analyzeMove(resource, destinationParent=None, view=None, x__xgafv=None)
Analyze moving a resource to a specified destination without kicking off the actual move. The analysis is best effort depending on the user's permissions of viewing different hierarchical policies and configurations. The policies and configuration are subject to change before the actual resource migration takes place.
+ +Analyzes organization policies under a scope.
+ +Retrieves the next page of results.
+ +Analyzes organization policies governed assets (GCP resources or policies) under a scope. This RPC supports custom constraints and the following 10 canned constraints: * storage.uniformBucketLevelAccess * iam.disableServiceAccountKeyCreation * iam.allowedPolicyMemberDomains * compute.vmExternalIpAccess * appengine.enforceServiceAccountActAsCheck * gcp.resourceLocations * compute.trustedImageProjects * compute.skipDefaultNetworkCreation * compute.requireOsLogin * compute.disableNestedVirtualization This RPC only returns either: * resources of types supported by [searchable asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types), or * IAM policies.
+
+ analyzeOrgPolicyGovernedAssets_next()
Retrieves the next page of results.
+ +Analyzes organization policies governed containers (projects, folders or organization) under a scope.
+
+ analyzeOrgPolicyGovernedContainers_next()
Retrieves the next page of results.
Batch gets the update history of assets that overlap a time window. For IAM_POLICY content, this API outputs history when the asset and its attached IAM POLICY both exist. This can create gaps in the output history. Otherwise, this API outputs history with asset in both non-delete or deleted status. If a specified asset does not exist, this API returns an INVALID_ARGUMENT error.
@@ -92,6 +110,9 @@
exportAssets(parent, body=None, x__xgafv=None)
Exports assets with time and resource types to a given Cloud Storage location/BigQuery table. For Cloud Storage location destinations, the output format is newline-delimited JSON. Each line represents a google.cloud.asset.v1.Asset in the JSON format; for BigQuery table destinations, the output table stores the fields in asset Protobuf as columns. This API implements the google.longrunning.Operation API, which allows you to keep track of the export. We recommend intervals of at least 2 seconds with exponential retry to poll the export operation result. For regular-size resource parent, the export operation usually finishes within 5 minutes.
+
+ queryAssets(parent, body=None, x__xgafv=None)
Issue a job that queries assets using a SQL statement compatible with [BigQuery Standard SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql). If the query execution finishes within timeout and there's no pagination, the full query results will be returned in the `QueryAssetsResponse`. Otherwise, full query results can be obtained by issuing extra requests with the `job_reference` from the a previous `QueryAssets` call. Note, the query result has approximately 10 GB limitation enforced by BigQuery https://cloud.google.com/bigquery/docs/best-practices-performance-output, queries return larger results will result in errors.
Searches all IAM policies within the specified scope, such as a project, folder, or organization. The caller must be granted the `cloudasset.assets.searchAllIamPolicies` permission on the desired scope, otherwise the request will be rejected.
@@ -478,6 +499,428 @@analyzeOrgPolicies(scope, constraint=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Analyzes organization policies under a scope.
+
+Args:
+ scope: string, Required. The organization to scope the request. Only organization policies within the scope will be analyzed. * organizations/{ORGANIZATION_NUMBER} (e.g., "organizations/123456") (required)
+ constraint: string, Required. The name of the constraint to analyze organization policies for. The response only contains analyzed organization policies for the provided constraint.
+ filter: string, The expression to filter AnalyzeOrgPoliciesResponse.org_policy_results. The only supported field is `consolidated_policy.attached_resource`, and the only supported operator is `=`. Example: consolidated_policy.attached_resource="//cloudresourcemanager.googleapis.com/folders/001" will return the org policy results of"folders/001".
+ pageSize: integer, The maximum number of items to return per page. If unspecified, AnalyzeOrgPoliciesResponse.org_policy_results will contain 20 items with a maximum of 200.
+ pageToken: string, The pagination token to retrieve the next page.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # The response message for AssetService.AnalyzeOrgPolicies.
+ "constraint": { # The organization policy constraint definition. # The definition of the constraint in the request.
+ "customConstraint": { # The definition of a custom constraint. # The definition of the custom constraint.
+ "actionType": "A String", # Allow or deny type.
+ "condition": "A String", # Organization policy condition/expression. For example: `resource.instanceName.matches("[production|test]_.*_(\d)+")'` or, `resource.management.auto_upgrade == true`
+ "description": "A String", # Detailed information about this custom policy constraint.
+ "displayName": "A String", # One line display name for the UI.
+ "methodTypes": [ # All the operations being applied for this constraint.
+ "A String",
+ ],
+ "name": "A String", # Name of the constraint. This is unique within the organization. Format of the name should be * `organizations/{organization_id}/customConstraints/{custom_constraint_id}` Example : "organizations/123/customConstraints/custom.createOnlyE2TypeVms"
+ "resourceTypes": [ # The Resource Instance type on which this policy applies to. Format will be of the form : "/" Example: * `compute.googleapis.com/Instance`.
+ "A String",
+ ],
+ },
+ "googleDefinedConstraint": { # The definition of a constraint. # The definition of the canned constraint defined by Google.
+ "booleanConstraint": { # A `Constraint` that is either enforced or not. For example a constraint `constraints/compute.disableSerialPortAccess`. If it is enforced on a VM instance, serial port connections will not be opened to that instance. # Defines this constraint as being a BooleanConstraint.
+ },
+ "constraintDefault": "A String", # The evaluation behavior of this constraint in the absence of 'Policy'.
+ "description": "A String", # Detailed description of what this `Constraint` controls as well as how and where it is enforced.
+ "displayName": "A String", # The human readable name of the constraint.
+ "listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are configured by an Organization's policy administrator with a `Policy`. # Defines this constraint as being a ListConstraint.
+ "supportsIn": True or False, # Indicates whether values grouped into categories can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `"in:Python"` would match any value in the 'Python' group.
+ "supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `"under:folders/123"` would match any resource under the 'folders/123' folder.
+ },
+ "name": "A String", # The unique name of the constraint. Format of the name should be * `constraints/{constraint_name}` For example, `constraints/compute.disableSerialPortAccess`.
+ },
+ },
+ "nextPageToken": "A String", # The page token to fetch the next page for AnalyzeOrgPoliciesResponse.org_policy_results.
+ "orgPolicyResults": [ # The organization policies under the AnalyzeOrgPoliciesRequest.scope with the AnalyzeOrgPoliciesRequest.constraint.
+ { # The organization policy result to the query.
+ "consolidatedPolicy": { # This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose. # The consolidated organization policy for the analyzed resource. The consolidated organization policy is computed by merging and evaluating AnalyzeOrgPoliciesResponse.policy_bundle. The evaluation will respect the organization policy [hierarchy rules](https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy).
+ "appliedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.
+ "attachedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.
+ "inheritFromParent": True or False, # If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.
+ "reset": True or False, # Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
+ "rules": [ # List of rules for this organization policy.
+ { # Represents a rule defined in an organization policy
+ "allowAll": True or False, # Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The evaluating condition for this rule.
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "denyAll": True or False, # Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
+ "enforce": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
+ "values": { # The string values for the list constraints. # List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+ "allowedValues": [ # List of values allowed at this resource.
+ "A String",
+ ],
+ "deniedValues": [ # List of values denied at this resource.
+ "A String",
+ ],
+ },
+ },
+ ],
+ },
+ "policyBundle": [ # The ordered list of all organization policies from the AnalyzeOrgPoliciesResponse.OrgPolicyResult.consolidated_policy.attached_resource. to the scope specified in the request. If the constraint is defined with default policy, it will also appear in the list.
+ { # This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose.
+ "appliedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.
+ "attachedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.
+ "inheritFromParent": True or False, # If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.
+ "reset": True or False, # Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
+ "rules": [ # List of rules for this organization policy.
+ { # Represents a rule defined in an organization policy
+ "allowAll": True or False, # Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The evaluating condition for this rule.
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "denyAll": True or False, # Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
+ "enforce": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
+ "values": { # The string values for the list constraints. # List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+ "allowedValues": [ # List of values allowed at this resource.
+ "A String",
+ ],
+ "deniedValues": [ # List of values denied at this resource.
+ "A String",
+ ],
+ },
+ },
+ ],
+ },
+ ],
+ },
+ ],
+}
+analyzeOrgPolicies_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
analyzeOrgPolicyGovernedAssets(scope, constraint=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Analyzes organization policies governed assets (GCP resources or policies) under a scope. This RPC supports custom constraints and the following 10 canned constraints: * storage.uniformBucketLevelAccess * iam.disableServiceAccountKeyCreation * iam.allowedPolicyMemberDomains * compute.vmExternalIpAccess * appengine.enforceServiceAccountActAsCheck * gcp.resourceLocations * compute.trustedImageProjects * compute.skipDefaultNetworkCreation * compute.requireOsLogin * compute.disableNestedVirtualization This RPC only returns either: * resources of types supported by [searchable asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types), or * IAM policies.
