google-cloud-service_directory-v1beta1 0.7.2 → 0.8.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.yardopts +1 -1
- data/AUTHENTICATION.md +7 -25
- data/README.md +1 -1
- data/lib/google/cloud/service_directory/v1beta1/lookup_service/client.rb +20 -3
- data/lib/google/cloud/service_directory/v1beta1/registration_service/client.rb +386 -56
- data/lib/google/cloud/service_directory/v1beta1/version.rb +1 -1
- data/lib/google/cloud/service_directory/v1beta1.rb +2 -0
- data/lib/google/cloud/servicedirectory/v1beta1/endpoint_pb.rb +2 -2
- data/lib/google/cloud/servicedirectory/v1beta1/lookup_service_pb.rb +2 -2
- data/lib/google/cloud/servicedirectory/v1beta1/lookup_service_services_pb.rb +1 -1
- data/lib/google/cloud/servicedirectory/v1beta1/namespace_pb.rb +2 -2
- data/lib/google/cloud/servicedirectory/v1beta1/registration_service_pb.rb +2 -2
- data/lib/google/cloud/servicedirectory/v1beta1/registration_service_services_pb.rb +1 -1
- data/lib/google/cloud/servicedirectory/v1beta1/service_pb.rb +2 -2
- data/proto_docs/google/api/resource.rb +10 -71
- data/proto_docs/google/iam/v1/iam_policy.rb +8 -1
- data/proto_docs/google/iam/v1/options.rb +14 -4
- data/proto_docs/google/iam/v1/policy.rb +208 -38
- metadata +7 -13
@@ -26,6 +26,8 @@ module Google
|
|
26
26
|
##
|
27
27
|
# To load this package, including all its services, and instantiate a client:
|
28
28
|
#
|
29
|
+
# @example
|
30
|
+
#
|
29
31
|
# require "google/cloud/service_directory/v1beta1"
|
30
32
|
# client = ::Google::Cloud::ServiceDirectory::V1beta1::LookupService::Client.new
|
31
33
|
#
|
@@ -1,12 +1,12 @@
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
2
2
|
# source: google/cloud/servicedirectory/v1beta1/endpoint.proto
|
3
3
|
|
4
|
-
require 'google/protobuf'
|
5
|
-
|
6
4
|
require 'google/api/field_behavior_pb'
|
7
5
|
require 'google/api/resource_pb'
|
8
6
|
require 'google/protobuf/timestamp_pb'
|
9
7
|
require 'google/api/annotations_pb'
|
8
|
+
require 'google/protobuf'
|
9
|
+
|
10
10
|
Google::Protobuf::DescriptorPool.generated_pool.build do
|
11
11
|
add_file("google/cloud/servicedirectory/v1beta1/endpoint.proto", :syntax => :proto3) do
|
12
12
|
add_message "google.cloud.servicedirectory.v1beta1.Endpoint" do
|
@@ -1,13 +1,13 @@
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
2
2
|
# source: google/cloud/servicedirectory/v1beta1/lookup_service.proto
|
3
3
|
|
4
|
-
require 'google/protobuf'
|
5
|
-
|
6
4
|
require 'google/api/annotations_pb'
|
7
5
|
require 'google/api/field_behavior_pb'
|
8
6
|
require 'google/api/resource_pb'
|
9
7
|
require 'google/cloud/servicedirectory/v1beta1/service_pb'
|
10
8
|
require 'google/api/client_pb'
|
9
|
+
require 'google/protobuf'
|
10
|
+
|
11
11
|
Google::Protobuf::DescriptorPool.generated_pool.build do
|
12
12
|
add_file("google/cloud/servicedirectory/v1beta1/lookup_service.proto", :syntax => :proto3) do
|
13
13
|
add_message "google.cloud.servicedirectory.v1beta1.ResolveServiceRequest" do
|
@@ -1,12 +1,12 @@
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
2
2
|
# source: google/cloud/servicedirectory/v1beta1/namespace.proto
|
3
3
|
|
4
|
-
require 'google/protobuf'
|
5
|
-
|
6
4
|
require 'google/api/field_behavior_pb'
|
7
5
|
require 'google/api/resource_pb'
|
8
6
|
require 'google/protobuf/timestamp_pb'
|
9
7
|
require 'google/api/annotations_pb'
|
8
|
+
require 'google/protobuf'
|
9
|
+
|
10
10
|
Google::Protobuf::DescriptorPool.generated_pool.build do
|
11
11
|
add_file("google/cloud/servicedirectory/v1beta1/namespace.proto", :syntax => :proto3) do
|
12
12
|
add_message "google.cloud.servicedirectory.v1beta1.Namespace" do
|
@@ -1,8 +1,6 @@
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
2
2
|
# source: google/cloud/servicedirectory/v1beta1/registration_service.proto
|
3
3
|
|
4
|
-
require 'google/protobuf'
|
5
|
-
|
6
4
|
require 'google/api/annotations_pb'
|
7
5
|
require 'google/api/client_pb'
|
8
6
|
require 'google/api/field_behavior_pb'
|
@@ -14,6 +12,8 @@ require 'google/iam/v1/iam_policy_pb'
|
|
14
12
|
require 'google/iam/v1/policy_pb'
|
15
13
|
require 'google/protobuf/empty_pb'
|
16
14
|
require 'google/protobuf/field_mask_pb'
|
15
|
+
require 'google/protobuf'
|
16
|
+
|
17
17
|
Google::Protobuf::DescriptorPool.generated_pool.build do
|
18
18
|
add_file("google/cloud/servicedirectory/v1beta1/registration_service.proto", :syntax => :proto3) do
|
19
19
|
add_message "google.cloud.servicedirectory.v1beta1.CreateNamespaceRequest" do
|
@@ -1,13 +1,13 @@
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
2
2
|
# source: google/cloud/servicedirectory/v1beta1/service.proto
|
3
3
|
|
4
|
-
require 'google/protobuf'
|
5
|
-
|
6
4
|
require 'google/api/field_behavior_pb'
|
7
5
|
require 'google/api/resource_pb'
|
8
6
|
require 'google/cloud/servicedirectory/v1beta1/endpoint_pb'
|
9
7
|
require 'google/protobuf/timestamp_pb'
|
10
8
|
require 'google/api/annotations_pb'
|
9
|
+
require 'google/protobuf'
|
10
|
+
|
11
11
|
Google::Protobuf::DescriptorPool.generated_pool.build do
|
12
12
|
add_file("google/cloud/servicedirectory/v1beta1/service.proto", :syntax => :proto3) do
