@0xkaleab/sdk-js 0.2.7

package/dist/types/codegen/google/iam/v1/policy.d.ts

@@ -0,0 +1,1186 @@
+import { Expr, ExprAmino } from "../../type/expr";
+import { BinaryReader, BinaryWriter } from "../../../binary";
+import { DeepPartial } from "../../../helpers";
+/**
+ * The list of valid permission types for which logging can be configured.
+ * Admin writes are always logged, and are not configurable.
+ */
+export declare enum AuditLogConfig_LogType {
+    /** LOG_TYPE_UNSPECIFIED - Default case. Should never be this. */
+    LOG_TYPE_UNSPECIFIED = 0,
+    /** ADMIN_READ - Admin reads. Example: CloudIAM getIamPolicy */
+    ADMIN_READ = 1,
+    /** DATA_WRITE - Data writes. Example: CloudSQL Users create */
+    DATA_WRITE = 2,
+    /** DATA_READ - Data reads. Example: CloudSQL Users list */
+    DATA_READ = 3,
+    UNRECOGNIZED = -1
+}
+export declare const AuditLogConfig_LogTypeAmino: typeof AuditLogConfig_LogType;
+export declare function auditLogConfig_LogTypeFromJSON(object: any): AuditLogConfig_LogType;
+export declare function auditLogConfig_LogTypeToJSON(object: AuditLogConfig_LogType): string;
+/** The type of action performed on a Binding in a policy. */
+export declare enum BindingDelta_Action {
+    /** ACTION_UNSPECIFIED - Unspecified. */
+    ACTION_UNSPECIFIED = 0,
+    /** ADD - Addition of a Binding. */
+    ADD = 1,
+    /** REMOVE - Removal of a Binding. */
+    REMOVE = 2,
+    UNRECOGNIZED = -1
+}
+export declare const BindingDelta_ActionAmino: typeof BindingDelta_Action;
+export declare function bindingDelta_ActionFromJSON(object: any): BindingDelta_Action;
+export declare function bindingDelta_ActionToJSON(object: BindingDelta_Action): string;
+/** The type of action performed on an audit configuration in a policy. */
+export declare enum AuditConfigDelta_Action {
+    /** ACTION_UNSPECIFIED - Unspecified. */
+    ACTION_UNSPECIFIED = 0,
+    /** ADD - Addition of an audit configuration. */
+    ADD = 1,
+    /** REMOVE - Removal of an audit configuration. */
+    REMOVE = 2,
+    UNRECOGNIZED = -1
+}
+export declare const AuditConfigDelta_ActionAmino: typeof AuditConfigDelta_Action;
+export declare function auditConfigDelta_ActionFromJSON(object: any): AuditConfigDelta_Action;
+export declare function auditConfigDelta_ActionToJSON(object: AuditConfigDelta_Action): string;
+/**
+ * An Identity and Access Management (IAM) policy, which specifies access
+ * controls for Google Cloud resources.
+ *
+ *
+ * A `Policy` is a collection of `bindings`. A `binding` binds one or more
+ * `members`, or principals, to a single `role`. Principals can be user
+ * accounts, service accounts, Google groups, and domains (such as G Suite). A
+ * `role` is a named list of permissions; each `role` can be an IAM predefined
+ * role or a user-created custom role.
+ *
+ * For some types of Google Cloud resources, a `binding` can also specify a
+ * `condition`, which is a logical expression that allows access to a resource
+ * only if the expression evaluates to `true`. A condition can add constraints
+ * based on attributes of the request, the resource, or both. To learn which
+ * resources support conditions in their IAM policies, see the
+ * [IAM
+ * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ *
+ * **JSON example:**
+ *
+ * ```
+ *     {
+ *       "bindings": [
+ *         {
+ *           "role": "roles/resourcemanager.organizationAdmin",
+ *           "members": [
+ *             "user:mike@example.com",
+ *             "group:admins@example.com",
+ *             "domain:google.com",
+ *             "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+ *           ]
+ *         },
+ *         {
+ *           "role": "roles/resourcemanager.organizationViewer",
+ *           "members": [
+ *             "user:eve@example.com"
+ *           ],
+ *           "condition": {
+ *             "title": "expirable access",
+ *             "description": "Does not grant access after Sep 2020",
+ *             "expression": "request.time <
+ *             timestamp('2020-10-01T00:00:00.000Z')",
+ *           }
+ *         }
+ *       ],
+ *       "etag": "BwWWja0YfJA=",
+ *       "version": 3
+ *     }
+ * ```
+ *
+ * **YAML example:**
+ *
+ * ```
+ *     bindings:
+ *     - members:
+ *       - user:mike@example.com
+ *       - group:admins@example.com
+ *       - domain:google.com
+ *       - serviceAccount:my-project-id@appspot.gserviceaccount.com
+ *       role: roles/resourcemanager.organizationAdmin
+ *     - members:
+ *       - user:eve@example.com
+ *       role: roles/resourcemanager.organizationViewer
+ *       condition:
+ *         title: expirable access
+ *         description: Does not grant access after Sep 2020
+ *         expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+ *     etag: BwWWja0YfJA=
+ *     version: 3
+ * ```
+ *
+ * For a description of IAM and its features, see the
+ * [IAM documentation](https://cloud.google.com/iam/docs/).
