this field to match on tools, prompts
+                #     and resource accesses while setting the baseProtocolMethodsOption
+                #     to MATCH_BASE_PROTOCOL_METHODS to match on all the other MCP
+                #     protocol methods.
+                #     Limited to 10 MCP methods per Authorization Policy.
+                class MCP
+                  include ::Google::Protobuf::MessageExts
+                  extend ::Google::Protobuf::MessageExts::ClassMethods
+                end
+
+                # Describes the option to match against the base MCP protocol methods.
+                module BaseProtocolMethodsOption
+                  # Unspecified option. Defaults to SKIP_BASE_PROTOCOL_METHODS.
+                  BASE_PROTOCOL_METHODS_OPTION_UNSPECIFIED = 0
+
+                  # Skip matching on the base MCP protocol methods.
+                  SKIP_BASE_PROTOCOL_METHODS = 1
+
+                  # Match on the base MCP protocol methods.
+                  MATCH_BASE_PROTOCOL_METHODS = 2
+                end
+              end
+            end
+          end
+
+          # Allows delegating authorization decisions to Cloud IAP or to
+          # Service Extensions.
+          # @!attribute [rw] cloud_iap
+          #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::CustomProvider::CloudIap]
+          #     Optional. Delegates authorization decisions to Cloud IAP. Applicable
+          #     only for managed load balancers. Enabling Cloud IAP at the AuthzPolicy
+          #     level is not compatible with Cloud IAP settings in the BackendService.
+          #     Enabling IAP in both places will result in request failure. Ensure that
+          #     IAP is enabled in either the AuthzPolicy or the BackendService but not in
+          #     both places.
+          # @!attribute [rw] authz_extension
+          #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy::CustomProvider::AuthzExtension]
+          #     Optional. Delegate authorization decision to user authored Service
+          #     Extension. Only one of cloudIap or authzExtension can be specified.
+          class CustomProvider
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Optional. Delegates authorization decisions to Cloud IAP. Applicable
+            # only for managed load balancers. Enabling Cloud IAP at the AuthzPolicy
+            # level is not compatible with Cloud IAP settings in the BackendService.
+            # Enabling IAP in both places will result in request failure. Ensure that
+            # IAP is enabled in either the AuthzPolicy or the BackendService but not in
+            # both places.
+            class CloudIap
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+
+            # Optional. Delegate authorization decision to user authored extension.
+            # Only one of cloudIap or authzExtension can be specified.
+            # @!attribute [rw] resources
+            #   @return [::Array<::String>]
+            #     Required. A list of references to authorization
+            #     extensions that will be invoked for requests matching this policy.
+            #     Limited to 1 custom provider.
+            class AuthzExtension
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
+
+          # @!attribute [rw] key
+          #   @return [::String]
+          # @!attribute [rw] value
+          #   @return [::String]
+          class LabelsEntry
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # Load balancing schemes supported by the `AuthzPolicy` resource. The valid
+          # values are `INTERNAL_MANAGED` and
+          # `EXTERNAL_MANAGED`. For more information, refer to [Backend services
+          # overview](https://cloud.google.com/load-balancing/docs/backend-service).
+          module LoadBalancingScheme
+            # Default value. Do not use.
+            LOAD_BALANCING_SCHEME_UNSPECIFIED = 0
+
+            # Signifies that this is used for Regional internal or Cross-region
+            # internal Application Load Balancing.
+            INTERNAL_MANAGED = 1
+
+            # Signifies that this is used for Global external or Regional external
+            # Application Load Balancing.
+            EXTERNAL_MANAGED = 2
+
+            # Signifies that this is used for Cloud Service Mesh. Meant for use by
+            # CSM GKE controller only.
+            INTERNAL_SELF_MANAGED = 3
+          end
+
+          # The action to be applied to this policy. Valid values are
+          # `ALLOW`, `DENY`, `CUSTOM`.
+          module AuthzAction
+            # Unspecified action.
+            AUTHZ_ACTION_UNSPECIFIED = 0
+
+            # Allow request to pass through to the backend.
+            ALLOW = 1
+
+            # Deny the request and return a HTTP 404 to the client.
+            DENY = 2
+
+            # Delegate the authorization decision to an external authorization engine.
+            CUSTOM = 3
+          end
+
+          # The type of authorization being performed.
+          # New values may be added in the future.
+          module PolicyProfile
+            # Unspecified policy profile.
+            POLICY_PROFILE_UNSPECIFIED = 0
+
+            # Applies to request authorization. `CUSTOM` authorization
+            # policies with Authz extensions will be allowed with `EXT_AUTHZ_GRPC` or
+            # `EXT_PROC_GRPC` protocols. Extensions are invoked only for request header
+            # events.
+            REQUEST_AUTHZ = 1
+
+            # Applies to content security, sanitization, etc. Only
+            # `CUSTOM` action is allowed in this policy profile. AuthzExtensions in the
+            # custom provider must support `EXT_PROC_GRPC` protocol only and be capable
+            # of receiving all `EXT_PROC_GRPC` events (REQUEST_HEADERS, REQUEST_BODY,
+            # REQUEST_TRAILERS, RESPONSE_HEADERS, RESPONSE_BODY, RESPONSE_TRAILERS)
+            # with `FULL_DUPLEX_STREAMED` body send mode.
