# Copyright 2015 Google Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. require 'date' require 'google/apis/core/base_service' require 'google/apis/core/json_representation' require 'google/apis/core/hashable' require 'google/apis/errors' module Google module Apis module AccesscontextmanagerV1beta # An `AccessLevel` is a label that can be applied to requests to GCP services, # along with a list of requirements necessary for the label to be applied. class AccessLevel include Google::Apis::Core::Hashable # `BasicLevel` is an `AccessLevel` using a set of recommended features. # Corresponds to the JSON property `basic` # @return [Google::Apis::AccesscontextmanagerV1beta::BasicLevel] attr_accessor :basic # Output only. Time the `AccessLevel` was created in UTC. # Corresponds to the JSON property `createTime` # @return [String] attr_accessor :create_time # Description of the `AccessLevel` and its use. Does not affect behavior. # Corresponds to the JSON property `description` # @return [String] attr_accessor :description # Required. Resource name for the Access Level. The `short_name` component # must begin with a letter and only include alphanumeric and '_'. Format: # `accessPolicies/`policy_id`/accessLevels/`short_name`` # Corresponds to the JSON property `name` # @return [String] attr_accessor :name # Human readable title. Must be unique within the Policy. # Corresponds to the JSON property `title` # @return [String] attr_accessor :title # Output only. Time the `AccessLevel` was updated in UTC. # Corresponds to the JSON property `updateTime` # @return [String] attr_accessor :update_time def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @basic = args[:basic] if args.key?(:basic) @create_time = args[:create_time] if args.key?(:create_time) @description = args[:description] if args.key?(:description) @name = args[:name] if args.key?(:name) @title = args[:title] if args.key?(:title) @update_time = args[:update_time] if args.key?(:update_time) end end # `AccessPolicy` is a container for `AccessLevels` (which define the necessary # attributes to use GCP services) and `ServicePerimeters` (which define regions # of services able to freely pass data within a perimeter). An access policy is # globally visible within an organization, and the restrictions it specifies # apply to all projects within an organization. class AccessPolicy include Google::Apis::Core::Hashable # Output only. Time the `AccessPolicy` was created in UTC. # Corresponds to the JSON property `createTime` # @return [String] attr_accessor :create_time # Output only. Resource name of the `AccessPolicy`. Format: # `accessPolicies/`policy_id`` # Corresponds to the JSON property `name` # @return [String] attr_accessor :name # Required. The parent of this `AccessPolicy` in the Cloud Resource # Hierarchy. Currently immutable once created. Format: # `organizations/`organization_id`` # Corresponds to the JSON property `parent` # @return [String] attr_accessor :parent # Required. Human readable title. Does not affect behavior. # Corresponds to the JSON property `title` # @return [String] attr_accessor :title # Output only. Time the `AccessPolicy` was updated in UTC. # Corresponds to the JSON property `updateTime` # @return [String] attr_accessor :update_time def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @create_time = args[:create_time] if args.key?(:create_time) @name = args[:name] if args.key?(:name) @parent = args[:parent] if args.key?(:parent) @title = args[:title] if args.key?(:title) @update_time = args[:update_time] if args.key?(:update_time) end end # `BasicLevel` is an `AccessLevel` using a set of recommended features. class BasicLevel include Google::Apis::Core::Hashable # How the `conditions` list should be combined to determine if a request is # granted this `AccessLevel`. If AND is used, each `Condition` in # `conditions` must be satisfied for the `AccessLevel` to be applied. If OR # is used, at least one `Condition` in `conditions` must be satisfied for the # `AccessLevel` to be applied. Default behavior is AND. # Corresponds to the JSON property `combiningFunction` # @return [String] attr_accessor :combining_function # Required. A list of requirements for the `AccessLevel` to be granted. # Corresponds to the JSON property `conditions` # @return [Array] attr_accessor :conditions def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @combining_function = args[:combining_function] if args.key?(:combining_function) @conditions = args[:conditions] if args.key?(:conditions) end end # A condition necessary for an `AccessLevel` to be granted. The Condition is an # AND over its fields. So a Condition is true if: 1) the request IP is from one # of the listed subnetworks AND 2) the originating device complies with the # listed device policy AND 3) all listed access levels are granted AND 4) the # request was sent at a time allowed by the DateTimeRestriction. class Condition include Google::Apis::Core::Hashable # `DevicePolicy` specifies device specific restrictions necessary to acquire a # given access level. A `DevicePolicy` specifies requirements for requests from # devices to be granted access levels, it does not do any enforcement on the # device. `DevicePolicy` acts as an AND over all specified fields, and each # repeated field is an OR over its elements. Any unset fields are ignored. For # example, if the proto is ` os_type : DESKTOP_WINDOWS, os_type : # DESKTOP_LINUX, encryption_status: ENCRYPTED`, then the DevicePolicy will be # true for requests originating from encrypted Linux desktops and encrypted # Windows desktops. # Corresponds to the JSON property `devicePolicy` # @return [Google::Apis::AccesscontextmanagerV1beta::DevicePolicy] attr_accessor :device_policy # CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for # a CIDR IP address block, the specified IP address portion must be properly # truncated (i.e. all the host bits must be zero) or the input is considered # malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is # not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas # "2001:db8::1/32" is not. The originating IP of a request must be in one of # the listed subnets in order for this Condition to be true. If empty, all IP # addresses are allowed. # Corresponds to the JSON property `ipSubnetworks` # @return [Array] attr_accessor :ip_subnetworks # The signed-in user originating the request must be a part of one of the # provided members. # Syntax: # `user:`emailid`` # `group:`emailid`` # `serviceAccount:`emailid`` # If not specified, a request may come from any user (logged in/not logged # in, not present in any groups, etc.). # Corresponds to the JSON property `members` # @return [Array] attr_accessor :members # Whether to negate the Condition. If true, the Condition becomes a NAND over # its non-empty fields, each field must be false for the Condition overall to # be satisfied. Defaults to false. # Corresponds to the JSON property `negate` # @return [Boolean] attr_accessor :negate alias_method :negate?, :negate # A list of other access levels defined in the same `Policy`, referenced by # resource name. Referencing an `AccessLevel` which does not exist is an # error. All access levels listed must be granted for the Condition # to be true. Example: # "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"` # Corresponds to the JSON property `requiredAccessLevels` # @return [Array] attr_accessor :required_access_levels def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @device_policy = args[:device_policy] if args.key?(:device_policy) @ip_subnetworks = args[:ip_subnetworks] if args.key?(:ip_subnetworks) @members = args[:members] if args.key?(:members) @negate = args[:negate] if args.key?(:negate) @required_access_levels = args[:required_access_levels] if args.key?(:required_access_levels) end end # `DevicePolicy` specifies device specific restrictions necessary to acquire a # given access level. A `DevicePolicy` specifies requirements for requests from # devices to be granted access levels, it does not do any enforcement on the # device. `DevicePolicy` acts as an AND over all specified fields, and each # repeated field is an OR over its elements. Any unset fields are ignored. For # example, if the proto is ` os_type : DESKTOP_WINDOWS, os_type : # DESKTOP_LINUX, encryption_status: ENCRYPTED`, then the DevicePolicy will be # true for requests originating from encrypted Linux desktops and encrypted # Windows desktops. class DevicePolicy include Google::Apis::Core::Hashable # Allowed device management levels, an empty list allows all management # levels. # Corresponds to the JSON property `allowedDeviceManagementLevels` # @return [Array] attr_accessor :allowed_device_management_levels # Allowed encryptions statuses, an empty list allows all statuses. # Corresponds to the JSON property `allowedEncryptionStatuses` # @return [Array] attr_accessor :allowed_encryption_statuses # Allowed OS versions, an empty list allows all types and all versions. # Corresponds to the JSON property `osConstraints` # @return [Array] attr_accessor :os_constraints # Whether or not screenlock is required for the DevicePolicy to be true. # Defaults to `false`. # Corresponds to the JSON property `requireScreenlock` # @return [Boolean] attr_accessor :require_screenlock alias_method :require_screenlock?, :require_screenlock def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @allowed_device_management_levels = args[:allowed_device_management_levels] if args.key?(:allowed_device_management_levels) @allowed_encryption_statuses = args[:allowed_encryption_statuses] if args.key?(:allowed_encryption_statuses) @os_constraints = args[:os_constraints] if args.key?(:os_constraints) @require_screenlock = args[:require_screenlock] if args.key?(:require_screenlock) end end # A response to `ListAccessLevelsRequest`. class ListAccessLevelsResponse include Google::Apis::Core::Hashable # List of the Access Level instances. # Corresponds to the JSON property `accessLevels` # @return [Array] attr_accessor :access_levels # The pagination token to retrieve the next page of results. If the value is # empty, no further results remain. # Corresponds to the JSON property `nextPageToken` # @return [String] attr_accessor :next_page_token def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @access_levels = args[:access_levels] if args.key?(:access_levels) @next_page_token = args[:next_page_token] if args.key?(:next_page_token) end end # A response to `ListAccessPoliciesRequest`. class ListAccessPoliciesResponse include Google::Apis::Core::Hashable # List of the AccessPolicy instances. # Corresponds to the JSON property `accessPolicies` # @return [Array] attr_accessor :access_policies # The pagination token to retrieve the next page of results. If the value is # empty, no further results remain. # Corresponds to the JSON property `nextPageToken` # @return [String] attr_accessor :next_page_token def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @access_policies = args[:access_policies] if args.key?