google-identity-access_context_manager-v1 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/.yardopts +12 -0
- data/AUTHENTICATION.md +167 -0
- data/LICENSE.md +201 -0
- data/README.md +139 -0
- data/lib/google/identity/access_context_manager/v1/access_context_manager/client.rb +2358 -0
- data/lib/google/identity/access_context_manager/v1/access_context_manager/credentials.rb +47 -0
- data/lib/google/identity/access_context_manager/v1/access_context_manager/operations.rb +664 -0
- data/lib/google/identity/access_context_manager/v1/access_context_manager/paths.rb +112 -0
- data/lib/google/identity/access_context_manager/v1/access_context_manager.rb +60 -0
- data/lib/google/identity/access_context_manager/v1/version.rb +28 -0
- data/lib/google/identity/access_context_manager/v1.rb +38 -0
- data/lib/google/identity/accesscontextmanager/type/device_resources_pb.rb +43 -0
- data/lib/google/identity/accesscontextmanager/v1/access_context_manager_pb.rb +182 -0
- data/lib/google/identity/accesscontextmanager/v1/access_context_manager_services_pb.rb +224 -0
- data/lib/google/identity/accesscontextmanager/v1/access_level_pb.rb +73 -0
- data/lib/google/identity/accesscontextmanager/v1/access_policy_pb.rb +30 -0
- data/lib/google/identity/accesscontextmanager/v1/gcp_user_access_binding_pb.rb +27 -0
- data/lib/google/identity/accesscontextmanager/v1/service_perimeter_pb.rb +109 -0
- data/lib/google-identity-access_context_manager-v1.rb +21 -0
- data/proto_docs/README.md +4 -0
- data/proto_docs/google/api/field_behavior.rb +71 -0
- data/proto_docs/google/api/resource.rb +283 -0
- data/proto_docs/google/identity/accesscontextmanager/type/device_resources.rb +84 -0
- data/proto_docs/google/identity/accesscontextmanager/v1/access_context_manager.rb +539 -0
- data/proto_docs/google/identity/accesscontextmanager/v1/access_level.rb +197 -0
- data/proto_docs/google/identity/accesscontextmanager/v1/access_policy.rb +60 -0
- data/proto_docs/google/identity/accesscontextmanager/v1/gcp_user_access_binding.rb +55 -0
- data/proto_docs/google/identity/accesscontextmanager/v1/service_perimeter.rb +484 -0
- data/proto_docs/google/longrunning/operations.rb +164 -0
- data/proto_docs/google/protobuf/any.rb +141 -0
- data/proto_docs/google/protobuf/duration.rb +98 -0
- data/proto_docs/google/protobuf/empty.rb +36 -0
- data/proto_docs/google/protobuf/field_mask.rb +229 -0
- data/proto_docs/google/protobuf/timestamp.rb +129 -0
- data/proto_docs/google/rpc/status.rb +46 -0
- data/proto_docs/google/type/expr.rb +75 -0
- metadata +228 -0
@@ -0,0 +1,197 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# Copyright 2021 Google LLC