+ * @name Policy
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.Policy
+ */
+export interface Policy {
+    /**
+     * Specifies the format of the policy.
+     *
+     * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
+     * are rejected.
+     *
+     * Any operation that affects conditional role bindings must specify version
+     * `3`. This requirement applies to the following operations:
+     *
+     * * Getting a policy that includes a conditional role binding
+     * * Adding a conditional role binding to a policy
+     * * Changing a conditional role binding in a policy
+     * * Removing any role binding, with or without a condition, from a policy
+     *   that includes conditions
+     *
+     * **Important:** If you use IAM Conditions, you must include the `etag` field
+     * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+     * you to overwrite a version `3` policy with a version `1` policy, and all of
+     * the conditions in the version `3` policy are lost.
+     *
+     * If a policy does not include any conditions, operations on that policy may
+     * specify any valid version or leave the field unset.
+     *
+     * To learn which resources support conditions in their IAM policies, see the
+     * [IAM
+     * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+     */
+    version: number;
+    /**
+     * Associates a list of `members`, or principals, with a `role`. Optionally,
+     * may specify a `condition` that determines how and when the `bindings` are
+     * applied. Each of the `bindings` must contain at least one principal.
+     *
+     * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
+     * of these principals can be Google groups. Each occurrence of a principal
+     * counts towards these limits. For example, if the `bindings` grant 50
+     * different roles to `user:alice@example.com`, and not to any other
+     * principal, then you can add another 1,450 principals to the `bindings` in
+     * the `Policy`.
+     */
+    bindings: Binding[];
+    /**
+     * Specifies cloud audit logging configuration for this policy.
+     */
+    auditConfigs: AuditConfig[];
+    /**
+     * `etag` is used for optimistic concurrency control as a way to help
+     * prevent simultaneous updates of a policy from overwriting each other.
+     * It is strongly suggested that systems make use of the `etag` in the
+     * read-modify-write cycle to perform policy updates in order to avoid race
+     * conditions: An `etag` is returned in the response to `getIamPolicy`, and
+     * systems are expected to put that etag in the request to `setIamPolicy` to
+     * ensure that their change will be applied to the same version of the policy.
+     *
+     * **Important:** If you use IAM Conditions, you must include the `etag` field
+     * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+     * you to overwrite a version `3` policy with a version `1` policy, and all of
+     * the conditions in the version `3` policy are lost.
+     */
+    etag: Uint8Array;
+}
+export interface PolicyProtoMsg {
+    typeUrl: "/google.iam.v1.Policy";
+    value: Uint8Array;
+}
+/**
+ * An Identity and Access Management (IAM) policy, which specifies access
+ * controls for Google Cloud resources.
+ *
+ *
+ * A `Policy` is a collection of `bindings`. A `binding` binds one or more
+ * `members`, or principals, to a single `role`. Principals can be user
+ * accounts, service accounts, Google groups, and domains (such as G Suite). A
+ * `role` is a named list of permissions; each `role` can be an IAM predefined
+ * role or a user-created custom role.
+ *
+ * For some types of Google Cloud resources, a `binding` can also specify a
+ * `condition`, which is a logical expression that allows access to a resource
+ * only if the expression evaluates to `true`. A condition can add constraints
+ * based on attributes of the request, the resource, or both. To learn which
+ * resources support conditions in their IAM policies, see the
+ * [IAM
+ * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ *
+ * **JSON example:**
+ *
+ * ```
+ *     {
+ *       "bindings": [
+ *         {
+ *           "role": "roles/resourcemanager.organizationAdmin",
+ *           "members": [
+ *             "user:mike@example.com",
+ *             "group:admins@example.com",
+ *             "domain:google.com",
+ *             "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+ *           ]
+ *         },
+ *         {
+ *           "role": "roles/resourcemanager.organizationViewer",
+ *           "members": [
+ *             "user:eve@example.com"
+ *           ],
+ *           "condition": {
+ *             "title": "expirable access",
+ *             "description": "Does not grant access after Sep 2020",
+ *             "expression": "request.time <
+ *             timestamp('2020-10-01T00:00:00.000Z')",
+ *           }
+ *         }
+ *       ],
+ *       "etag": "BwWWja0YfJA=",
+ *       "version": 3
+ *     }
+ * ```
+ *
+ * **YAML example:**
+ *
+ * ```
+ *     bindings:
+ *     - members:
+ *       - user:mike@example.com
+ *       - group:admins@example.com
+ *       - domain:google.com
+ *       - serviceAccount:my-project-id@appspot.gserviceaccount.com
+ *       role: roles/resourcemanager.organizationAdmin
+ *     - members:
+ *       - user:eve@example.com
+ *       role: roles/resourcemanager.organizationViewer
+ *       condition:
+ *         title: expirable access
+ *         description: Does not grant access after Sep 2020
+ *         expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+ *     etag: BwWWja0YfJA=
+ *     version: 3
+ * ```
+ *
+ * For a description of IAM and its features, see the
+ * [IAM documentation](https://cloud.google.com/iam/docs/).