|
13
13
|
add_message "google.cloud.servicedirectory.v1beta1.Service" do
|
@@ -33,11 +33,7 @@ module Google
|
|
33
33
|
# // For Kubernetes resources, the format is {api group}/{kind}.
|
34
34
|
# option (google.api.resource) = {
|
35
35
|
# type: "pubsub.googleapis.com/Topic"
|
36
|
-
#
|
37
|
-
# pattern: "projects/{project}/topics/{topic}"
|
38
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
39
|
-
# parent_name_extractor: "projects/{project}"
|
40
|
-
# }
|
36
|
+
# pattern: "projects/{project}/topics/{topic}"
|
41
37
|
# };
|
42
38
|
# }
|
43
39
|
#
|
@@ -45,10 +41,7 @@ module Google
|
|
45
41
|
#
|
46
42
|
# resources:
|
47
43
|
# - type: "pubsub.googleapis.com/Topic"
|
48
|
-
#
|
49
|
-
# - pattern: "projects/{project}/topics/{topic}"
|
50
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
51
|
-
# parent_name_extractor: "projects/{project}"
|
44
|
+
# pattern: "projects/{project}/topics/{topic}"
|
52
45
|
#
|
53
46
|
# Sometimes, resources have multiple patterns, typically because they can
|
54
47
|
# live under multiple parents.
|
@@ -58,26 +51,10 @@ module Google
|
|
58
51
|
# message LogEntry {
|
59
52
|
# option (google.api.resource) = {
|
60
53
|
# type: "logging.googleapis.com/LogEntry"
|
61
|
-
#
|
62
|
-
#
|
63
|
-
#
|
64
|
-
#
|
65
|
-
# }
|
66
|
-
# name_descriptor: {
|
67
|
-
# pattern: "folders/{folder}/logs/{log}"
|
68
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
69
|
-
# parent_name_extractor: "folders/{folder}"
|
70
|
-
# }
|
71
|
-
# name_descriptor: {
|
72
|
-
# pattern: "organizations/{organization}/logs/{log}"
|
73
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Organization"
|
74
|
-
# parent_name_extractor: "organizations/{organization}"
|
75
|
-
# }
|
76
|
-
# name_descriptor: {
|
77
|
-
# pattern: "billingAccounts/{billing_account}/logs/{log}"
|
78
|
-
# parent_type: "billing.googleapis.com/BillingAccount"
|
79
|
-
# parent_name_extractor: "billingAccounts/{billing_account}"
|
80
|
-
# }
|
54
|
+
# pattern: "projects/{project}/logs/{log}"
|
55
|
+
# pattern: "folders/{folder}/logs/{log}"
|
56
|
+
# pattern: "organizations/{organization}/logs/{log}"
|
57
|
+
# pattern: "billingAccounts/{billing_account}/logs/{log}"
|
81
58
|
# };
|
82
59
|
# }
|
83
60
|
#
|
@@ -85,48 +62,10 @@ module Google
|
|
85
62
|
#
|
86
63
|
# resources:
|
87
64
|
# - type: 'logging.googleapis.com/LogEntry'
|
88
|
-
#
|
89
|
-
#
|
90
|
-
#
|
91
|
-
#
|
92
|
-
# - pattern: "folders/{folder}/logs/{log}"
|
93
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
94
|
-
# parent_name_extractor: "folders/{folder}"
|
95
|
-
# - pattern: "organizations/{organization}/logs/{log}"
|
96
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Organization"