+
+Args:
+ scope: string, Required. The organization to scope the request. Only organization policies within the scope will be analyzed. The output assets will also be limited to the ones governed by those in-scope organization policies. * organizations/{ORGANIZATION_NUMBER} (e.g., "organizations/123456") (required)
+ constraint: string, Required. The name of the constraint to analyze governed assets for. The analysis only contains analyzed organization policies for the provided constraint.
+ filter: string, The expression to filter the governed assets in result. The only supported fields for governed resources are `governed_resource.project` and `governed_resource.folders`. The only supported fields for governed iam policies are `governed_iam_policy.project` and `governed_iam_policy.folders`. The only supported operator is `=`. Example 1: governed_resource.project="projects/12345678" filter will return all governed resources under projects/12345678 including the project ifself, if applicable. Example 2: governed_iam_policy.folders="folders/12345678" filter will return all governed iam policies under folders/12345678, if applicable.
+ pageSize: integer, The maximum number of items to return per page. If unspecified, AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets will contain 100 items with a maximum of 200.
+ pageToken: string, The pagination token to retrieve the next page.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # The response message for AssetService.AnalyzeOrgPolicyGovernedAssets.
+ "constraint": { # The organization policy constraint definition. # The definition of the constraint in the request.
+ "customConstraint": { # The definition of a custom constraint. # The definition of the custom constraint.
+ "actionType": "A String", # Allow or deny type.
+ "condition": "A String", # Organization policy condition/expression. For example: `resource.instanceName.matches("[production|test]_.*_(\d)+")'` or, `resource.management.auto_upgrade == true`
+ "description": "A String", # Detailed information about this custom policy constraint.
+ "displayName": "A String", # One line display name for the UI.
+ "methodTypes": [ # All the operations being applied for this constraint.
+ "A String",
+ ],
+ "name": "A String", # Name of the constraint. This is unique within the organization. Format of the name should be * `organizations/{organization_id}/customConstraints/{custom_constraint_id}` Example : "organizations/123/customConstraints/custom.createOnlyE2TypeVms"
+ "resourceTypes": [ # The Resource Instance type on which this policy applies to. Format will be of the form : "/" Example: * `compute.googleapis.com/Instance`.
+ "A String",
+ ],
+ },
+ "googleDefinedConstraint": { # The definition of a constraint. # The definition of the canned constraint defined by Google.
+ "booleanConstraint": { # A `Constraint` that is either enforced or not. For example a constraint `constraints/compute.disableSerialPortAccess`. If it is enforced on a VM instance, serial port connections will not be opened to that instance. # Defines this constraint as being a BooleanConstraint.
+ },
+ "constraintDefault": "A String", # The evaluation behavior of this constraint in the absence of 'Policy'.
+ "description": "A String", # Detailed description of what this `Constraint` controls as well as how and where it is enforced.
+ "displayName": "A String", # The human readable name of the constraint.
+ "listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are configured by an Organization's policy administrator with a `Policy`. # Defines this constraint as being a ListConstraint.
+ "supportsIn": True or False, # Indicates whether values grouped into categories can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `"in:Python"` would match any value in the 'Python' group.
+ "supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `"under:folders/123"` would match any resource under the 'folders/123' folder.
+ },
+ "name": "A String", # The unique name of the constraint. Format of the name should be * `constraints/{constraint_name}` For example, `constraints/compute.disableSerialPortAccess`.
+ },
+ },
+ "governedAssets": [ # The list of the analyzed governed assets.
+ { # Represents a GCP asset(resource or IAM policy) governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint.
+ "consolidatedPolicy": { # This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose. # The consolidated policy for the analyzed asset. The consolidated policy is computed by merging and evaluating AnalyzeOrgPolicyGovernedAssetsResponse.GovernedAsset.policy_bundle. The evaluation will respect the organization policy [hierarchy rules](https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy).
+ "appliedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.
+ "attachedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.
+ "inheritFromParent": True or False, # If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.
+ "reset": True or False, # Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
+ "rules": [ # List of rules for this organization policy.
+ { # Represents a rule defined in an organization policy
+ "allowAll": True or False, # Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The evaluating condition for this rule.
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "denyAll": True or False, # Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
+ "enforce": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
+ "values": { # The string values for the list constraints. # List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+ "allowedValues": [ # List of values allowed at this resource.
+ "A String",
+ ],
+ "deniedValues": [ # List of values denied at this resource.
+ "A String",
+ ],
+ },
+ },
+ ],
+ },
+ "governedIamPolicy": { # The IAM policies governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint. # An IAM policy governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint.
+ "attachedResource": "A String", # The full resource name of the resource associated with this IAM policy. Example: `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. See [Cloud Asset Inventory Resource Name Format](https://cloud.google.com/asset-inventory/docs/resource-name-format) for more information.
+ "folders": [ # The folder(s) that this IAM policy belongs to, in the form of folders/{FOLDER_NUMBER}. This field is available when the IAM policy belongs(directly or cascadingly) to one or more folders.
+ "A String",
+ ],
+ "organization": "A String", # The organization that this IAM policy belongs to, in the form of organizations/{ORGANIZATION_NUMBER}. This field is available when the IAM policy belongs(directly or cascadingly) to an organization.
+ "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # The IAM policy directly set on the given resource.
+ "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
+ { # Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
+ "auditLogConfigs": [ # The configuration for logging of each type of permission.
+ { # Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
+ "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
+ "A String",
+ ],
+ "logType": "A String", # The log type that this config enables.
+ },
+ ],
+ "service": "A String", # Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
+ },
+ ],
+ "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:alice@example.com`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`.
+ { # Associates `members`, or principals, with a `role`.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "members": [ # Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+ "A String",
+ ],
+ "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+ },
+ ],
+ "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost.
+ "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ },
+ "project": "A String", # The project that this IAM policy belongs to, in the form of projects/{PROJECT_NUMBER}. This field is available when the IAM policy belongs to a project.
+ },
+ "governedResource": { # The GCP resources governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint. # A GCP resource governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint.
+ "folders": [ # The folder(s) that this resource belongs to, in the form of folders/{FOLDER_NUMBER}. This field is available when the resource belongs(directly or cascadingly) to one or more folders.
+ "A String",
+ ],
+ "fullResourceName": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of the GCP resource.
+ "organization": "A String", # The organization that this resource belongs to, in the form of organizations/{ORGANIZATION_NUMBER}. This field is available when the resource belongs(directly or cascadingly) to an organization.
+ "parent": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of the parent of AnalyzeOrgPolicyGovernedAssetsResponse.GovernedResource.full_resource_name.
+ "project": "A String", # The project that this resource belongs to, in the form of projects/{PROJECT_NUMBER}. This field is available when the resource belongs to a project.
+ },
+ "policyBundle": [ # The ordered list of all organization policies from the AnalyzeOrgPoliciesResponse.OrgPolicyResult.consolidated_policy.attached_resource to the scope specified in the request. If the constraint is defined with default policy, it will also appear in the list.
+ { # This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose.
+ "appliedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.
+ "attachedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.
+ "inheritFromParent": True or False, # If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.
+ "reset": True or False, # Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
+ "rules": [ # List of rules for this organization policy.
+ { # Represents a rule defined in an organization policy
+ "allowAll": True or False, # Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The evaluating condition for this rule.
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "denyAll": True or False, # Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
+ "enforce": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
+ "values": { # The string values for the list constraints. # List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+ "allowedValues": [ # List of values allowed at this resource.
+ "A String",
+ ],
+ "deniedValues": [ # List of values denied at this resource.
+ "A String",
+ ],
+ },
+ },
+ ],
+ },
+ ],
+ },
+ ],
+ "nextPageToken": "A String", # The page token to fetch the next page for AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets.
+}
+analyzeOrgPolicyGovernedAssets_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
analyzeOrgPolicyGovernedContainers(scope, constraint=None, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
+ Analyzes organization policies governed containers (projects, folders or organization) under a scope.
+
+Args:
+ scope: string, Required. The organization to scope the request. Only organization policies within the scope will be analyzed. The output containers will also be limited to the ones governed by those in-scope organization policies. * organizations/{ORGANIZATION_NUMBER} (e.g., "organizations/123456") (required)
+ constraint: string, Required. The name of the constraint to analyze governed containers for. The analysis only contains organization policies for the provided constraint.
+ filter: string, The expression to filter the governed containers in result. The only supported field is `parent`, and the only supported operator is `=`. Example: parent="//cloudresourcemanager.googleapis.com/folders/001" will return all containers under "folders/001".
+ pageSize: integer, The maximum number of items to return per page. If unspecified, AnalyzeOrgPolicyGovernedContainersResponse.governed_containers will contain 100 items with a maximum of 200.