|
4
|
+
#
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
6
|
+
# you may not use this file except in compliance with the License.
|
7
|
+
# You may obtain a copy of the License at
|
8
|
+
#
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
10
|
+
#
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
14
|
+
# See the License for the specific language governing permissions and
|
15
|
+
# limitations under the License.
|
16
|
+
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
18
|
+
|
19
|
+
|
20
|
+
module Google
|
21
|
+
module Identity
|
22
|
+
module AccessContextManager
|
23
|
+
module V1
|
24
|
+
# An `AccessLevel` is a label that can be applied to requests to Google Cloud
|
25
|
+
# services, along with a list of requirements necessary for the label to be
|
26
|
+
# applied.
|
27
|
+
# @!attribute [rw] name
|
28
|
+
# @return [::String]
|
29
|
+
# Required. Resource name for the Access Level. The `short_name` component
|
30
|
+
# must begin with a letter and only include alphanumeric and '_'. Format:
|
31
|
+
# `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum
|
32
|
+
# length of the `access_level` component is 50 characters.
|
33
|
+
# @!attribute [rw] title
|
34
|
+
# @return [::String]
|
35
|
+
# Human readable title. Must be unique within the Policy.
|
36
|
+
# @!attribute [rw] description
|
37
|
+
# @return [::String]
|
38
|
+
# Description of the `AccessLevel` and its use. Does not affect behavior.
|
39
|
+
# @!attribute [rw] basic
|
40
|
+
# @return [::Google::Identity::AccessContextManager::V1::BasicLevel]
|
41
|
+
# A `BasicLevel` composed of `Conditions`.
|
42
|
+
# @!attribute [rw] custom
|
43
|
+
# @return [::Google::Identity::AccessContextManager::V1::CustomLevel]
|
44
|
+
# A `CustomLevel` written in the Common Expression Language.
|
45
|
+
# @!attribute [rw] create_time
|
46
|
+
# @return [::Google::Protobuf::Timestamp]
|
47
|
+
# Output only. Time the `AccessLevel` was created in UTC.
|
48
|
+
# @!attribute [rw] update_time
|
49
|
+
# @return [::Google::Protobuf::Timestamp]
|
50
|
+
# Output only. Time the `AccessLevel` was updated in UTC.
|
51
|
+
class AccessLevel
|
52
|
+
include ::Google::Protobuf::MessageExts
|
53
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
54
|
+
end
|
55
|
+
|
56
|
+
# `BasicLevel` is an `AccessLevel` using a set of recommended features.
|
57
|
+
# @!attribute [rw] conditions
|
58
|
+
# @return [::Array<::Google::Identity::AccessContextManager::V1::Condition>]
|
59
|
+
# Required. A list of requirements for the `AccessLevel` to be granted.
|
60
|
+
# @!attribute [rw] combining_function
|
61
|
+
# @return [::Google::Identity::AccessContextManager::V1::BasicLevel::ConditionCombiningFunction]
|
62
|
+
# How the `conditions` list should be combined to determine if a request is
|
63
|
+
# granted this `AccessLevel`. If AND is used, each `Condition` in
|
64
|
+
# `conditions` must be satisfied for the `AccessLevel` to be applied. If OR
|
65
|
+
# is used, at least one `Condition` in `conditions` must be satisfied for the
|
66
|
+
# `AccessLevel` to be applied. Default behavior is AND.
|
67
|
+
class BasicLevel
|
68
|
+
include ::Google::Protobuf::MessageExts
|
69
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
70
|
+
|
71
|
+
# Options for how the `conditions` list should be combined to determine if
|
72
|
+
# this `AccessLevel` is applied. Default is AND.
|
73
|
+
module ConditionCombiningFunction
|
74
|
+
# All `Conditions` must be true for the `BasicLevel` to be true.
|
75
|
+
AND = 0
|
76
|
+
|
77
|
+
# If at least one `Condition` is true, then the `BasicLevel` is true.
|
78
|
+
OR = 1
|
79
|
+
end
|
80
|
+
end
|
81
|
+
|
82
|
+
# A condition necessary for an `AccessLevel` to be granted. The Condition is an
|
83
|
+
# AND over its fields. So a Condition is true if: 1) the request IP is from one
|
84
|
+
# of the listed subnetworks AND 2) the originating device complies with the
|
85
|
+
# listed device policy AND 3) all listed access levels are granted AND 4) the
|
86
|
+
# request was sent at a time allowed by the DateTimeRestriction.
|
87
|
+
# @!attribute [rw] ip_subnetworks
|
88
|
+
# @return [::Array<::String>]
|
89
|
+
# CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for
|
90
|
+
# a CIDR IP address block, the specified IP address portion must be properly
|
91
|
+
# truncated (i.e. all the host bits must be zero) or the input is considered
|
92
|
+
# malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is
|
93
|
+
# not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas
|
94
|
+
# "2001:db8::1/32" is not. The originating IP of a request must be in one of
|
95
|
+
# the listed subnets in order for this Condition to be true. If empty, all IP
|
96
|
+
# addresses are allowed.
|
97
|
+
# @!attribute [rw] device_policy
|
98
|
+
# @return [::Google::Identity::AccessContextManager::V1::DevicePolicy]
|
99
|
+
# Device specific restrictions, all restrictions must hold for the
|
100
|
+
# Condition to be true. If not specified, all devices are allowed.
|
101
|
+
# @!attribute [rw] required_access_levels
|
102
|
+
# @return [::Array<::String>]
|
103