|
97
|
-
# parent_name_extractor: "organizations/{organization}"
|
98
|
-
# - pattern: "billingAccounts/{billing_account}/logs/{log}"
|
99
|
-
# parent_type: "billing.googleapis.com/BillingAccount"
|
100
|
-
# parent_name_extractor: "billingAccounts/{billing_account}"
|
101
|
-
#
|
102
|
-
# For flexible resources, the resource name doesn't contain parent names, but
|
103
|
-
# the resource itself has parents for policy evaluation.
|
104
|
-
#
|
105
|
-
# Example:
|
106
|
-
#
|
107
|
-
# message Shelf {
|
108
|
-
# option (google.api.resource) = {
|
109
|
-
# type: "library.googleapis.com/Shelf"
|
110
|
-
# name_descriptor: {
|
111
|
-
# pattern: "shelves/{shelf}"
|
112
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
113
|
-
# }
|
114
|
-
# name_descriptor: {
|
115
|
-
# pattern: "shelves/{shelf}"
|
116
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
117
|
-
# }
|
118
|
-
# };
|
119
|
-
# }
|
120
|
-
#
|
121
|
-
# The ResourceDescriptor Yaml config will look like:
|
122
|
-
#
|
123
|
-
# resources:
|
124
|
-
# - type: 'library.googleapis.com/Shelf'
|
125
|
-
# name_descriptor:
|
126
|
-
# - pattern: "shelves/{shelf}"
|
127
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
128
|
-
# - pattern: "shelves/{shelf}"
|
129
|
-
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
65
|
+
# pattern: "projects/{project}/logs/{log}"
|
66
|
+
# pattern: "folders/{folder}/logs/{log}"
|
67
|
+
# pattern: "organizations/{organization}/logs/{log}"
|
68
|
+
# pattern: "billingAccounts/{billing_account}/logs/{log}"
|
130
69
|
# @!attribute [rw] type
|
131
70
|
# @return [::String]
|
132
71
|
# The resource type. It must be in the format of
|
@@ -31,6 +31,13 @@ module Google
|
|
31
31
|
# the policy is limited to a few 10s of KB. An empty policy is a
|
32
32
|
# valid policy but certain Cloud Platform services (such as Projects)
|
33
33
|
# might reject them.
|
34
|
+
# @!attribute [rw] update_mask
|
35
|
+
# @return [::Google::Protobuf::FieldMask]
|
36
|
+
# OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
|
37
|
+
# the fields in the mask will be modified. If no mask is provided, the
|
38
|
+
# following default mask is used:
|
39
|
+
#
|
40
|
+
# `paths: "bindings, etag"`
|
34
41
|
class SetIamPolicyRequest
|
35
42
|
include ::Google::Protobuf::MessageExts
|
36
43
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
@@ -44,7 +51,7 @@ module Google
|
|
44
51
|
# @!attribute [rw] options
|
45
52
|
# @return [::Google::Iam::V1::GetPolicyOptions]
|
46
53
|
# OPTIONAL: A `GetPolicyOptions` object for specifying options to
|
47
|
-
# `GetIamPolicy`.
|
54
|
+
# `GetIamPolicy`.
|
48
55
|
class GetIamPolicyRequest
|
49
56
|
include ::Google::Protobuf::MessageExts
|
50
57
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
@@ -23,14 +23,24 @@ module Google
|
|
23
23
|
# Encapsulates settings provided to GetIamPolicy.
|
24
24
|
# @!attribute [rw] requested_policy_version
|
25
25
|
# @return [::Integer]
|
26
|
-
# Optional. The policy
|
26
|
+
# Optional. The maximum policy version that will be used to format the
|
27
|
+
# policy.
|
27
28
|
#
|
28
29
|
# Valid values are 0, 1, and 3. Requests specifying an invalid value will be
|
29
30
|
# rejected.
|
30
31
|
#
|
31
|
-
# Requests for policies with any conditional bindings must specify
|
32
|
-
# Policies
|
33
|
-
# leave the field unset.
|
32
|
+
# Requests for policies with any conditional role bindings must specify
|
33
|
+
# version 3. Policies with no conditional role bindings may specify any valid
|
34
|
+