+ * @name PolicyAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.Policy
+ */
+export interface PolicyAmino {
+    /**
+     * Specifies the format of the policy.
+     *
+     * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
+     * are rejected.
+     *
+     * Any operation that affects conditional role bindings must specify version
+     * `3`. This requirement applies to the following operations:
+     *
+     * * Getting a policy that includes a conditional role binding
+     * * Adding a conditional role binding to a policy
+     * * Changing a conditional role binding in a policy
+     * * Removing any role binding, with or without a condition, from a policy
+     *   that includes conditions
+     *
+     * **Important:** If you use IAM Conditions, you must include the `etag` field
+     * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+     * you to overwrite a version `3` policy with a version `1` policy, and all of
+     * the conditions in the version `3` policy are lost.
+     *
+     * If a policy does not include any conditions, operations on that policy may
+     * specify any valid version or leave the field unset.
+     *
+     * To learn which resources support conditions in their IAM policies, see the
+     * [IAM
+     * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+     */
+    version: number;
+    /**
+     * Associates a list of `members`, or principals, with a `role`. Optionally,
+     * may specify a `condition` that determines how and when the `bindings` are
+     * applied. Each of the `bindings` must contain at least one principal.
+     *
+     * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
+     * of these principals can be Google groups. Each occurrence of a principal
+     * counts towards these limits. For example, if the `bindings` grant 50
+     * different roles to `user:alice@example.com`, and not to any other
+     * principal, then you can add another 1,450 principals to the `bindings` in
+     * the `Policy`.
+     */
+    bindings: BindingAmino[];
+    /**
+     * Specifies cloud audit logging configuration for this policy.
+     */
+    audit_configs: AuditConfigAmino[];
+    /**
+     * `etag` is used for optimistic concurrency control as a way to help
+     * prevent simultaneous updates of a policy from overwriting each other.
+     * It is strongly suggested that systems make use of the `etag` in the
+     * read-modify-write cycle to perform policy updates in order to avoid race
+     * conditions: An `etag` is returned in the response to `getIamPolicy`, and
+     * systems are expected to put that etag in the request to `setIamPolicy` to
+     * ensure that their change will be applied to the same version of the policy.
+     *
+     * **Important:** If you use IAM Conditions, you must include the `etag` field
+     * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
+     * you to overwrite a version `3` policy with a version `1` policy, and all of
+     * the conditions in the version `3` policy are lost.
+     */
+    etag: string;
+}
+export interface PolicyAminoMsg {
+    type: "/google.iam.v1.Policy";
+    value: PolicyAmino;
+}
+/**
+ * Associates `members`, or principals, with a `role`.
+ * @name Binding
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.Binding
+ */
+export interface Binding {
+    /**
+     * Role that is assigned to the list of `members`, or principals.
+     * For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+     */
+    role: string;
+    /**
+     * Specifies the principals requesting access for a Google Cloud resource.
+     * `members` can have the following values:
+     *
+     * * `allUsers`: A special identifier that represents anyone who is
+     *    on the internet; with or without a Google account.
+     *
+     * * `allAuthenticatedUsers`: A special identifier that represents anyone
+     *    who is authenticated with a Google account or a service account.
+     *
+     * * `user:{emailid}`: An email address that represents a specific Google
+     *    account. For example, `alice@example.com` .
+     *
+     *
+     * * `serviceAccount:{emailid}`: An email address that represents a service
+     *    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+     *
+     * * `group:{emailid}`: An email address that represents a Google group.
+     *    For example, `admins@example.com`.
+     *
+     * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+     *    identifier) representing a user that has been recently deleted. For
+     *    example, `alice@example.com?uid=123456789012345678901`. If the user is
+     *    recovered, this value reverts to `user:{emailid}` and the recovered user
+     *    retains the role in the binding.
+     *
+     * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+     *    unique identifier) representing a service account that has been recently
+     *    deleted. For example,
+     *    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+     *    If the service account is undeleted, this value reverts to
+     *    `serviceAccount:{emailid}` and the undeleted service account retains the
+     *    role in the binding.
+     *
+     * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+     *    identifier) representing a Google group that has been recently
+     *    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+     *    the group is recovered, this value reverts to `group:{emailid}` and the
+     *    recovered group retains the role in the binding.
+     *
+     *
+     * * `domain:{domain}`: The G Suite domain (primary) that represents all the
+     *    users of that domain. For example, `google.com` or `example.com`.
+     */
+    members: string[];
+    /**
+     * The condition that is associated with this binding.
+     *
+     * If the condition evaluates to `true`, then this binding applies to the
+     * current request.
+     *
+     * If the condition evaluates to `false`, then this binding does not apply to
+     * the current request. However, a different role binding might grant the same
+     * role to one or more of the principals in this binding.
+     *
+     * To learn which resources support conditions in their IAM policies, see the
+     * [IAM
+     * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+     */
+    condition?: Expr;
+}
+export interface BindingProtoMsg {
+    typeUrl: "/google.iam.v1.Binding";
+    value: Uint8Array;
+}
+/**
+ * Associates `members`, or principals, with a `role`.