|
+
# A list of other access levels defined in the same `Policy`, referenced by
|
104
|
+
# resource name. Referencing an `AccessLevel` which does not exist is an
|
105
|
+
# error. All access levels listed must be granted for the Condition
|
106
|
+
# to be true. Example:
|
107
|
+
# "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
|
108
|
+
# @!attribute [rw] negate
|
109
|
+
# @return [::Boolean]
|
110
|
+
# Whether to negate the Condition. If true, the Condition becomes a NAND over
|
111
|
+
# its non-empty fields, each field must be false for the Condition overall to
|
112
|
+
# be satisfied. Defaults to false.
|
113
|
+
# @!attribute [rw] members
|
114
|
+
# @return [::Array<::String>]
|
115
|
+
# The request must be made by one of the provided user or service
|
116
|
+
# accounts. Groups are not supported.
|
117
|
+
# Syntax:
|
118
|
+
# `user:{emailid}`
|
119
|
+
# `serviceAccount:{emailid}`
|
120
|
+
# If not specified, a request may come from any user.
|
121
|
+
# @!attribute [rw] regions
|
122
|
+
# @return [::Array<::String>]
|
123
|
+
# The request must originate from one of the provided countries/regions.
|
124
|
+
# Must be valid ISO 3166-1 alpha-2 codes.
|
125
|
+
class Condition
|
126
|
+
include ::Google::Protobuf::MessageExts
|
127
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
128
|
+
end
|
129
|
+
|
130
|
+
# `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
|
131
|
+
# to represent the necessary conditions for the level to apply to a request.
|
132
|
+
# See CEL spec at: https://github.com/google/cel-spec
|
133
|
+
# @!attribute [rw] expr
|
134
|
+
# @return [::Google::Type::Expr]
|
135
|
+
# Required. A Cloud CEL expression evaluating to a boolean.
|
136
|
+
class CustomLevel
|
137
|
+
include ::Google::Protobuf::MessageExts
|
138
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
139
|
+
end
|
140
|
+
|
141
|
+
# `DevicePolicy` specifies device specific restrictions necessary to acquire a
|
142
|
+
# given access level. A `DevicePolicy` specifies requirements for requests from
|
143
|
+
# devices to be granted access levels, it does not do any enforcement on the
|
144
|
+
# device. `DevicePolicy` acts as an AND over all specified fields, and each
|
145
|
+
# repeated field is an OR over its elements. Any unset fields are ignored. For
|
146
|
+
# example, if the proto is { os_type : DESKTOP_WINDOWS, os_type :
|
147
|
+
# DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be
|
148
|
+
# true for requests originating from encrypted Linux desktops and encrypted
|
149
|
+
# Windows desktops.
|
150
|
+
# @!attribute [rw] require_screenlock
|
151
|
+
# @return [::Boolean]
|
152
|
+
# Whether or not screenlock is required for the DevicePolicy to be true.
|
153
|
+
# Defaults to `false`.
|
154
|
+
# @!attribute [rw] allowed_encryption_statuses
|
155
|
+
# @return [::Array<::Google::Identity::AccessContextManager::Type::DeviceEncryptionStatus>]
|
156
|
+
# Allowed encryptions statuses, an empty list allows all statuses.
|
157
|
+
# @!attribute [rw] os_constraints
|
158
|
+
# @return [::Array<::Google::Identity::AccessContextManager::V1::OsConstraint>]
|
159
|
+
# Allowed OS versions, an empty list allows all types and all versions.
|
160
|
+
# @!attribute [rw] allowed_device_management_levels
|
161
|
+
# @return [::Array<::Google::Identity::AccessContextManager::Type::DeviceManagementLevel>]
|
162
|
+
# Allowed device management levels, an empty list allows all management
|
163
|
+
# levels.
|
164
|
+
# @!attribute [rw] require_admin_approval
|
165
|
+
# @return [::Boolean]
|
166
|
+
# Whether the device needs to be approved by the customer admin.
|
167
|
+
# @!attribute [rw] require_corp_owned
|
168
|
+
# @return [::Boolean]
|
169
|
+
# Whether the device needs to be corp owned.
|
170
|
+
class DevicePolicy
|
171
|
+
include ::Google::Protobuf::MessageExts
|
172
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
173
|
+
end
|
174
|
+
|
175
|
+
# A restriction on the OS type and version of devices making requests.
|
176
|
+
# @!attribute [rw] os_type
|
177
|
+
# @return [::Google::Identity::AccessContextManager::Type::OsType]
|
178
|
+
# Required. The allowed OS type.
|
179
|
+
# @!attribute [rw] minimum_version
|
180
|
+
# @return [::String]
|
181
|
+
# The minimum allowed OS version. If not set, any version of this OS
|
182
|
+
# satisfies the constraint. Format: `"major.minor.patch"`.
|
183
|
+
# Examples: `"10.5.301"`, `"9.2.1"`.
|
184
|
+
# @!attribute [rw] require_verified_chrome_os
|
185
|
+
# @return [::Boolean]
|
186
|
+
# Only allows requests from devices with a verified Chrome OS.
|
187
|
+
# Verifications includes requirements that the device is enterprise-managed,
|
188
|
+
# conformant to domain policies, and the caller has permission to call
|
189
|
+
# the API targeted by the request.
|
190
|
+
class OsConstraint
|
191
|
+
include ::Google::Protobuf::MessageExts
|
192
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
193
|
+
end
|
194
|
+
end
|
195
|
+
end
|
196
|
+
end
|
197
|
+
end
|
@@ -0,0 +1,60 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# Copyright 2021 Google LLC