# value or leave the field unset.
|
35
|
+
#
|
36
|
+
# The policy in the response might use the policy version that you specified,
|
37
|
+
# or it might use a lower policy version. For example, if you specify version
|
38
|
+
# 3, but the policy has no conditional role bindings, the response uses
|
39
|
+
# version 1.
|
40
|
+
#
|
41
|
+
# To learn which resources support conditions in their IAM policies, see the
|
42
|
+
# [IAM
|
43
|
+
# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
|
34
44
|
class GetPolicyOptions
|
35
45
|
include ::Google::Protobuf::MessageExts
|
36
46
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
@@ -20,19 +20,24 @@
|
|
20
20
|
module Google
|
21
21
|
module Iam
|
22
22
|
module V1
|
23
|
-
#
|
24
|
-
#
|
23
|
+
# An Identity and Access Management (IAM) policy, which specifies access
|
24
|
+
# controls for Google Cloud resources.
|
25
25
|
#
|
26
26
|
#
|
27
27
|
# A `Policy` is a collection of `bindings`. A `binding` binds one or more
|
28
|
-
# `members
|
29
|
-
# Google groups, and domains (such as G Suite). A
|
30
|
-
#
|
31
|
-
#
|
32
|
-
# constrains the role binding based on attributes about the request and/or
|
33
|
-
# target resource.
|
28
|
+
# `members`, or principals, to a single `role`. Principals can be user
|
29
|
+
# accounts, service accounts, Google groups, and domains (such as G Suite). A
|
30
|
+
# `role` is a named list of permissions; each `role` can be an IAM predefined
|
31
|
+
# role or a user-created custom role.
|
34
32
|
#
|
35
|
-
#
|
33
|
+
# For some types of Google Cloud resources, a `binding` can also specify a
|
34
|
+
# `condition`, which is a logical expression that allows access to a resource
|
35
|
+
# only if the expression evaluates to `true`. A condition can add constraints
|
36
|
+
# based on attributes of the request, the resource, or both. To learn which
|
37
|
+
# resources support conditions in their IAM policies, see the
|
38
|
+
# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
|
39
|
+
#
|
40
|
+
# **JSON example:**
|
36
41
|
#
|
37
42
|
# {
|
38
43
|
# "bindings": [
|
@@ -47,18 +52,21 @@ module Google
|
|
47
52
|
# },
|
48
53
|
# {
|
49
54
|
# "role": "roles/resourcemanager.organizationViewer",
|
50
|
-
# "members": [
|
55
|
+
# "members": [
|
56
|
+
# "user:eve@example.com"
|
57
|
+
# ],
|
51
58
|
# "condition": {
|
52
59
|
# "title": "expirable access",
|
53
60
|
# "description": "Does not grant access after Sep 2020",
|
54
|
-
# "expression": "request.time <
|
55
|
-
# timestamp('2020-10-01T00:00:00.000Z')",
|
61
|
+
# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
|
56
62
|
# }
|
57
63
|
# }
|
58
|
-
# ]
|
64
|
+
# ],
|
65
|
+
# "etag": "BwWWja0YfJA=",
|
66
|
+
# "version": 3
|
59
67
|
# }
|
60
68
|
#
|
61
|
-
# **YAML
|
69
|
+
# **YAML example:**
|
62
70
|
#
|
63
71
|
# bindings:
|
64
72
|
# - members:
|
@@ -74,30 +82,52 @@ module Google
|
|
74
82
|
# title: expirable access
|
75
83
|
# description: Does not grant access after Sep 2020
|
76
84
|
# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
|
85
|
+
# etag: BwWWja0YfJA=
|
86
|
+
# version: 3
|
77
87
|
#
|
78
88
|
# For a description of IAM and its features, see the
|
79
|
-
# [IAM
|
89
|
+
# [IAM documentation](https://cloud.google.com/iam/docs/).
|
80
90
|
# @!attribute [rw] version
|
81
91
|
# @return [::Integer]
|
82
92
|
# Specifies the format of the policy.
|
83
93
|
#
|
84
|
-
# Valid values are 0
|
85
|
-
# rejected.
|
94
|
+
# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
|
95
|
+
# are rejected.
|
96
|