+ pageToken: string, The pagination token to retrieve the next page.
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # The response message for AssetService.AnalyzeOrgPolicyGovernedContainers.
+ "constraint": { # The organization policy constraint definition. # The definition of the constraint in the request.
+ "customConstraint": { # The definition of a custom constraint. # The definition of the custom constraint.
+ "actionType": "A String", # Allow or deny type.
+ "condition": "A String", # Organization policy condition/expression. For example: `resource.instanceName.matches("[production|test]_.*_(\d)+")'` or, `resource.management.auto_upgrade == true`
+ "description": "A String", # Detailed information about this custom policy constraint.
+ "displayName": "A String", # One line display name for the UI.
+ "methodTypes": [ # All the operations being applied for this constraint.
+ "A String",
+ ],
+ "name": "A String", # Name of the constraint. This is unique within the organization. Format of the name should be * `organizations/{organization_id}/customConstraints/{custom_constraint_id}` Example : "organizations/123/customConstraints/custom.createOnlyE2TypeVms"
+ "resourceTypes": [ # The Resource Instance type on which this policy applies to. Format will be of the form : "/" Example: * `compute.googleapis.com/Instance`.
+ "A String",
+ ],
+ },
+ "googleDefinedConstraint": { # The definition of a constraint. # The definition of the canned constraint defined by Google.
+ "booleanConstraint": { # A `Constraint` that is either enforced or not. For example a constraint `constraints/compute.disableSerialPortAccess`. If it is enforced on a VM instance, serial port connections will not be opened to that instance. # Defines this constraint as being a BooleanConstraint.
+ },
+ "constraintDefault": "A String", # The evaluation behavior of this constraint in the absence of 'Policy'.
+ "description": "A String", # Detailed description of what this `Constraint` controls as well as how and where it is enforced.
+ "displayName": "A String", # The human readable name of the constraint.
+ "listConstraint": { # A `Constraint` that allows or disallows a list of string values, which are configured by an Organization's policy administrator with a `Policy`. # Defines this constraint as being a ListConstraint.
+ "supportsIn": True or False, # Indicates whether values grouped into categories can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `"in:Python"` would match any value in the 'Python' group.
+ "supportsUnder": True or False, # Indicates whether subtrees of Cloud Resource Manager resource hierarchy can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `"under:folders/123"` would match any resource under the 'folders/123' folder.
+ },
+ "name": "A String", # The unique name of the constraint. Format of the name should be * `constraints/{constraint_name}` For example, `constraints/compute.disableSerialPortAccess`.
+ },
+ },
+ "governedContainers": [ # The list of the analyzed governed containers.
+ { # The organization/folder/project resource governed by organization policies of AnalyzeOrgPolicyGovernedContainersRequest.constraint.
+ "consolidatedPolicy": { # This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose. # The consolidated organization policy for the analyzed resource. The consolidated organization policy is computed by merging and evaluating AnalyzeOrgPolicyGovernedContainersResponse.GovernedContainer.policy_bundle. The evaluation will respect the organization policy [hierarchy rules](https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy).
+ "appliedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.
+ "attachedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.
+ "inheritFromParent": True or False, # If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.
+ "reset": True or False, # Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
+ "rules": [ # List of rules for this organization policy.
+ { # Represents a rule defined in an organization policy
+ "allowAll": True or False, # Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The evaluating condition for this rule.
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "denyAll": True or False, # Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
+ "enforce": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
+ "values": { # The string values for the list constraints. # List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+ "allowedValues": [ # List of values allowed at this resource.
+ "A String",
+ ],
+ "deniedValues": [ # List of values denied at this resource.
+ "A String",
+ ],
+ },
+ },
+ ],
+ },
+ "fullResourceName": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource.
+ "parent": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of the parent of AnalyzeOrgPolicyGovernedContainersResponse.GovernedContainer.full_resource_name.
+ "policyBundle": [ # The ordered list of all organization policies from the AnalyzeOrgPoliciesResponse.OrgPolicyResult.consolidated_policy.attached_resource. to the scope specified in the request. If the constraint is defined with default policy, it will also appear in the list.
+ { # This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose.
+ "appliedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.
+ "attachedResource": "A String", # The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.
+ "inheritFromParent": True or False, # If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.
+ "reset": True or False, # Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
+ "rules": [ # List of rules for this organization policy.
+ { # Represents a rule defined in an organization policy
+ "allowAll": True or False, # Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
+ "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The evaluating condition for this rule.
+ "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
+ "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
+ "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
+ "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
+ },
+ "denyAll": True or False, # Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
+ "enforce": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
+ "values": { # The string values for the list constraints. # List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
+ "allowedValues": [ # List of values allowed at this resource.
+ "A String",
+ ],
+ "deniedValues": [ # List of values denied at this resource.
+ "A String",
+ ],
+ },
+ },
+ ],
+ },
+ ],
+ },
+ ],
+ "nextPageToken": "A String", # The page token to fetch the next page for AnalyzeOrgPolicyGovernedContainersResponse.governed_containers.
+}
+analyzeOrgPolicyGovernedContainers_next()
+ Retrieves the next page of results. + + Args: + previous_request: The request for the previous page. (required) + previous_response: The response from the request for the previous page. (required) + + Returns: + A request object that you can call 'execute()' on to request the next + page. Returns None if there are no more items in the collection. ++
batchGetAssetsHistory(parent, assetNames=None, contentType=None, readTimeWindow_endTime=None, readTimeWindow_startTime=None, relationshipTypes=None, x__xgafv=None)
Batch gets the update history of assets that overlap a time window. For IAM_POLICY content, this API outputs history when the asset and its attached IAM POLICY both exist. This can create gaps in the output history. Otherwise, this API outputs history with asset in both non-delete or deleted status. If a specified asset does not exist, this API returns an INVALID_ARGUMENT error. @@ -557,7 +1000,7 @@Method Details
}, }, "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters. + "name": "A String", # Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`. "title": "A String", # Human readable title. Must be unique within the Policy. }, "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). @@ -831,7 +1274,7 @@Method Details
}, "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview). "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}` + "name": "A String", # Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`. "perimeterType": "A String", # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set. "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty. @@ -1044,7 +1487,7 @@Method Details
}, }, "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters. + "name": "A String", # Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`. "title": "A String", # Human readable title. Must be unique within the Policy. }, "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). @@ -1318,7 +1761,7 @@Method Details
}, "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview). "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}` + "name": "A String", # Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`. "perimeterType": "A String", # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set. "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty. @@ -1560,6 +2003,86 @@Method Details
}
queryAssets(parent, body=None, x__xgafv=None)
+ Issue a job that queries assets using a SQL statement compatible with [BigQuery Standard SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql). If the query execution finishes within timeout and there's no pagination, the full query results will be returned in the `QueryAssetsResponse`. Otherwise, full query results can be obtained by issuing extra requests with the `job_reference` from the a previous `QueryAssets` call. Note, the query result has approximately 10 GB limitation enforced by BigQuery https://cloud.google.com/bigquery/docs/best-practices-performance-output, queries return larger results will result in errors.
+
+Args:
+ parent: string, Required. The relative name of the root asset. This can only be an organization number (such as "organizations/123"), a project ID (such as "projects/my-project-id"), or a project number (such as "projects/12345"), or a folder number (such as "folders/123"). Only assets belonging to the `parent` will be returned. (required)
+ body: object, The request body.
+ The object takes the form of:
+
+{ # QueryAssets request.
+ "jobReference": "A String", # Optional. Reference to the query job, which is from the `QueryAssetsResponse` of previous `QueryAssets` call.
+ "outputConfig": { # Output configuration query assets. # Optional. Destination where the query results will be saved. When this field is specified, the query results won't be saved in the [QueryAssetsResponse.query_result]. Instead [QueryAssetsResponse.output_config] will be set. Meanwhile, [QueryAssetsResponse.job_reference] will be set and can be used to check the status of the query job when passed to a following [QueryAssets] API call.
+ "bigqueryDestination": { # BigQuery destination. # BigQuery destination where the query results will be saved.
+ "dataset": "A String", # Required. The BigQuery dataset where the query results will be saved. It has the format of "projects/{projectId}/datasets/{datasetId}".
+ "table": "A String", # Required. The BigQuery table where the query results will be saved. If this table does not exist, a new table with the given name will be created.
+ "writeDisposition": "A String", # Specifies the action that occurs if the destination table or partition already exists. The following values are supported: * WRITE_TRUNCATE: If the table or partition already exists, BigQuery overwrites the entire table or all the partitions data. * WRITE_APPEND: If the table or partition already exists, BigQuery appends the data to the table or the latest partition. * WRITE_EMPTY: If the table already exists and contains data, a 'duplicate' error is returned in the job result. The default value is WRITE_EMPTY.