|
4
|
+
#
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
6
|
+
# you may not use this file except in compliance with the License.
|
7
|
+
# You may obtain a copy of the License at
|
8
|
+
#
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
10
|
+
#
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
14
|
+
# See the License for the specific language governing permissions and
|
15
|
+
# limitations under the License.
|
16
|
+
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
18
|
+
|
19
|
+
|
20
|
+
module Google
|
21
|
+
module Identity
|
22
|
+
module AccessContextManager
|
23
|
+
module V1
|
24
|
+
# `AccessPolicy` is a container for `AccessLevels` (which define the necessary
|
25
|
+
# attributes to use Google Cloud services) and `ServicePerimeters` (which
|
26
|
+
# define regions of services able to freely pass data within a perimeter). An
|
27
|
+
# access policy is globally visible within an organization, and the
|
28
|
+
# restrictions it specifies apply to all projects within an organization.
|
29
|
+
# @!attribute [rw] name
|
30
|
+
# @return [::String]
|
31
|
+
# Output only. Resource name of the `AccessPolicy`. Format:
|
32
|
+
# `accessPolicies/{access_policy}`
|
33
|
+
# @!attribute [rw] parent
|
34
|
+
# @return [::String]
|
35
|
+
# Required. The parent of this `AccessPolicy` in the Cloud Resource
|
36
|
+
# Hierarchy. Currently immutable once created. Format:
|
37
|
+
# `organizations/{organization_id}`
|
38
|
+
# @!attribute [rw] title
|
39
|
+
# @return [::String]
|
40
|
+
# Required. Human readable title. Does not affect behavior.
|
41
|
+
# @!attribute [rw] create_time
|
42
|
+
# @return [::Google::Protobuf::Timestamp]
|
43
|
+
# Output only. Time the `AccessPolicy` was created in UTC.
|
44
|
+
# @!attribute [rw] update_time
|
45
|
+
# @return [::Google::Protobuf::Timestamp]
|
46
|
+
# Output only. Time the `AccessPolicy` was updated in UTC.
|
47
|
+
# @!attribute [rw] etag
|
48
|
+
# @return [::String]
|
49
|
+
# Output only. An opaque identifier for the current version of the
|
50
|
+
# `AccessPolicy`. This will always be a strongly validated etag, meaning that
|
51
|
+
# two Access Polices will be identical if and only if their etags are
|
52
|
+
# identical. Clients should not expect this to be in any specific format.
|
53
|
+
class AccessPolicy
|
54
|
+
include ::Google::Protobuf::MessageExts
|
55
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
56
|
+
end
|
57
|
+
end
|
58
|
+
end
|
59
|
+
end
|
60
|
+
end
|
@@ -0,0 +1,55 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# Copyright 2021 Google LLC
|
4
|
+
#
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
6
|
+
# you may not use this file except in compliance with the License.
|
7
|
+
# You may obtain a copy of the License at
|
8
|
+
#
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
10
|
+
#
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
14
|
+
# See the License for the specific language governing permissions and
|
15
|
+
# limitations under the License.
|
16
|
+
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
18
|
+
|
19
|
+
|
20
|
+
module Google
|
21
|
+
module Identity
|
22
|
+
module AccessContextManager
|
23
|
+
module V1
|
24
|
+
# Restricts access to Cloud Console and Google Cloud APIs for a set of users
|
25
|
+
# using Context-Aware Access.
|
26
|
+
# @!attribute [rw] name
|
27
|
+
# @return [::String]
|
28
|
+
# Immutable. Assigned by the server during creation. The last segment has an arbitrary
|
29
|
+
# length and has only URI unreserved characters (as defined by
|
30
|
+
# [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)).
|
31
|
+
# Should not be specified by the client during creation.
|
32
|
+
# Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
|
33
|
+
# @!attribute [rw] group_key
|
34
|
+
# @return [::String]
|
35
|
+
# Required. Immutable. Google Group id whose members are subject to this binding's restrictions.
|
36
|
+
# See "id" in the [G Suite Directory API's Groups resource]
|
37
|
+
# (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource).
|
38
|
+
# If a group's email address/alias is changed, this resource will continue
|
39
|
+
# to point at the changed group. This field does not accept group email
|
40
|
+
# addresses or aliases.
|
41
|
+
# Example: "01d520gv4vjcrht"
|
42
|
+
# @!attribute [rw] access_levels
|
43
|
+
# @return [::Array<::String>]
|
44
|
+
# Required. Access level that a user must have to be granted access. Only one access
|
45
|
+
# level is supported, not multiple. This repeated field must have exactly
|
46
|
+
# one element.
|
47
|
+
# Example: "accessPolicies/9522/accessLevels/device_trusted"
|
48
|
+
class GcpUserAccessBinding
|
49
|
+
include ::Google::Protobuf::MessageExts
|
50
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
51
|
+
end
|
52
|
+
end
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|