+ * @name BindingAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.Binding
+ */
+export interface BindingAmino {
+    /**
+     * Role that is assigned to the list of `members`, or principals.
+     * For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+     */
+    role: string;
+    /**
+     * Specifies the principals requesting access for a Google Cloud resource.
+     * `members` can have the following values:
+     *
+     * * `allUsers`: A special identifier that represents anyone who is
+     *    on the internet; with or without a Google account.
+     *
+     * * `allAuthenticatedUsers`: A special identifier that represents anyone
+     *    who is authenticated with a Google account or a service account.
+     *
+     * * `user:{emailid}`: An email address that represents a specific Google
+     *    account. For example, `alice@example.com` .
+     *
+     *
+     * * `serviceAccount:{emailid}`: An email address that represents a service
+     *    account. For example, `my-other-app@appspot.gserviceaccount.com`.
+     *
+     * * `group:{emailid}`: An email address that represents a Google group.
+     *    For example, `admins@example.com`.
+     *
+     * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
+     *    identifier) representing a user that has been recently deleted. For
+     *    example, `alice@example.com?uid=123456789012345678901`. If the user is
+     *    recovered, this value reverts to `user:{emailid}` and the recovered user
+     *    retains the role in the binding.
+     *
+     * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
+     *    unique identifier) representing a service account that has been recently
+     *    deleted. For example,
+     *    `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
+     *    If the service account is undeleted, this value reverts to
+     *    `serviceAccount:{emailid}` and the undeleted service account retains the
+     *    role in the binding.
+     *
+     * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
+     *    identifier) representing a Google group that has been recently
+     *    deleted. For example, `admins@example.com?uid=123456789012345678901`. If
+     *    the group is recovered, this value reverts to `group:{emailid}` and the
+     *    recovered group retains the role in the binding.
+     *
+     *
+     * * `domain:{domain}`: The G Suite domain (primary) that represents all the
+     *    users of that domain. For example, `google.com` or `example.com`.
+     */
+    members: string[];
+    /**
+     * The condition that is associated with this binding.
+     *
+     * If the condition evaluates to `true`, then this binding applies to the
+     * current request.
+     *
+     * If the condition evaluates to `false`, then this binding does not apply to
+     * the current request. However, a different role binding might grant the same
+     * role to one or more of the principals in this binding.
+     *
+     * To learn which resources support conditions in their IAM policies, see the
+     * [IAM
+     * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+     */
+    condition?: ExprAmino;
+}
+export interface BindingAminoMsg {
+    type: "/google.iam.v1.Binding";
+    value: BindingAmino;
+}
+/**
+ * Specifies the audit configuration for a service.
+ * The configuration determines which permission types are logged, and what
+ * identities, if any, are exempted from logging.
+ * An AuditConfig must have one or more AuditLogConfigs.
+ *
+ * If there are AuditConfigs for both `allServices` and a specific service,
+ * the union of the two AuditConfigs is used for that service: the log_types
+ * specified in each AuditConfig are enabled, and the exempted_members in each
+ * AuditLogConfig are exempted.
+ *
+ * Example Policy with multiple AuditConfigs:
+ *
+ *     {
+ *       "audit_configs": [
+ *         {
+ *           "service": "allServices",
+ *           "audit_log_configs": [
+ *             {
+ *               "log_type": "DATA_READ",
+ *               "exempted_members": [
+ *                 "user:jose@example.com"
+ *               ]
+ *             },
+ *             {
+ *               "log_type": "DATA_WRITE"
+ *             },
+ *             {
+ *               "log_type": "ADMIN_READ"
+ *             }
+ *           ]
+ *         },
+ *         {
+ *           "service": "sampleservice.googleapis.com",
+ *           "audit_log_configs": [
+ *             {
+ *               "log_type": "DATA_READ"
+ *             },
+ *             {
+ *               "log_type": "DATA_WRITE",
+ *               "exempted_members": [
+ *                 "user:aliya@example.com"
+ *               ]
+ *             }
+ *           ]
+ *         }
+ *       ]
+ *     }
+ *
+ * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
+ * logging. It also exempts `jose@example.com` from DATA_READ logging, and
+ * `aliya@example.com` from DATA_WRITE logging.
+ * @name AuditConfig
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditConfig
+ */
+export interface AuditConfig {
+    /**
+     * Specifies a service that will be enabled for audit logging.
+     * For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
+     * `allServices` is a special value that covers all services.
+     */
+    service: string;
+    /**
+     * The configuration for logging of each type of permission.
+     */
+    auditLogConfigs: AuditLogConfig[];
+}
+export interface AuditConfigProtoMsg {
+    typeUrl: "/google.iam.v1.AuditConfig";
+    value: Uint8Array;
+}
+/**
+ * Specifies the audit configuration for a service.
+ * The configuration determines which permission types are logged, and what
+ * identities, if any, are exempted from logging.
+ * An AuditConfig must have one or more AuditLogConfigs.