+ },
+ },
+ "pageSize": 42, # Optional. The maximum number of rows to return in the results. Responses are limited to 10 MB and 1000 rows. By default, the maximum row count is 1000. When the byte or row count limit is reached, the rest of the query results will be paginated. The field will be ignored when [output_config] is specified.
+ "pageToken": "A String", # Optional. A page token received from previous `QueryAssets`. The field will be ignored when [output_config] is specified.
+ "readTime": "A String", # Optional. Queries cloud assets as they appeared at the specified point in time.
+ "readTimeWindow": { # A time window specified by its `start_time` and `end_time`. # Optional. [start_time] is required. [start_time] must be less than [end_time] Defaults [end_time] to now if [start_time] is set and [end_time] isn't. Maximum permitted time range is 7 days.
+ "endTime": "A String", # End time of the time window (inclusive). If not specified, the current timestamp is used instead.
+ "startTime": "A String", # Start time of the time window (exclusive).
+ },
+ "statement": "A String", # Optional. A SQL statement that's compatible with [BigQuery Standard SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql).
+ "timeout": "A String", # Optional. Specifies the maximum amount of time that the client is willing to wait for the query to complete. By default, this limit is 5 min for the first query, and 1 minute for the following queries. If the query is complete, the `done` field in the `QueryAssetsResponse` is true, otherwise false. Like BigQuery [jobs.query API](https://cloud.google.com/bigquery/docs/reference/rest/v2/jobs/query#queryrequest) The call is not guaranteed to wait for the specified timeout; it typically returns after around 200 seconds (200,000 milliseconds), even if the query is not complete. The field will be ignored when [output_config] is specified.
+}
+
+ x__xgafv: string, V1 error format.
+ Allowed values
+ 1 - v1 error format
+ 2 - v2 error format
+
+Returns:
+ An object of the form:
+
+ { # QueryAssets response.
+ "done": True or False, # The query response, which can be either an `error` or a valid `response`. If `done` == `false` and the query result is being saved in a output, the output_config field will be set. If `done` == `true`, exactly one of `error`, `query_result` or `output_config` will be set.
+ "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # Error status.
+ "code": 42, # The status code, which should be an enum value of google.rpc.Code.
+ "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
+ {
+ "a_key": "", # Properties of the object. Contains field @type with type URL.
+ },
+ ],
+ "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
+ },
+ "jobReference": "A String", # Reference to a query job.
+ "outputConfig": { # Output configuration query assets. # Output configuration which indicates instead of being returned in API response on the fly, the query result will be saved in a specific output.
+ "bigqueryDestination": { # BigQuery destination. # BigQuery destination where the query results will be saved.
+ "dataset": "A String", # Required. The BigQuery dataset where the query results will be saved. It has the format of "projects/{projectId}/datasets/{datasetId}".
+ "table": "A String", # Required. The BigQuery table where the query results will be saved. If this table does not exist, a new table with the given name will be created.
+ "writeDisposition": "A String", # Specifies the action that occurs if the destination table or partition already exists. The following values are supported: * WRITE_TRUNCATE: If the table or partition already exists, BigQuery overwrites the entire table or all the partitions data. * WRITE_APPEND: If the table or partition already exists, BigQuery appends the data to the table or the latest partition. * WRITE_EMPTY: If the table already exists and contains data, a 'duplicate' error is returned in the job result. The default value is WRITE_EMPTY.
+ },
+ },
+ "queryResult": { # Execution results of the query. The result is formatted as rows represented by BigQuery compatible [schema]. When pagination is necessary, it will contains the page token to retrieve the results of following pages. # Result of the query.
+ "nextPageToken": "A String", # Token to retrieve the next page of the results.
+ "rows": [ # Each row hold a query result in the format of `Struct`.
+ {
+ "a_key": "", # Properties of the object.
+ },
+ ],
+ "schema": { # BigQuery Compatible table schema. # Describes the format of the [rows].
+ "fields": [ # Describes the fields in a table.
+ { # A field in TableSchema.
+ "field": "A String", # The field name. The name must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_), and must start with a letter or underscore. The maximum length is 128 characters.
+ "fields": [ # Describes the nested schema fields if the type property is set to RECORD.
+ # Object with schema name: TableFieldSchema
+ ],
+ "mode": "A String", # The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.
+ "type": "A String", # The field data type. Possible values include * STRING * BYTES * INTEGER * FLOAT * BOOLEAN * TIMESTAMP * DATE * TIME * DATETIME * GEOGRAPHY, * NUMERIC, * BIGNUMERIC, * RECORD (where RECORD indicates that the field contains a nested schema).
+ },
+ ],
+ },
+ "totalRows": "A String", # Total rows of the whole query results.
+ },
+}
+searchAllIamPolicies(scope, assetTypes=None, orderBy=None, pageSize=None, pageToken=None, query=None, x__xgafv=None)
Searches all IAM policies within the specified scope, such as a project, folder, or organization. The caller must be granted the `cloudasset.assets.searchAllIamPolicies` permission on the desired scope, otherwise the request will be rejected. diff --git a/docs/dyn/cloudasset_v1beta1.organizations.html b/docs/dyn/cloudasset_v1beta1.organizations.html index fe8e614767c..6b5bdd0584c 100644 --- a/docs/dyn/cloudasset_v1beta1.organizations.html +++ b/docs/dyn/cloudasset_v1beta1.organizations.html @@ -163,7 +163,7 @@Method Details
}, }, "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters. + "name": "A String", # Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`. "title": "A String", # Human readable title. Must be unique within the Policy. }, "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). @@ -244,7 +244,7 @@Method Details
}, "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview). "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}` + "name": "A String", # Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`. "perimeterType": "A String", # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set. "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty. diff --git a/docs/dyn/cloudasset_v1beta1.projects.html b/docs/dyn/cloudasset_v1beta1.projects.html index dbac87e2497..1da726eeb07 100644 --- a/docs/dyn/cloudasset_v1beta1.projects.html +++ b/docs/dyn/cloudasset_v1beta1.projects.html @@ -163,7 +163,7 @@Method Details
}, }, "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters. + "name": "A String", # Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`. "title": "A String", # Human readable title. Must be unique within the Policy. }, "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). @@ -244,7 +244,7 @@Method Details
}, "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview). "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}` + "name": "A String", # Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`. "perimeterType": "A String", # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set. "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty. diff --git a/docs/dyn/cloudasset_v1p5beta1.assets.html b/docs/dyn/cloudasset_v1p5beta1.assets.html index dfb81c19ba2..1229a5ea87f 100644 --- a/docs/dyn/cloudasset_v1p5beta1.assets.html +++ b/docs/dyn/cloudasset_v1p5beta1.assets.html @@ -165,7 +165,7 @@Method Details
}, }, "description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters. + "name": "A String", # Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`. "title": "A String", # Human readable title. Must be unique within the Policy. }, "accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization. # Please also refer to the [access policy user guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies). @@ -249,7 +249,7 @@Method Details
}, "servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges. # Please also refer to the [service perimeter user guide](https://cloud.google.com/vpc-service-controls/docs/overview). "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect behavior. - "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}` + "name": "A String", # Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`. "perimeterType": "A String", # Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration. # Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set. "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed must be in the same policy as this `ServicePerimeter`. Referencing a nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. For Service Perimeter Bridge, must be empty. diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1.json index cb901539266..9b424e5cebe 100644 --- a/googleapiclient/discovery_cache/documents/cloudasset.v1.json +++ b/googleapiclient/discovery_cache/documents/cloudasset.v1.json @@ -716,6 +716,144 @@ "https://www.googleapis.com/auth/cloud-platform" ] }, + "analyzeOrgPolicies": { + "description": "Analyzes organization policies under a scope.", + "flatPath": "v1/{v1Id}/{v1Id1}:analyzeOrgPolicies", + "httpMethod": "GET", + "id": "cloudasset.analyzeOrgPolicies", + "parameterOrder": [ + "scope" + ], + "parameters": { + "constraint": { + "description": "Required. The name of the constraint to analyze organization policies for. The response only contains analyzed organization policies for the provided constraint.", + "location": "query", + "type": "string" + }, + "filter": { + "description": "The expression to filter AnalyzeOrgPoliciesResponse.org_policy_results. The only supported field is `consolidated_policy.attached_resource`, and the only supported operator is `=`. Example: consolidated_policy.attached_resource=\"//cloudresourcemanager.googleapis.com/folders/001\" will return the org policy results of\"folders/001\".", + "location": "query", + "type": "string" + }, + "pageSize": { + "description": "The maximum number of items to return per page. If unspecified, AnalyzeOrgPoliciesResponse.org_policy_results will contain 20 items with a maximum of 200.", + "format": "int32", + "location": "query", + "type": "integer" + }, + "pageToken": { + "description": "The pagination token to retrieve the next page.", + "location": "query", + "type": "string" + }, + "scope": { + "description": "Required. The organization to scope the request. Only organization policies within the scope will be analyzed. * organizations/{ORGANIZATION_NUMBER} (e.g., \"organizations/123456\")", + "location": "path", + "pattern": "^[^/]+/[^/]+$", + "required": true, + "type": "string" + } + }, + "path": "v1/{+scope}:analyzeOrgPolicies", + "response": { + "$ref": "AnalyzeOrgPoliciesResponse" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform" + ] + }, + "analyzeOrgPolicyGovernedAssets": { + "description": "Analyzes organization policies governed assets (GCP resources or policies) under a scope. This RPC supports custom constraints and the following 10 canned constraints: * storage.uniformBucketLevelAccess * iam.disableServiceAccountKeyCreation * iam.allowedPolicyMemberDomains * compute.vmExternalIpAccess * appengine.enforceServiceAccountActAsCheck * gcp.resourceLocations * compute.trustedImageProjects * compute.skipDefaultNetworkCreation * compute.requireOsLogin * compute.disableNestedVirtualization This RPC only returns either: * resources of types supported by [searchable asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types), or * IAM policies.", + "flatPath": "v1/{v1Id}/{v1Id1}:analyzeOrgPolicyGovernedAssets", + "httpMethod": "GET", + "id": "cloudasset.analyzeOrgPolicyGovernedAssets", + "parameterOrder": [ + "scope" + ], + "parameters": { + "constraint": { + "description": "Required. The name of the constraint to analyze governed assets for. The analysis only contains analyzed organization policies for the provided constraint.", + "location": "query", + "type": "string" + }, + "filter": { + "description": "The expression to filter the governed assets in result. The only supported fields for governed resources are `governed_resource.project` and `governed_resource.folders`. The only supported fields for governed iam policies are `governed_iam_policy.project` and `governed_iam_policy.folders`. The only supported operator is `=`. Example 1: governed_resource.project=\"projects/12345678\" filter will return all governed resources under projects/12345678 including the project ifself, if applicable. Example 2: governed_iam_policy.folders=\"folders/12345678\" filter will return all governed iam policies under folders/12345678, if applicable.", + "location": "query", + "type": "string" + }, + "pageSize": { + "description": "The maximum number of items to return per page. If unspecified, AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets will contain 100 items with a maximum of 200.", + "format": "int32", + "location": "query", + "type": "integer" + }, + "pageToken": { + "description": "The pagination token to retrieve the next page.", + "location": "query", + "type": "string" + }, + "scope": { + "description": "Required. The organization to scope the request. Only organization policies within the scope will be analyzed. The output assets will also be limited to the ones governed by those in-scope organization policies. * organizations/{ORGANIZATION_NUMBER} (e.g., \"organizations/123456\")", + "location": "path", + "pattern": "^[^/]+/[^/]+$", + "required": true, + "type": "string" + } + }, + "path": "v1/{+scope}:analyzeOrgPolicyGovernedAssets", + "response": { + "$ref": "AnalyzeOrgPolicyGovernedAssetsResponse" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform" + ] + }, + "analyzeOrgPolicyGovernedContainers": { + "description": "Analyzes organization policies governed containers (projects, folders or organization) under a scope.", + "flatPath": "v1/{v1Id}/{v1Id1}:analyzeOrgPolicyGovernedContainers", + "httpMethod": "GET", + "id": "cloudasset.analyzeOrgPolicyGovernedContainers", + "parameterOrder": [ + "scope" + ], + "parameters": { + "constraint": { + "description": "Required. The name of the constraint to analyze governed containers for. The analysis only contains organization policies for the provided constraint.", + "location": "query", + "type": "string" + }, + "filter": { + "description": "The expression to filter the governed containers in result. The only supported field is `parent`, and the only supported operator is `=`. Example: parent=\"//cloudresourcemanager.googleapis.com/folders/001\" will return all containers under \"folders/001\".", + "location": "query", + "type": "string" + }, + "pageSize": { + "description": "The maximum number of items to return per page. If unspecified, AnalyzeOrgPolicyGovernedContainersResponse.governed_containers will contain 100 items with a maximum of 200.", + "format": "int32", + "location": "query", + "type": "integer" + }, + "pageToken": { + "description": "The pagination token to retrieve the next page.", + "location": "query", + "type": "string" + }, + "scope": { + "description": "Required. The organization to scope the request. Only organization policies within the scope will be analyzed. The output containers will also be limited to the ones governed by those in-scope organization policies. * organizations/{ORGANIZATION_NUMBER} (e.g., \"organizations/123456\")", + "location": "path", + "pattern": "^[^/]+/[^/]+$", + "required": true, + "type": "string" + } + }, + "path": "v1/{+scope}:analyzeOrgPolicyGovernedContainers", + "response": { + "$ref": "AnalyzeOrgPolicyGovernedContainersResponse" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform" + ] + }, "batchGetAssetsHistory": { "description": "Batch gets the update history of assets that overlap a time window. For IAM_POLICY content, this API outputs history when the asset and its attached IAM POLICY both exist. This can create gaps in the output history. Otherwise, this API outputs history with asset in both non-delete or deleted status. If a specified asset does not exist, this API returns an INVALID_ARGUMENT error.", "flatPath": "v1/{v1Id}/{v1Id1}:batchGetAssetsHistory", @@ -816,6 +954,34 @@ "https://www.googleapis.com/auth/cloud-platform" ] }, + "queryAssets": { + "description": "Issue a job that queries assets using a SQL statement compatible with [BigQuery Standard SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql). If the query execution finishes within timeout and there's no pagination, the full query results will be returned in the `QueryAssetsResponse`. Otherwise, full query results can be obtained by issuing extra requests with the `job_reference` from the a previous `QueryAssets` call. Note, the query result has approximately 10 GB limitation enforced by BigQuery https://cloud.google.com/bigquery/docs/best-practices-performance-output, queries return larger results will result in errors.", + "flatPath": "v1/{v1Id}/{v1Id1}:queryAssets", + "httpMethod": "POST", + "id": "cloudasset.queryAssets", + "parameterOrder": [ + "parent" + ], + "parameters": { + "parent": { + "description": "Required. The relative name of the root asset. This can only be an organization number (such as \"organizations/123\"), a project ID (such as \"projects/my-project-id\"), or a project number (such as \"projects/12345\"), or a folder number (such as \"folders/123\"). Only assets belonging to the `parent` will be returned.", + "location": "path", + "pattern": "^[^/]+/[^/]+$", + "required": true, + "type": "string" + } + }, + "path": "v1/{+parent}:queryAssets", + "request": { + "$ref": "QueryAssetsRequest" + }, + "response": { + "$ref": "QueryAssetsResponse" + }, + "scopes": [ + "https://www.googleapis.com/auth/cloud-platform" + ] + }, "searchAllIamPolicies": { "description": "Searches all IAM policies within the specified scope, such as a project, folder, or organization. The caller must be granted the `cloudasset.assets.searchAllIamPolicies` permission on the desired scope, otherwise the request will be rejected.", "flatPath": "v1/{v1Id}/{v1Id1}:searchAllIamPolicies", @@ -929,7 +1095,7 @@ } } }, - "revision": "20221028", + "revision": "20221117", "rootUrl": "https://cloudasset.googleapis.com/", "schemas": { "AccessSelector": { @@ -1027,6 +1193,117 @@ }, "type": "object" }, + "AnalyzeOrgPoliciesResponse": { + "description": "The response message for AssetService.AnalyzeOrgPolicies.", + "id": "AnalyzeOrgPoliciesResponse", + "properties": { + "constraint": { + "$ref": "AnalyzerOrgPolicyConstraint", + "description": "The definition of the constraint in the request." + }, + "nextPageToken": { + "description": "The page token to fetch the next page for AnalyzeOrgPoliciesResponse.org_policy_results.", + "type": "string" + }, + "orgPolicyResults": { + "description": "The organization policies under the AnalyzeOrgPoliciesRequest.scope with the AnalyzeOrgPoliciesRequest.constraint.", + "items": { + "$ref": "OrgPolicyResult" + }, + "type": "array" + } + }, + "type": "object" + }, + "AnalyzeOrgPolicyGovernedAssetsResponse": { + "description": "The response message for AssetService.AnalyzeOrgPolicyGovernedAssets.", + "id": "AnalyzeOrgPolicyGovernedAssetsResponse", + "properties": { + "constraint": { + "$ref": "AnalyzerOrgPolicyConstraint", + "description": "The definition of the constraint in the request." + }, + "governedAssets": { + "description": "The list of the analyzed governed assets.", + "items": { + "$ref": "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedAsset" + }, + "type": "array" + }, + "nextPageToken": { + "description": "The page token to fetch the next page for AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets.", + "type": "string" + } + }, + "type": "object" + }, + "AnalyzeOrgPolicyGovernedContainersResponse": { + "description": "The response message for AssetService.AnalyzeOrgPolicyGovernedContainers.", + "id": "AnalyzeOrgPolicyGovernedContainersResponse", + "properties": { + "constraint": { + "$ref": "AnalyzerOrgPolicyConstraint", + "description": "The