+
#
|
97
|
+
# Any operation that affects conditional role bindings must specify version
|
98
|
+
# `3`. This requirement applies to the following operations:
|
86
99
|
#
|
87
|
-
#
|
88
|
-
#
|
89
|
-
#
|
90
|
-
#
|
91
|
-
#
|
92
|
-
# leave the field unset.
|
100
|
+
# * Getting a policy that includes a conditional role binding
|
101
|
+
# * Adding a conditional role binding to a policy
|
102
|
+
# * Changing a conditional role binding in a policy
|
103
|
+
# * Removing any role binding, with or without a condition, from a policy
|
104
|
+
# that includes conditions
|
93
105
|
#
|
94
|
-
# If
|
95
|
-
#
|
106
|
+
# **Important:** If you use IAM Conditions, you must include the `etag` field
|
107
|
+
# whenever you call `setIamPolicy`. If you omit this field, then IAM allows
|
108
|
+
# you to overwrite a version `3` policy with a version `1` policy, and all of
|
109
|
+
# the conditions in the version `3` policy are lost.
|
110
|
+
#
|
111
|
+
# If a policy does not include any conditions, operations on that policy may
|
112
|
+
# specify any valid version or leave the field unset.
|
113
|
+
#
|
114
|
+
# To learn which resources support conditions in their IAM policies, see the
|
115
|
+
# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
|
96
116
|
# @!attribute [rw] bindings
|
97
117
|
# @return [::Array<::Google::Iam::V1::Binding>]
|
98
|
-
# Associates a list of `members
|
99
|
-
# `condition` that determines when
|
100
|
-
# `bindings`
|
118
|
+
# Associates a list of `members`, or principals, with a `role`. Optionally,
|
119
|
+
# may specify a `condition` that determines how and when the `bindings` are
|
120
|
+
# applied. Each of the `bindings` must contain at least one principal.
|
121
|
+
#
|
122
|
+
# The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
|
123
|
+
# of these principals can be Google groups. Each occurrence of a principal
|
124
|
+
# counts towards these limits. For example, if the `bindings` grant 50
|
125
|
+
# different roles to `user:alice@example.com`, and not to any other
|
126
|
+
# principal, then you can add another 1,450 principals to the `bindings` in
|
127
|
+
# the `Policy`.
|
128
|
+
# @!attribute [rw] audit_configs
|
129
|
+
# @return [::Array<::Google::Iam::V1::AuditConfig>]
|
130
|
+
# Specifies cloud audit logging configuration for this policy.
|
101
131
|
# @!attribute [rw] etag
|
102
132
|
# @return [::String]
|
103
133
|
# `etag` is used for optimistic concurrency control as a way to help
|
@@ -108,23 +138,23 @@ module Google
|
|
108
138
|
# systems are expected to put that etag in the request to `setIamPolicy` to
|
109
139
|
# ensure that their change will be applied to the same version of the policy.
|
110
140
|
#
|
111
|
-
# If
|
112
|
-
#
|
113
|
-
#
|
114
|
-
#
|
141
|
+
# **Important:** If you use IAM Conditions, you must include the `etag` field
|
142
|
+
# whenever you call `setIamPolicy`. If you omit this field, then IAM allows
|
143
|
+
# you to overwrite a version `3` policy with a version `1` policy, and all of
|
144
|
+
# the conditions in the version `3` policy are lost.
|
115
145
|
class Policy
|
116
146
|
include ::Google::Protobuf::MessageExts
|
117
147
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
118
148
|
end
|
119
149
|
|
120
|
-
# Associates `members
|
150
|
+
# Associates `members`, or principals, with a `role`.
|
121
151
|
# @!attribute [rw] role
|
122
152
|
# @return [::String]
|
123
|
-
# Role that is assigned to `members
|
153
|
+
# Role that is assigned to the list of `members`, or principals.
|