+ *
+ * If there are AuditConfigs for both `allServices` and a specific service,
+ * the union of the two AuditConfigs is used for that service: the log_types
+ * specified in each AuditConfig are enabled, and the exempted_members in each
+ * AuditLogConfig are exempted.
+ *
+ * Example Policy with multiple AuditConfigs:
+ *
+ *     {
+ *       "audit_configs": [
+ *         {
+ *           "service": "allServices",
+ *           "audit_log_configs": [
+ *             {
+ *               "log_type": "DATA_READ",
+ *               "exempted_members": [
+ *                 "user:jose@example.com"
+ *               ]
+ *             },
+ *             {
+ *               "log_type": "DATA_WRITE"
+ *             },
+ *             {
+ *               "log_type": "ADMIN_READ"
+ *             }
+ *           ]
+ *         },
+ *         {
+ *           "service": "sampleservice.googleapis.com",
+ *           "audit_log_configs": [
+ *             {
+ *               "log_type": "DATA_READ"
+ *             },
+ *             {
+ *               "log_type": "DATA_WRITE",
+ *               "exempted_members": [
+ *                 "user:aliya@example.com"
+ *               ]
+ *             }
+ *           ]
+ *         }
+ *       ]
+ *     }
+ *
+ * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
+ * logging. It also exempts `jose@example.com` from DATA_READ logging, and
+ * `aliya@example.com` from DATA_WRITE logging.
+ * @name AuditConfigAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditConfig
+ */
+export interface AuditConfigAmino {
+    /**
+     * Specifies a service that will be enabled for audit logging.
+     * For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
+     * `allServices` is a special value that covers all services.
+     */
+    service: string;
+    /**
+     * The configuration for logging of each type of permission.
+     */
+    audit_log_configs: AuditLogConfigAmino[];
+}
+export interface AuditConfigAminoMsg {
+    type: "/google.iam.v1.AuditConfig";
+    value: AuditConfigAmino;
+}
+/**
+ * Provides the configuration for logging a type of permissions.
+ * Example:
+ *
+ *     {
+ *       "audit_log_configs": [
+ *         {
+ *           "log_type": "DATA_READ",
+ *           "exempted_members": [
+ *             "user:jose@example.com"
+ *           ]
+ *         },
+ *         {
+ *           "log_type": "DATA_WRITE"
+ *         }
+ *       ]
+ *     }
+ *
+ * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
+ * jose@example.com from DATA_READ logging.
+ * @name AuditLogConfig
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditLogConfig
+ */
+export interface AuditLogConfig {
+    /**
+     * The log type that this config enables.
+     */
+    logType: AuditLogConfig_LogType;
+    /**
+     * Specifies the identities that do not cause logging for this type of
+     * permission.
+     * Follows the same format of
+     * [Binding.members][google.iam.v1.Binding.members].
+     */
+    exemptedMembers: string[];
+}
+export interface AuditLogConfigProtoMsg {
+    typeUrl: "/google.iam.v1.AuditLogConfig";
+    value: Uint8Array;
+}
+/**
+ * Provides the configuration for logging a type of permissions.
+ * Example:
+ *
+ *     {
+ *       "audit_log_configs": [
+ *         {
+ *           "log_type": "DATA_READ",
+ *           "exempted_members": [
+ *             "user:jose@example.com"
+ *           ]
+ *         },
+ *         {
+ *           "log_type": "DATA_WRITE"
+ *         }
+ *       ]
+ *     }
+ *
+ * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
+ * jose@example.com from DATA_READ logging.
+ * @name AuditLogConfigAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditLogConfig
+ */
+export interface AuditLogConfigAmino {
+    /**
+     * The log type that this config enables.
+     */
+    log_type: AuditLogConfig_LogType;
+    /**
+     * Specifies the identities that do not cause logging for this type of
+     * permission.
+     * Follows the same format of
+     * [Binding.members][google.iam.v1.Binding.members].
+     */
+    exempted_members: string[];
+}
+export interface AuditLogConfigAminoMsg {
+    type: "/google.iam.v1.AuditLogConfig";
+    value: AuditLogConfigAmino;
+}
+/**
+ * The difference delta between two policies.
+ * @name PolicyDelta
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.PolicyDelta
+ */
+export interface PolicyDelta {
+    /**
+     * The delta for Bindings between two policies.
+     */
+    bindingDeltas: BindingDelta[];
+    /**
+     * The delta for AuditConfigs between two policies.
+     */
+    auditConfigDeltas: AuditConfigDelta[];
+}
+export interface PolicyDeltaProtoMsg {
+    typeUrl: "/google.iam.v1.PolicyDelta";
+    value: Uint8Array;
+}
+/**
+ * The difference delta between two policies.
+ * @name PolicyDeltaAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.PolicyDelta
+ */
+export interface PolicyDeltaAmino {
+    /**
+     * The delta for Bindings between two policies.
+     */
+    binding_deltas: BindingDeltaAmino[];
+    /**
+     * The delta for AuditConfigs between two policies.