definition of the constraint in the request." + }, + "governedContainers": { + "description": "The list of the analyzed governed containers.", + "items": { + "$ref": "GoogleCloudAssetV1GovernedContainer" + }, + "type": "array" + }, + "nextPageToken": { + "description": "The page token to fetch the next page for AnalyzeOrgPolicyGovernedContainersResponse.governed_containers.", + "type": "string" + } + }, + "type": "object" + }, + "AnalyzerOrgPolicy": { + "description": "This organization policy message is a modified version of the one defined in the OrgPolicy system. This message contains several fields defined in the original organization policy with some new fields for analysis purpose.", + "id": "AnalyzerOrgPolicy", + "properties": { + "appliedResource": { + "description": "The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy applies to. For any user defined org policies, this field has the same value as the [attached_resource] field. Only for default policy, this field has the different value.", + "type": "string" + }, + "attachedResource": { + "description": "The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource where this organization policy is set. Notice that some type of constraints are defined with default policy. This field will be empty for them.", + "type": "string" + }, + "inheritFromParent": { + "description": "If `inherit_from_parent` is true, Rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the effective root for evaluation.", + "type": "boolean" + }, + "reset": { + "description": "Ignores policies set above this resource and restores the default behavior of the constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.", + "type": "boolean" + }, + "rules": { + "description": "List of rules for this organization policy.", + "items": { + "$ref": "GoogleCloudAssetV1Rule" + }, + "type": "array" + } + }, + "type": "object" + }, + "AnalyzerOrgPolicyConstraint": { + "description": "The organization policy constraint definition.", + "id": "AnalyzerOrgPolicyConstraint", + "properties": { + "customConstraint": { + "$ref": "GoogleCloudAssetV1CustomConstraint", + "description": "The definition of the custom constraint." + }, + "googleDefinedConstraint": { + "$ref": "GoogleCloudAssetV1Constraint", + "description": "The definition of the canned constraint defined by Google." + } + }, + "type": "object" + }, "Asset": { "description": "An asset in Google Cloud. An asset can be any resource in the Google Cloud [resource hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), a resource outside the Google Cloud resource hierarchy (such as Google Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy), or a relationship (e.g. an INSTANCE_TO_INSTANCEGROUP relationship). See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.", "id": "Asset", @@ -1560,6 +1837,92 @@ }, "type": "object" }, + "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedAsset": { + "description": "Represents a GCP asset(resource or IAM policy) governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint.", + "id": "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedAsset", + "properties": { + "consolidatedPolicy": { + "$ref": "AnalyzerOrgPolicy", + "description": "The consolidated policy for the analyzed asset. The consolidated policy is computed by merging and evaluating AnalyzeOrgPolicyGovernedAssetsResponse.GovernedAsset.policy_bundle. The evaluation will respect the organization policy [hierarchy rules](https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy)." + }, + "governedIamPolicy": { + "$ref": "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedIamPolicy", + "description": "An IAM policy governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint." + }, + "governedResource": { + "$ref": "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedResource", + "description": "A GCP resource governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint." + }, + "policyBundle": { + "description": "The ordered list of all organization policies from the AnalyzeOrgPoliciesResponse.OrgPolicyResult.consolidated_policy.attached_resource to the scope specified in the request. If the constraint is defined with default policy, it will also appear in the list.", + "items": { + "$ref": "AnalyzerOrgPolicy" + }, + "type": "array" + } + }, + "type": "object" + }, + "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedIamPolicy": { + "description": "The IAM policies governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint.", + "id": "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedIamPolicy", + "properties": { + "attachedResource": { + "description": "The full resource name of the resource associated with this IAM policy. Example: `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. See [Cloud Asset Inventory Resource Name Format](https://cloud.google.com/asset-inventory/docs/resource-name-format) for more information.", + "type": "string" + }, + "folders": { + "description": "The folder(s) that this IAM policy belongs to, in the form of folders/{FOLDER_NUMBER}. This field is available when the IAM policy belongs(directly or cascadingly) to one or more folders.", + "items": { + "type": "string" + }, + "type": "array" + }, + "organization": { + "description": "The organization that this IAM policy belongs to, in the form of organizations/{ORGANIZATION_NUMBER}. This field is available when the IAM policy belongs(directly or cascadingly) to an organization.", + "type": "string" + }, + "policy": { + "$ref": "Policy", + "description": "The IAM policy directly set on the given resource." + }, + "project": { + "description": "The project that this IAM policy belongs to, in the form of projects/{PROJECT_NUMBER}. This field is available when the IAM policy belongs to a project.", + "type": "string" + } + }, + "type": "object" + }, + "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedResource": { + "description": "The GCP resources governed by the organization policies of the AnalyzeOrgPolicyGovernedAssetsRequest.constraint.", + "id": "GoogleCloudAssetV1AnalyzeOrgPolicyGovernedAssetsResponseGovernedResource", + "properties": { + "folders": { + "description": "The folder(s) that this resource belongs to, in the form of folders/{FOLDER_NUMBER}. This field is available when the resource belongs(directly or cascadingly) to one or more folders.", + "items": { + "type": "string" + }, + "type": "array" + }, + "fullResourceName": { + "description": "The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of the GCP resource.", + "type": "string" + }, + "organization": { + "description": "The organization that this resource belongs to, in the form of organizations/{ORGANIZATION_NUMBER}. This field is available when the resource belongs(directly or cascadingly) to an organization.", + "type": "string" + }, + "parent": { + "description": "The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of the parent of AnalyzeOrgPolicyGovernedAssetsResponse.GovernedResource.full_resource_name.", + "type": "string" + }, + "project": { + "description": "The project that this resource belongs to, in the form of projects/{PROJECT_NUMBER}. This field is available when the resource belongs to a project.", + "type": "string" + } + }, + "type": "object" + }, "GoogleCloudAssetV1BigQueryDestination": { "description": "A BigQuery destination.", "id": "GoogleCloudAssetV1BigQueryDestination", @@ -1591,6 +1954,116 @@ }, "type": "object" }, + "GoogleCloudAssetV1BooleanConstraint": { + "description": "A `Constraint` that is either enforced or not. For example a constraint `constraints/compute.disableSerialPortAccess`. If it is enforced on a VM instance, serial port connections will not be opened to that instance.", + "id": "GoogleCloudAssetV1BooleanConstraint", + "properties": {}, + "type": "object" + }, + "GoogleCloudAssetV1Constraint": { + "description": "The definition of a constraint.", + "id": "GoogleCloudAssetV1Constraint", + "properties": { + "booleanConstraint": { + "$ref": "GoogleCloudAssetV1BooleanConstraint", + "description": "Defines this constraint as being a BooleanConstraint." + }, + "constraintDefault": { + "description": "The evaluation behavior of this constraint in the absence of 'Policy'.", + "enum": [ + "CONSTRAINT_DEFAULT_UNSPECIFIED", + "ALLOW", + "DENY" + ], + "enumDescriptions": [ + "This is only used for distinguishing unset values and should never be used.", + "Indicate that all values are allowed for list constraints. Indicate that enforcement is off for boolean constraints.", + "Indicate that all values are denied for list constraints. Indicate that enforcement is on for boolean constraints." + ], + "type": "string" + }, + "description": { + "description": "Detailed description of what this `Constraint` controls as well as how and where it is enforced.", + "type": "string" + }, + "displayName": { + "description": "The human readable name of the constraint.", + "type": "string" + }, + "listConstraint": { + "$ref": "GoogleCloudAssetV1ListConstraint", + "description": "Defines this constraint as being a ListConstraint." + }, + "name": { + "description": "The unique name of the constraint. Format of the name should be * `constraints/{constraint_name}` For example, `constraints/compute.disableSerialPortAccess`.", + "type": "string" + } + }, + "type": "object" + }, + "GoogleCloudAssetV1CustomConstraint": { + "description": "The definition of a custom constraint.", + "id": "GoogleCloudAssetV1CustomConstraint", + "properties": { + "actionType": { + "description": "Allow or deny type.", + "enum": [ + "ACTION_TYPE_UNSPECIFIED", + "ALLOW", + "DENY" + ], + "enumDescriptions": [ + "Unspecified. Will results in user error.", + "Allowed action type.", + "Deny action type." + ], + "type": "string" + }, + "condition": { + "description": "Organization policy condition/expression. For example: `resource.instanceName.matches(\"[production|test]_.