+            CONTENT_AUTHZ = 2
+          end
+        end
+
+        # Message for creating an `AuthzPolicy` resource.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The parent resource of the `AuthzPolicy` resource. Must be in
+        #     the format `projects/{project}/locations/{location}`.
+        # @!attribute [rw] authz_policy_id
+        #   @return [::String]
+        #     Required. User-provided ID of the `AuthzPolicy` resource to be created.
+        # @!attribute [rw] authz_policy
+        #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy]
+        #     Required. `AuthzPolicy` resource to be created.
+        # @!attribute [rw] request_id
+        #   @return [::String]
+        #     Optional. An optional request ID to identify requests. Specify a unique
+        #     request ID so that if you must retry your request, the server can ignore
+        #     the request if it has already been completed. The server guarantees
+        #     that for at least 60 minutes since the first request.
+        #
+        #     For example, consider a situation where you make an initial request and the
+        #     request times out. If you make the request again with the same request
+        #     ID, the server can check if original operation with the same request ID
+        #     was received, and if so, ignores the second request. This prevents
+        #     clients from accidentally creating duplicate commitments.
+        #
+        #     The request ID must be a valid UUID with the exception that zero UUID is
+        #     not supported (00000000-0000-0000-0000-000000000000).
+        class CreateAuthzPolicyRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Message for requesting list of `AuthzPolicy` resources.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The project and location from which the `AuthzPolicy` resources
+        #     are listed, specified in the following format:
+        #     `projects/{project}/locations/{location}`.
+        # @!attribute [rw] page_size
+        #   @return [::Integer]
+        #     Optional. Requested page size. The server might return fewer items than
+        #     requested. If unspecified, the server picks an appropriate default.
+        # @!attribute [rw] page_token
+        #   @return [::String]
+        #     Optional. A token identifying a page of results that the server returns.
+        # @!attribute [rw] filter
+        #   @return [::String]
+        #     Optional. Filtering results.
+        # @!attribute [rw] order_by
+        #   @return [::String]
+        #     Optional. Hint for how to order the results.
+        class ListAuthzPoliciesRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Message for response to listing `AuthzPolicy` resources.
+        # @!attribute [rw] authz_policies
+        #   @return [::Array<::Google::Cloud::NetworkSecurity::V1::AuthzPolicy>]
+        #     The list of `AuthzPolicy` resources.
+        # @!attribute [rw] next_page_token
+        #   @return [::String]
+        #     A token identifying a page of results that the server returns.
+        # @!attribute [rw] unreachable
+        #   @return [::Array<::String>]
+        #     Locations that could not be reached.
+        class ListAuthzPoliciesResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Message for getting a `AuthzPolicy` resource.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. A name of the `AuthzPolicy` resource to get. Must be in the
+        #     format
+        #     `projects/{project}/locations/{location}/authzPolicies/{authz_policy}`.
+        class GetAuthzPolicyRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Message for updating an `AuthzPolicy` resource.
+        # @!attribute [rw] update_mask
+        #   @return [::Google::Protobuf::FieldMask]
+        #     Required. Used to specify the fields to be overwritten in the
+        #     `AuthzPolicy` resource by the update.
+        #     The fields specified in the `update_mask` are relative to the resource, not
+        #     the full request. A field is overwritten if it is in the mask. If the
+        #     user does not specify a mask, then all fields are overwritten.
+        # @!attribute [rw] authz_policy
+        #   @return [::Google::Cloud::NetworkSecurity::V1::AuthzPolicy]
+        #     Required. `AuthzPolicy` resource being updated.
+        # @!attribute [rw] request_id
+        #   @return [::String]
+        #     Optional. An optional request ID to identify requests. Specify a unique
+        #     request ID so that if you must retry your request, the server can ignore
+        #     the request if it has already been completed. The server guarantees
+        #     that for at least 60 minutes since the first request.
+        #
+        #     For example, consider a situation where you make an initial request and the
+        #     request times out. If you make the request again with the same request
+        #     ID, the server can check if original operation with the same request ID
+        #     was received, and if so, ignores the second request. This prevents
+        #     clients from accidentally creating duplicate commitments.
+        #
+        #     The request ID must be a valid UUID with the exception that zero UUID is
+        #     not supported (00000000-0000-0000-0000-000000000000).
+        class UpdateAuthzPolicyRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Message for deleting an `AuthzPolicy` resource.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Required. The name of the `AuthzPolicy` resource to delete. Must be in
+        #     the format
+        #     `projects/{project}/locations/{location}/authzPolicies/{authz_policy}`.
+        # @!attribute [rw] request_id
+        #   @return [::String]
+        #     Optional. An optional request ID to identify requests. Specify a unique
+        #     request ID so that if you must retry your request, the server can ignore
+        #     the request if it has already been completed. The server guarantees
+        #     that for at least 60 minutes after the first request.
+        #
+        #     For example, consider a situation where you make an initial request and the
+        #     request times out. If you make the request again with the same request
+        #     ID, the server can check if original operation with the same request ID
+        #     was received, and if so, ignores the second request. This prevents
+        #     clients from accidentally creating duplicate commitments.
+        #
+        #     The request ID must be a valid UUID with the exception that zero UUID is
+        #     not supported (00000000-0000-0000-0000-000000000000).
+        class DeleteAuthzPolicyRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+      end
+    end
+  end
+end