+     */
+    audit_config_deltas: AuditConfigDeltaAmino[];
+}
+export interface PolicyDeltaAminoMsg {
+    type: "/google.iam.v1.PolicyDelta";
+    value: PolicyDeltaAmino;
+}
+/**
+ * One delta entry for Binding. Each individual change (only one member in each
+ * entry) to a binding will be a separate entry.
+ * @name BindingDelta
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.BindingDelta
+ */
+export interface BindingDelta {
+    /**
+     * The action that was performed on a Binding.
+     * Required
+     */
+    action: BindingDelta_Action;
+    /**
+     * Role that is assigned to `members`.
+     * For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+     * Required
+     */
+    role: string;
+    /**
+     * A single identity requesting access for a Google Cloud resource.
+     * Follows the same format of Binding.members.
+     * Required
+     */
+    member: string;
+    /**
+     * The condition that is associated with this binding.
+     */
+    condition?: Expr;
+}
+export interface BindingDeltaProtoMsg {
+    typeUrl: "/google.iam.v1.BindingDelta";
+    value: Uint8Array;
+}
+/**
+ * One delta entry for Binding. Each individual change (only one member in each
+ * entry) to a binding will be a separate entry.
+ * @name BindingDeltaAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.BindingDelta
+ */
+export interface BindingDeltaAmino {
+    /**
+     * The action that was performed on a Binding.
+     * Required
+     */
+    action: BindingDelta_Action;
+    /**
+     * Role that is assigned to `members`.
+     * For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+     * Required
+     */
+    role: string;
+    /**
+     * A single identity requesting access for a Google Cloud resource.
+     * Follows the same format of Binding.members.
+     * Required
+     */
+    member: string;
+    /**
+     * The condition that is associated with this binding.
+     */
+    condition?: ExprAmino;
+}
+export interface BindingDeltaAminoMsg {
+    type: "/google.iam.v1.BindingDelta";
+    value: BindingDeltaAmino;
+}
+/**
+ * One delta entry for AuditConfig. Each individual change (only one
+ * exempted_member in each entry) to a AuditConfig will be a separate entry.
+ * @name AuditConfigDelta
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditConfigDelta
+ */
+export interface AuditConfigDelta {
+    /**
+     * The action that was performed on an audit configuration in a policy.
+     * Required
+     */
+    action: AuditConfigDelta_Action;
+    /**
+     * Specifies a service that was configured for Cloud Audit Logging.
+     * For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
+     * `allServices` is a special value that covers all services.
+     * Required
+     */
+    service: string;
+    /**
+     * A single identity that is exempted from "data access" audit
+     * logging for the `service` specified above.
+     * Follows the same format of Binding.members.
+     */
+    exemptedMember: string;
+    /**
+     * Specifies the log_type that was be enabled. ADMIN_ACTIVITY is always
+     * enabled, and cannot be configured.
+     * Required
+     */
+    logType: string;
+}
+export interface AuditConfigDeltaProtoMsg {
+    typeUrl: "/google.iam.v1.AuditConfigDelta";
+    value: Uint8Array;
+}
+/**
+ * One delta entry for AuditConfig. Each individual change (only one
+ * exempted_member in each entry) to a AuditConfig will be a separate entry.
+ * @name AuditConfigDeltaAmino
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditConfigDelta
+ */
+export interface AuditConfigDeltaAmino {
+    /**
+     * The action that was performed on an audit configuration in a policy.
+     * Required
+     */
+    action: AuditConfigDelta_Action;
+    /**
+     * Specifies a service that was configured for Cloud Audit Logging.
+     * For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
+     * `allServices` is a special value that covers all services.
+     * Required
+     */
+    service: string;
+    /**
+     * A single identity that is exempted from "data access" audit
+     * logging for the `service` specified above.
+     * Follows the same format of Binding.members.
+     */
+    exempted_member: string;
+    /**
+     * Specifies the log_type that was be enabled. ADMIN_ACTIVITY is always
+     * enabled, and cannot be configured.
+     * Required
+     */
+    log_type: string;
+}
+export interface AuditConfigDeltaAminoMsg {
+    type: "/google.iam.v1.AuditConfigDelta";
+    value: AuditConfigDeltaAmino;
+}
+/**
+ * An Identity and Access Management (IAM) policy, which specifies access
+ * controls for Google Cloud resources.
+ *
+ *
+ * A `Policy` is a collection of `bindings`. A `binding` binds one or more
+ * `members`, or principals, to a single `role`. Principals can be user
+ * accounts, service accounts, Google groups, and domains (such as G Suite). A
+ * `role` is a named list of permissions; each `role` can be an IAM predefined
+ * role or a user-created custom role.