*_(\\d)+\")'` or, `resource.management.auto_upgrade == true`", + "type": "string" + }, + "description": { + "description": "Detailed information about this custom policy constraint.", + "type": "string" + }, + "displayName": { + "description": "One line display name for the UI.", + "type": "string" + }, + "methodTypes": { + "description": "All the operations being applied for this constraint.", + "items": { + "enum": [ + "METHOD_TYPE_UNSPECIFIED", + "CREATE", + "UPDATE", + "DELETE" + ], + "enumDescriptions": [ + "Unspecified. Will results in user error.", + "Constraint applied when creating the resource.", + "Constraint applied when updating the resource.", + "Constraint applied when deleting the resource." + ], + "type": "string" + }, + "type": "array" + }, + "name": { + "description": "Name of the constraint. This is unique within the organization. Format of the name should be * `organizations/{organization_id}/customConstraints/{custom_constraint_id}` Example : \"organizations/123/customConstraints/custom.createOnlyE2TypeVms\"", + "type": "string" + }, + "resourceTypes": { + "description": "The Resource Instance type on which this policy applies to. Format will be of the form : \"/\" Example: * `compute.googleapis.com/Instance`.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, "GoogleCloudAssetV1Edge": { "description": "A directional edge.", "id": "GoogleCloudAssetV1Edge", @@ -1617,6 +2090,32 @@ }, "type": "object" }, + "GoogleCloudAssetV1GovernedContainer": { + "description": "The organization/folder/project resource governed by organization policies of AnalyzeOrgPolicyGovernedContainersRequest.constraint.", + "id": "GoogleCloudAssetV1GovernedContainer", + "properties": { + "consolidatedPolicy": { + "$ref": "AnalyzerOrgPolicy", + "description": "The consolidated organization policy for the analyzed resource. The consolidated organization policy is computed by merging and evaluating AnalyzeOrgPolicyGovernedContainersResponse.GovernedContainer.policy_bundle. The evaluation will respect the organization policy [hierarchy rules](https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy)." + }, + "fullResourceName": { + "description": "The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of an organization/folder/project resource.", + "type": "string" + }, + "parent": { + "description": "The [full resource name] (https://cloud.google.com/asset-inventory/docs/resource-name-format) of the parent of AnalyzeOrgPolicyGovernedContainersResponse.GovernedContainer.full_resource_name.", + "type": "string" + }, + "policyBundle": { + "description": "The ordered list of all organization policies from the AnalyzeOrgPoliciesResponse.OrgPolicyResult.consolidated_policy.attached_resource. to the scope specified in the request. If the constraint is defined with default policy, it will also appear in the list.", + "items": { + "$ref": "AnalyzerOrgPolicy" + }, + "type": "array" + } + }, + "type": "object" + }, "GoogleCloudAssetV1Identity": { "description": "An identity under analysis.", "id": "GoogleCloudAssetV1Identity", @@ -1653,6 +2152,40 @@ }, "type": "object" }, + "GoogleCloudAssetV1ListConstraint": { + "description": "A `Constraint` that allows or disallows a list of string values, which are configured by an Organization's policy administrator with a `Policy`.", + "id": "GoogleCloudAssetV1ListConstraint", + "properties": { + "supportsIn": { + "description": "Indicates whether values grouped into categories can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `\"in:Python\"` would match any value in the 'Python' group.", + "type": "boolean" + }, + "supportsUnder": { + "description": "Indicates whether subtrees of Cloud Resource Manager resource hierarchy can be used in `Policy.allowed_values` and `Policy.denied_values`. For example, `\"under:folders/123\"` would match any resource under the 'folders/123' folder.", + "type": "boolean" + } + }, + "type": "object" + }, + "GoogleCloudAssetV1QueryAssetsOutputConfigBigQueryDestination": { + "description": "BigQuery destination.", + "id": "GoogleCloudAssetV1QueryAssetsOutputConfigBigQueryDestination", + "properties": { + "dataset": { + "description": "Required. The BigQuery dataset where the query results will be saved. It has the format of \"projects/{projectId}/datasets/{datasetId}\".", + "type": "string" + }, + "table": { + "description": "Required. The BigQuery table where the query results will be saved. If this table does not exist, a new table with the given name will be created.", + "type": "string" + }, + "writeDisposition": { + "description": "Specifies the action that occurs if the destination table or partition already exists. The following values are supported: * WRITE_TRUNCATE: If the table or partition already exists, BigQuery overwrites the entire table or all the partitions data. * WRITE_APPEND: If the table or partition already exists, BigQuery appends the data to the table or the latest partition. * WRITE_EMPTY: If the table already exists and contains data, a 'duplicate' error is returned in the job result. The default value is WRITE_EMPTY.", + "type": "string" + } + }, + "type": "object" + }, "GoogleCloudAssetV1Resource": { "description": "A Google Cloud resource under analysis.", "id": "GoogleCloudAssetV1Resource", @@ -1668,6 +2201,54 @@ }, "type": "object" }, + "GoogleCloudAssetV1Rule": { + "description": "Represents a rule defined in an organization policy", + "id": "GoogleCloudAssetV1Rule", + "properties": { + "allowAll": { + "description": "Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.", + "type": "boolean" + }, + "condition": { + "$ref": "Expr", + "description": "The evaluating condition for this rule." + }, + "denyAll": { + "description": "Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.", + "type": "boolean" + }, + "enforce": { + "description": "If `true`, then the `Policy` is enforced. If `false`, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.", + "type": "boolean" + }, + "values": { + "$ref": "GoogleCloudAssetV1StringValues", + "description": "List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints." + } + }, + "type": "object" + }, + "GoogleCloudAssetV1StringValues": { + "description": "The string values for the list constraints.", + "id": "GoogleCloudAssetV1StringValues", + "properties": { + "allowedValues": { + "description": "List of values allowed at this resource.", + "items": { + "type": "string" + }, + "type": "array" + }, + "deniedValues": { + "description": "List of values denied at this resource.", + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, "GoogleCloudAssetV1p7beta1Asset": { "description": "An asset in Google Cloud. An asset can be any resource in the Google Cloud [resource hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), a resource outside the Google Cloud resource hierarchy (such as Google Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy). See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.", "id": "GoogleCloudAssetV1p7beta1Asset", @@ -1943,7 +2524,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.", + "description": "Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.", "type": "string" }, "title": { @@ -2367,7 +2948,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`", + "description": "Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`.", "type": "string" }, "perimeterType": { @@ -2377,7 +2958,7 @@ "PERIMETER_TYPE_BRIDGE" ], "enumDescriptions": [ - "Regular Perimeter.", + "Regular Perimeter. When no value is specified, the perimeter uses this type.", "Perimeter Bridge." ], "type": "string" @@ -2927,6 +3508,24 @@ }, "type": "object" }, + "OrgPolicyResult": { + "description": "The organization policy result to the query.", + "id": "OrgPolicyResult", + "properties": { + "consolidatedPolicy": { + "$ref": "AnalyzerOrgPolicy", + "description": "The consolidated organization policy for the analyzed resource. The consolidated organization policy is computed by merging and evaluating AnalyzeOrgPoliciesResponse.policy_bundle. The evaluation will respect the organization policy [hierarchy rules](https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy)." + }, + "policyBundle": { + "description": "The ordered list of all organization policies from the AnalyzeOrgPoliciesResponse.OrgPolicyResult.consolidated_policy.attached_resource. to the scope specified in the request. If the constraint is defined with default policy, it will also appear in the list.", + "items": { + "$ref": "AnalyzerOrgPolicy" + }, + "type": "array" + } + }, + "type": "object" + }, "OsInfo": { "description": "Operating system information for the VM.", "id": "OsInfo", @@ -3073,6 +3672,86 @@ }, "type": "object" }, + "QueryAssetsOutputConfig": { + "description": "Output configuration query assets.", + "id": "QueryAssetsOutputConfig", + "properties": { + "bigqueryDestination": { + "$ref": "GoogleCloudAssetV1QueryAssetsOutputConfigBigQueryDestination", + "description": "BigQuery destination where the query results will be saved." + } + }, + "type": "object" + }, + "QueryAssetsRequest": { + "description": "QueryAssets request.", + "id": "QueryAssetsRequest", + "properties": { + "jobReference": { + "description": "Optional. Reference to the query job, which is from the `QueryAssetsResponse` of previous `QueryAssets` call.", + "type": "string" + }, + "outputConfig": { + "$ref": "QueryAssetsOutputConfig", + "description": "Optional. Destination where the query results will be saved. When this field is specified, the query results won't be saved in the [QueryAssetsResponse.query_result]. Instead [QueryAssetsResponse.output_config] will be set. Meanwhile, [QueryAssetsResponse.job_reference] will be set and can be used to check the status of the query job when passed to a following [QueryAssets] API call." + }, + "pageSize": { + "description": "Optional. The maximum number of rows to return in the results. Responses are limited to 10 MB and 1000 rows. By default, the maximum row count is 1000. When the byte or row count limit is reached, the rest of the query results will be paginated. The field will be ignored when [output_config] is specified.", + "format": "int32", + "type": "integer" + }, + "pageToken": { + "description": "Optional. A page token received from previous `QueryAssets`. The field will be ignored when [output_config] is specified.", + "type": "string" + }, + "readTime": { + "description": "Optional. Queries