124
154
|
# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
|
125
155
|
# @!attribute [rw] members
|
126
156
|
# @return [::Array<::String>]
|
127
|
-
# Specifies the
|
157
|
+
# Specifies the principals requesting access for a Cloud Platform resource.
|
128
158
|
# `members` can have the following values:
|
129
159
|
#
|
130
160
|
# * `allUsers`: A special identifier that represents anyone who is
|
@@ -143,20 +173,160 @@ module Google
|
|
143
173
|
# * `group:{emailid}`: An email address that represents a Google group.
|
144
174
|
# For example, `admins@example.com`.
|
145
175
|
#
|
176
|
+
# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
|
177
|
+
# identifier) representing a user that has been recently deleted. For
|
178
|
+
# example, `alice@example.com?uid=123456789012345678901`. If the user is
|
179
|
+
# recovered, this value reverts to `user:{emailid}` and the recovered user
|
180
|
+
# retains the role in the binding.
|
181
|
+
#
|
182
|
+
# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
|
183
|
+
# unique identifier) representing a service account that has been recently
|
184
|
+
# deleted. For example,
|
185
|
+
# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
|
186
|
+
# If the service account is undeleted, this value reverts to
|
187
|
+
# `serviceAccount:{emailid}` and the undeleted service account retains the
|
188
|
+
# role in the binding.
|
189
|
+
#
|
190
|
+
# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
|
191
|
+
# identifier) representing a Google group that has been recently
|
192
|
+
# deleted. For example, `admins@example.com?uid=123456789012345678901`. If
|
193
|
+
# the group is recovered, this value reverts to `group:{emailid}` and the
|
194
|
+
# recovered group retains the role in the binding.
|
195
|
+
#
|
146
196
|
#
|
147
197
|
# * `domain:{domain}`: The G Suite domain (primary) that represents all the
|
148
198
|
# users of that domain. For example, `google.com` or `example.com`.
|
149
199
|
# @!attribute [rw] condition
|
150
200
|
# @return [::Google::Type::Expr]
|
151
201
|
# The condition that is associated with this binding.
|
152
|
-
#
|
153
|
-
#
|
154
|
-
#
|
202
|
+
#
|
203
|
+
# If the condition evaluates to `true`, then this binding applies to the
|
204
|
+
# current request.
|
205
|
+
#
|
206
|
+
# If the condition evaluates to `false`, then this binding does not apply to
|
207
|
+
# the current request. However, a different role binding might grant the same
|
208
|
+
# role to one or more of the principals in this binding.
|
209
|
+
#
|
210
|
+
# To learn which resources support conditions in their IAM policies, see the
|
211
|
+
# [IAM
|
212
|
+
# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
|
155
213
|
class Binding
|
156
214
|
include ::Google::Protobuf::MessageExts
|
157
215
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
158
216
|
end
|
159
217
|
|
218
|
+
# Specifies the audit configuration for a service.
|
219
|
+
# The configuration determines which permission types are logged, and what
|
220
|
+
# identities, if any, are exempted from logging.
|
221
|
+
# An AuditConfig must have one or more AuditLogConfigs.
|
222
|
+
#
|
223
|
+
# If there are AuditConfigs for both `allServices` and a specific service,
|
224
|
+
# the union of the two AuditConfigs is used for that service: the log_types
|
225
|
+
# specified in each AuditConfig are enabled, and the exempted_members in each
|
226
|
+
# AuditLogConfig are exempted.
|
227
|
+
#
|
228
|
+