+ *
+ * For some types of Google Cloud resources, a `binding` can also specify a
+ * `condition`, which is a logical expression that allows access to a resource
+ * only if the expression evaluates to `true`. A condition can add constraints
+ * based on attributes of the request, the resource, or both. To learn which
+ * resources support conditions in their IAM policies, see the
+ * [IAM
+ * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ *
+ * **JSON example:**
+ *
+ * ```
+ *     {
+ *       "bindings": [
+ *         {
+ *           "role": "roles/resourcemanager.organizationAdmin",
+ *           "members": [
+ *             "user:mike@example.com",
+ *             "group:admins@example.com",
+ *             "domain:google.com",
+ *             "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+ *           ]
+ *         },
+ *         {
+ *           "role": "roles/resourcemanager.organizationViewer",
+ *           "members": [
+ *             "user:eve@example.com"
+ *           ],
+ *           "condition": {
+ *             "title": "expirable access",
+ *             "description": "Does not grant access after Sep 2020",
+ *             "expression": "request.time <
+ *             timestamp('2020-10-01T00:00:00.000Z')",
+ *           }
+ *         }
+ *       ],
+ *       "etag": "BwWWja0YfJA=",
+ *       "version": 3
+ *     }
+ * ```
+ *
+ * **YAML example:**
+ *
+ * ```
+ *     bindings:
+ *     - members:
+ *       - user:mike@example.com
+ *       - group:admins@example.com
+ *       - domain:google.com
+ *       - serviceAccount:my-project-id@appspot.gserviceaccount.com
+ *       role: roles/resourcemanager.organizationAdmin
+ *     - members:
+ *       - user:eve@example.com
+ *       role: roles/resourcemanager.organizationViewer
+ *       condition:
+ *         title: expirable access
+ *         description: Does not grant access after Sep 2020
+ *         expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+ *     etag: BwWWja0YfJA=
+ *     version: 3
+ * ```
+ *
+ * For a description of IAM and its features, see the
+ * [IAM documentation](https://cloud.google.com/iam/docs/).
+ * @name Policy
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.Policy
+ */
+export declare const Policy: {
+    typeUrl: string;
+    is(o: any): o is Policy;
+    isAmino(o: any): o is PolicyAmino;
+    encode(message: Policy, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): Policy;
+    fromPartial(object: DeepPartial<Policy>): Policy;
+    fromAmino(object: PolicyAmino): Policy;
+    toAmino(message: Policy): PolicyAmino;
+    fromAminoMsg(object: PolicyAminoMsg): Policy;
+    fromProtoMsg(message: PolicyProtoMsg): Policy;
+    toProto(message: Policy): Uint8Array;
+    toProtoMsg(message: Policy): PolicyProtoMsg;
+    registerTypeUrl(): void;
+};
+/**
+ * Associates `members`, or principals, with a `role`.
+ * @name Binding
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.Binding
+ */
+export declare const Binding: {
+    typeUrl: string;
+    is(o: any): o is Binding;
+    isAmino(o: any): o is BindingAmino;
+    encode(message: Binding, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): Binding;
+    fromPartial(object: DeepPartial<Binding>): Binding;
+    fromAmino(object: BindingAmino): Binding;
+    toAmino(message: Binding): BindingAmino;
+    fromAminoMsg(object: BindingAminoMsg): Binding;
+    fromProtoMsg(message: BindingProtoMsg): Binding;
+    toProto(message: Binding): Uint8Array;
+    toProtoMsg(message: Binding): BindingProtoMsg;
+    registerTypeUrl(): void;
+};
+/**
+ * Specifies the audit configuration for a service.
+ * The configuration determines which permission types are logged, and what
+ * identities, if any, are exempted from logging.
+ * An AuditConfig must have one or more AuditLogConfigs.
+ *
+ * If there are AuditConfigs for both `allServices` and a specific service,
+ * the union of the two AuditConfigs is used for that service: the log_types
+ * specified in each AuditConfig are enabled, and the exempted_members in each
+ * AuditLogConfig are exempted.
+ *
+ * Example Policy with multiple AuditConfigs:
+ *
+ *     {
+ *       "audit_configs": [
+ *         {
+ *           "service": "allServices",
+ *           "audit_log_configs": [
+ *             {
+ *               "log_type": "DATA_READ",
+ *               "exempted_members": [
+ *                 "user:jose@example.com"
+ *               ]
+ *             },
+ *             {
+ *               "log_type": "DATA_WRITE"
+ *             },
+ *             {
+ *               "log_type": "ADMIN_READ"
+ *             }
+ *           ]
+ *         },
+ *         {
+ *           "service": "sampleservice.googleapis.com",
+ *           "audit_log_configs": [
+ *             {
+ *               "log_type": "DATA_READ"
+ *             },
+ *             {
+ *               "log_type": "DATA_WRITE",
+ *               "exempted_members": [
+ *                 "user:aliya@example.com"
+ *               ]
+ *             }
+ *           ]
+ *         }
+ *       ]
+ *     }
+ *
+ * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
+ * logging. It also exempts `jose@example.com` from DATA_READ logging, and
+ * `aliya@example.com` from DATA_WRITE logging.
+ * @name AuditConfig
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditConfig
+ */
+export declare const AuditConfig: {
+    typeUrl: string;
+    is(o: any): o is AuditConfig;
+    isAmino(o: any): o is AuditConfigAmino;
+    encode(message: AuditConfig, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): AuditConfig;
+    fromPartial(object: DeepPartial<AuditConfig>): AuditConfig;
+    fromAmino(object: AuditConfigAmino): AuditConfig;
+    toAmino(message: AuditConfig): AuditConfigAmino;
+    fromAminoMsg(object: AuditConfigAminoMsg): AuditConfig;
+    fromProtoMsg(message: AuditConfigProtoMsg): AuditConfig;
+    toProto(message: AuditConfig): Uint8Array;
+    toProtoMsg(message: AuditConfig): AuditConfigProtoMsg;
+    registerTypeUrl(): void;
+};
+/**
+ * Provides the configuration for logging a type of permissions.