cloud assets as they appeared at the specified point in time.", + "format": "google-datetime", + "type": "string" + }, + "readTimeWindow": { + "$ref": "TimeWindow", + "description": "Optional. [start_time] is required. [start_time] must be less than [end_time] Defaults [end_time] to now if [start_time] is set and [end_time] isn't. Maximum permitted time range is 7 days." + }, + "statement": { + "description": "Optional. A SQL statement that's compatible with [BigQuery Standard SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql).", + "type": "string" + }, + "timeout": { + "description": "Optional. Specifies the maximum amount of time that the client is willing to wait for the query to complete. By default, this limit is 5 min for the first query, and 1 minute for the following queries. If the query is complete, the `done` field in the `QueryAssetsResponse` is true, otherwise false. Like BigQuery [jobs.query API](https://cloud.google.com/bigquery/docs/reference/rest/v2/jobs/query#queryrequest) The call is not guaranteed to wait for the specified timeout; it typically returns after around 200 seconds (200,000 milliseconds), even if the query is not complete. The field will be ignored when [output_config] is specified.", + "format": "google-duration", + "type": "string" + } + }, + "type": "object" + }, + "QueryAssetsResponse": { + "description": "QueryAssets response.", + "id": "QueryAssetsResponse", + "properties": { + "done": { + "description": "The query response, which can be either an `error` or a valid `response`. If `done` == `false` and the query result is being saved in a output, the output_config field will be set. If `done` == `true`, exactly one of `error`, `query_result` or `output_config` will be set.", + "type": "boolean" + }, + "error": { + "$ref": "Status", + "description": "Error status." + }, + "jobReference": { + "description": "Reference to a query job.", + "type": "string" + }, + "outputConfig": { + "$ref": "QueryAssetsOutputConfig", + "description": "Output configuration which indicates instead of being returned in API response on the fly, the query result will be saved in a specific output." + }, + "queryResult": { + "$ref": "QueryResult", + "description": "Result of the query." + } + }, + "type": "object" + }, "QueryContent": { "description": "The query content.", "id": "QueryContent", @@ -3084,6 +3763,37 @@ }, "type": "object" }, + "QueryResult": { + "description": "Execution results of the query. The result is formatted as rows represented by BigQuery compatible [schema]. When pagination is necessary, it will contains the page token to retrieve the results of following pages.", + "id": "QueryResult", + "properties": { + "nextPageToken": { + "description": "Token to retrieve the next page of the results.", + "type": "string" + }, + "rows": { + "description": "Each row hold a query result in the format of `Struct`.", + "items": { + "additionalProperties": { + "description": "Properties of the object.", + "type": "any" + }, + "type": "object" + }, + "type": "array" + }, + "schema": { + "$ref": "TableSchema", + "description": "Describes the format of the [rows]." + }, + "totalRows": { + "description": "Total rows of the whole query results.", + "format": "int64", + "type": "string" + } + }, + "type": "object" + }, "RelatedAsset": { "description": "An asset identifier in Google Cloud which contains its name, type and ancestors. An asset can be any resource in the Google Cloud [resource hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), a resource outside the Google Cloud resource hierarchy (such as Google Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy). See [Supported asset types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) for more information.", "id": "RelatedAsset", @@ -3523,6 +4233,46 @@ }, "type": "object" }, + "TableFieldSchema": { + "description": "A field in TableSchema.", + "id": "TableFieldSchema", + "properties": { + "field": { + "description": "The field name. The name must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_), and must start with a letter or underscore. The maximum length is 128 characters.", + "type": "string" + }, + "fields": { + "description": "Describes the nested schema fields if the type property is set to RECORD.", + "items": { + "$ref": "TableFieldSchema" + }, + "type": "array" + }, + "mode": { + "description": "The field mode. Possible values include NULLABLE, REQUIRED and REPEATED. The default value is NULLABLE.", + "type": "string" + }, + "type": { + "description": "The field data type. Possible values include * STRING * BYTES * INTEGER * FLOAT * BOOLEAN * TIMESTAMP * DATE * TIME * DATETIME * GEOGRAPHY, * NUMERIC, * BIGNUMERIC, * RECORD (where RECORD indicates that the field contains a nested schema).", + "type": "string" + } + }, + "type": "object" + }, + "TableSchema": { + "description": "BigQuery Compatible table schema.", + "id": "TableSchema", + "properties": { + "fields": { + "description": "Describes the fields in a table.", + "items": { + "$ref": "TableFieldSchema" + }, + "type": "array" + } + }, + "type": "object" + }, "TemporalAsset": { "description": "An asset in Google Cloud and its temporal metadata, including the time window when it was observed and its status during that window.", "id": "TemporalAsset", diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json index aed8925dab7..d48faf270d5 100644 --- a/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json +++ b/googleapiclient/discovery_cache/documents/cloudasset.v1beta1.json @@ -411,7 +411,7 @@ } } }, - "revision": "20221028", + "revision": "20221117", "rootUrl": "https://cloudasset.googleapis.com/", "schemas": { "AnalyzeIamPolicyLongrunningMetadata": { @@ -909,7 +909,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.", + "description": "Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.", "type": "string" }, "title": { @@ -1333,7 +1333,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`", + "description": "Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`.", "type": "string" }, "perimeterType": { @@ -1343,7 +1343,7 @@ "PERIMETER_TYPE_BRIDGE" ], "enumDescriptions": [ - "Regular Perimeter.", + "Regular Perimeter. When no value is specified, the perimeter uses this type.", "Perimeter Bridge." ], "type": "string" diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json index 914c294fb6f..026c1c9747c 100644 --- a/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json +++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p1beta1.json @@ -207,7 +207,7 @@ } } }, - "revision": "20221028", + "revision": "20221117", "rootUrl": "https://cloudasset.googleapis.com/", "schemas": { "AnalyzeIamPolicyLongrunningMetadata": { @@ -611,7 +611,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.", + "description": "Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.", "type": "string" }, "title": { @@ -1035,7 +1035,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`", + "description": "Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`.", "type": "string" }, "perimeterType": { @@ -1045,7 +1045,7 @@ "PERIMETER_TYPE_BRIDGE" ], "enumDescriptions": [ - "Regular Perimeter.", + "Regular Perimeter. When no value is specified, the perimeter uses this type.", "Perimeter Bridge." ], "type": "string" diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json index 9e223853e80..efb56ed0bee 100644 --- a/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json +++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p5beta1.json @@ -177,7 +177,7 @@ } } }, - "revision": "20221028", + "revision": "20221117", "rootUrl": "https://cloudasset.googleapis.com/", "schemas": { "AnalyzeIamPolicyLongrunningMetadata": { @@ -616,7 +616,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.", + "description": "Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.", "type": "string" }, "title": { @@ -1040,7 +1040,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`", + "description": "Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`.", "type": "string" }, "perimeterType": { @@ -1050,7 +1050,7 @@ "PERIMETER_TYPE_BRIDGE" ], "enumDescriptions": [ - "Regular Perimeter.", + "Regular Perimeter. When no value is specified, the perimeter uses this type.", "Perimeter Bridge." ], "type": "string" diff --git a/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json b/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json index 22d84bd0844..556a513bd86 100644 --- a/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json +++ b/googleapiclient/discovery_cache/documents/cloudasset.v1p7beta1.json @@ -167,7 +167,7 @@ } } }, - "revision": "20221028", + "revision": "20221117", "rootUrl": "https://cloudasset.googleapis.com/", "schemas": { "AnalyzeIamPolicyLongrunningMetadata": { @@ -685,7 +685,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the Access Level. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum length of the `access_level` component is 50 characters.", + "description": "Resource name for the `AccessLevel`. Format: `accessPolicies/{access_policy}/accessLevels/{access_level}`. The `access_level` component must begin with a letter, followed by alphanumeric characters or `_`. Its maximum length is 50 characters. After you create an `AccessLevel`, you cannot change its `name`.", "type": "string" }, "title": { @@ -1109,7 +1109,7 @@ "type": "string" }, "name": { - "description": "Required. Resource name for the ServicePerimeter. The `short_name` component must begin with a letter and only include alphanumeric and '_'. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`", + "description": "Resource name for the `ServicePerimeter`. Format: `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`. The `service_perimeter` component must begin with a letter, followed by alphanumeric characters or `_`. After you create a `ServicePerimeter`, you cannot change its `name`.", "type": "string" }, "perimeterType": { @@ -1119,7 +1119,7 @@ "PERIMETER_TYPE_BRIDGE" ], "enumDescriptions": [ - "Regular Perimeter.", + "Regular Perimeter. When no value is specified, the perimeter uses this type.", "Perimeter Bridge." ], "type": "string"