# Example Policy with multiple AuditConfigs:
|
229
|
+
#
|
230
|
+
# {
|
231
|
+
# "audit_configs": [
|
232
|
+
# {
|
233
|
+
# "service": "allServices",
|
234
|
+
# "audit_log_configs": [
|
235
|
+
# {
|
236
|
+
# "log_type": "DATA_READ",
|
237
|
+
# "exempted_members": [
|
238
|
+
# "user:jose@example.com"
|
239
|
+
# ]
|
240
|
+
# },
|
241
|
+
# {
|
242
|
+
# "log_type": "DATA_WRITE"
|
243
|
+
# },
|
244
|
+
# {
|
245
|
+
# "log_type": "ADMIN_READ"
|
246
|
+
# }
|
247
|
+
# ]
|
248
|
+
# },
|
249
|
+
# {
|
250
|
+
# "service": "sampleservice.googleapis.com",
|
251
|
+
# "audit_log_configs": [
|
252
|
+
# {
|
253
|
+
# "log_type": "DATA_READ"
|
254
|
+
# },
|
255
|
+
# {
|
256
|
+
# "log_type": "DATA_WRITE",
|
257
|
+
# "exempted_members": [
|
258
|
+
# "user:aliya@example.com"
|
259
|
+
# ]
|
260
|
+
# }
|
261
|
+
# ]
|
262
|
+
# }
|
263
|
+
# ]
|
264
|
+
# }
|
265
|
+
#
|
266
|
+
# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
|
267
|
+
# logging. It also exempts jose@example.com from DATA_READ logging, and
|
268
|
+
# aliya@example.com from DATA_WRITE logging.
|
269
|
+
# @!attribute [rw] service
|
270
|
+
# @return [::String]
|
271
|
+
# Specifies a service that will be enabled for audit logging.
|
272
|
+
# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
|
273
|
+
# `allServices` is a special value that covers all services.
|
274
|
+
# @!attribute [rw] audit_log_configs
|
275
|
+
# @return [::Array<::Google::Iam::V1::AuditLogConfig>]
|
276
|
+
# The configuration for logging of each type of permission.
|
277
|
+
class AuditConfig
|
278
|
+
include ::Google::Protobuf::MessageExts
|
279
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
280
|
+
end
|
281
|
+
|
282
|
+
# Provides the configuration for logging a type of permissions.
|
283
|
+
# Example:
|
284
|
+
#
|
285
|
+
# {
|
286
|
+
# "audit_log_configs": [
|
287
|
+
# {
|
288
|
+
# "log_type": "DATA_READ",
|
289
|
+
# "exempted_members": [
|
290
|
+
# "user:jose@example.com"
|
291
|
+
# ]
|
292
|
+
# },
|
293
|
+
# {
|
294
|
+
# "log_type": "DATA_WRITE"
|
295
|
+
# }
|
296
|
+
# ]
|
297
|
+
# }
|
298
|
+
#
|
299
|
+
# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
|
300
|
+
# jose@example.com from DATA_READ logging.
|
301
|
+
# @!attribute [rw] log_type
|
302
|
+
# @return [::Google::Iam::V1::AuditLogConfig::LogType]
|
303
|
+
# The log type that this config enables.
|
304
|
+
# @!attribute [rw] exempted_members
|
305
|
+
# @return [::Array<::String>]
|
306
|
+
# Specifies the identities that do not cause logging for this type of
|
307
|
+
# permission.
|
308
|
+
# Follows the same format of {::Google::Iam::V1::Binding#members Binding.members}.
|
309
|
+
class AuditLogConfig
|
310
|
+
include ::Google::Protobuf::MessageExts
|
311
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
312
|
+
|
313
|
+
# The list of valid permission types for which logging can be configured.
|
314
|
+
# Admin writes are always logged, and are not configurable.
|
315
|
+
module LogType
|
316
|
+
# Default case. Should never be this.
|
317
|
+
LOG_TYPE_UNSPECIFIED = 0
|
318
|
+
|
319
|
+
# Admin reads. Example: CloudIAM getIamPolicy
|
320
|
+
ADMIN_READ = 1
|
321
|
+
|
322
|
+
# Data writes. Example: CloudSQL Users create
|
323
|
+
DATA_WRITE = 2
|
324
|
+
|
325
|
+
# Data reads. Example: CloudSQL Users list
|
326
|
+
DATA_READ = 3
|
327
|
+
end
|
328
|
+
end
|
329
|
+
|
160
330
|
# The difference delta between two policies.
|
161
331
|
# @!attribute [rw] binding_deltas
|
162
332
|
# @return [::Array<::Google::Iam::V1::BindingDelta>]
|