+ * Example:
+ *
+ *     {
+ *       "audit_log_configs": [
+ *         {
+ *           "log_type": "DATA_READ",
+ *           "exempted_members": [
+ *             "user:jose@example.com"
+ *           ]
+ *         },
+ *         {
+ *           "log_type": "DATA_WRITE"
+ *         }
+ *       ]
+ *     }
+ *
+ * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
+ * jose@example.com from DATA_READ logging.
+ * @name AuditLogConfig
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditLogConfig
+ */
+export declare const AuditLogConfig: {
+    typeUrl: string;
+    is(o: any): o is AuditLogConfig;
+    isAmino(o: any): o is AuditLogConfigAmino;
+    encode(message: AuditLogConfig, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): AuditLogConfig;
+    fromPartial(object: DeepPartial<AuditLogConfig>): AuditLogConfig;
+    fromAmino(object: AuditLogConfigAmino): AuditLogConfig;
+    toAmino(message: AuditLogConfig): AuditLogConfigAmino;
+    fromAminoMsg(object: AuditLogConfigAminoMsg): AuditLogConfig;
+    fromProtoMsg(message: AuditLogConfigProtoMsg): AuditLogConfig;
+    toProto(message: AuditLogConfig): Uint8Array;
+    toProtoMsg(message: AuditLogConfig): AuditLogConfigProtoMsg;
+    registerTypeUrl(): void;
+};
+/**
+ * The difference delta between two policies.
+ * @name PolicyDelta
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.PolicyDelta
+ */
+export declare const PolicyDelta: {
+    typeUrl: string;
+    is(o: any): o is PolicyDelta;
+    isAmino(o: any): o is PolicyDeltaAmino;
+    encode(message: PolicyDelta, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): PolicyDelta;
+    fromPartial(object: DeepPartial<PolicyDelta>): PolicyDelta;
+    fromAmino(object: PolicyDeltaAmino): PolicyDelta;
+    toAmino(message: PolicyDelta): PolicyDeltaAmino;
+    fromAminoMsg(object: PolicyDeltaAminoMsg): PolicyDelta;
+    fromProtoMsg(message: PolicyDeltaProtoMsg): PolicyDelta;
+    toProto(message: PolicyDelta): Uint8Array;
+    toProtoMsg(message: PolicyDelta): PolicyDeltaProtoMsg;
+    registerTypeUrl(): void;
+};
+/**
+ * One delta entry for Binding. Each individual change (only one member in each
+ * entry) to a binding will be a separate entry.
+ * @name BindingDelta
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.BindingDelta
+ */
+export declare const BindingDelta: {
+    typeUrl: string;
+    is(o: any): o is BindingDelta;
+    isAmino(o: any): o is BindingDeltaAmino;
+    encode(message: BindingDelta, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): BindingDelta;
+    fromPartial(object: DeepPartial<BindingDelta>): BindingDelta;
+    fromAmino(object: BindingDeltaAmino): BindingDelta;
+    toAmino(message: BindingDelta): BindingDeltaAmino;
+    fromAminoMsg(object: BindingDeltaAminoMsg): BindingDelta;
+    fromProtoMsg(message: BindingDeltaProtoMsg): BindingDelta;
+    toProto(message: BindingDelta): Uint8Array;
+    toProtoMsg(message: BindingDelta): BindingDeltaProtoMsg;
+    registerTypeUrl(): void;
+};
+/**
+ * One delta entry for AuditConfig. Each individual change (only one
+ * exempted_member in each entry) to a AuditConfig will be a separate entry.
+ * @name AuditConfigDelta
+ * @package google.iam.v1
+ * @see proto type: google.iam.v1.AuditConfigDelta
+ */
+export declare const AuditConfigDelta: {
+    typeUrl: string;
+    is(o: any): o is AuditConfigDelta;
+    isAmino(o: any): o is AuditConfigDeltaAmino;
+    encode(message: AuditConfigDelta, writer?: BinaryWriter): BinaryWriter;
+    decode(input: BinaryReader | Uint8Array, length?: number): AuditConfigDelta;
+    fromPartial(object: DeepPartial<AuditConfigDelta>): AuditConfigDelta;
+    fromAmino(object: AuditConfigDeltaAmino): AuditConfigDelta;
+    toAmino(message: AuditConfigDelta): AuditConfigDeltaAmino;
+    fromAminoMsg(object: AuditConfigDeltaAminoMsg): AuditConfigDelta;
+    fromProtoMsg(message: AuditConfigDeltaProtoMsg): AuditConfigDelta;
+    toProto(message: AuditConfigDelta): Uint8Array;
+    toProtoMsg(message: AuditConfigDelta): AuditConfigDeltaProtoMsg;
+    registerTypeUrl(): void;
+};