(:access_policies) @next_page_token = args[:next_page_token] if args.key?(:next_page_token) end end # A response to `ListServicePerimetersRequest`. class ListServicePerimetersResponse include Google::Apis::Core::Hashable # The pagination token to retrieve the next page of results. If the value is # empty, no further results remain. # Corresponds to the JSON property `nextPageToken` # @return [String] attr_accessor :next_page_token # List of the Service Perimeter instances. # Corresponds to the JSON property `servicePerimeters` # @return [Array] attr_accessor :service_perimeters def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @next_page_token = args[:next_page_token] if args.key?(:next_page_token) @service_perimeters = args[:service_perimeters] if args.key?(:service_perimeters) end end # This resource represents a long-running operation that is the result of a # network API call. class Operation include Google::Apis::Core::Hashable # If the value is `false`, it means the operation is still in progress. # If `true`, the operation is completed, and either `error` or `response` is # available. # Corresponds to the JSON property `done` # @return [Boolean] attr_accessor :done alias_method :done?, :done # The `Status` type defines a logical error model that is suitable for different # programming environments, including REST APIs and RPC APIs. It is used by # [gRPC](https://github.com/grpc). The error model is designed to be: # - Simple to use and understand for most users # - Flexible enough to meet unexpected needs # # Overview # The `Status` message contains three pieces of data: error code, error message, # and error details. The error code should be an enum value of # google.rpc.Code, but it may accept additional error codes if needed. The # error message should be a developer-facing English message that helps # developers *understand* and *resolve* the error. If a localized user-facing # error message is needed, put the localized message in the error details or # localize it in the client. The optional error details may contain arbitrary # information about the error. There is a predefined set of error detail types # in the package `google.rpc` that can be used for common error conditions. # # Language mapping # The `Status` message is the logical representation of the error model, but it # is not necessarily the actual wire format. When the `Status` message is # exposed in different client libraries and different wire protocols, it can be # mapped differently. For example, it will likely be mapped to some exceptions # in Java, but more likely mapped to some error codes in C. # # Other uses # The error model and the `Status` message can be used in a variety of # environments, either with or without APIs, to provide a # consistent developer experience across different environments. # Example uses of this error model include: # - Partial errors. If a service needs to return partial errors to the client, # it may embed the `Status` in the normal response to indicate the partial # errors. # - Workflow errors. A typical workflow has multiple steps. Each step may # have a `Status` message for error reporting. # - Batch operations. If a client uses batch request and batch response, the # `Status` message should be used directly inside batch response, one for # each error sub-response. # - Asynchronous operations. If an API call embeds asynchronous operation # results in its response, the status of those operations should be # represented directly using the `Status` message. # - Logging. If some API errors are stored in logs, the message `Status` could # be used directly after any stripping needed for security/privacy reasons. # Corresponds to the JSON property `error` # @return [Google::Apis::AccesscontextmanagerV1beta::Status] attr_accessor :error # Service-specific metadata associated with the operation. It typically # contains progress information and common metadata such as create time. # Some services might not provide such metadata. Any method that returns a # long-running operation should document the metadata type, if any. # Corresponds to the JSON property `metadata` # @return [Hash] attr_accessor :metadata # The server-assigned name, which is only unique within the same service that # originally returns it. If you use the default HTTP mapping, the # `name` should have the format of `operations/some/unique/name`. # Corresponds to the JSON property `name` # @return [String] attr_accessor :name # The normal response of the operation in case of success. If the original # method returns no data on success, such as `Delete`, the response is # `google.protobuf.Empty`. If the original method is standard # `Get`/`Create`/`Update`, the response should be the resource. For other # methods, the response should have the type `XxxResponse`, where `Xxx` # is the original method name. For example, if the original method name # is `TakeSnapshot()`, the inferred response type is # `TakeSnapshotResponse`. # Corresponds to the JSON property `response` # @return [Hash] attr_accessor :response def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @done = args[:done] if args.key?(:done) @error = args[:error] if args.key?(:error) @metadata = args[:metadata] if args.key?(:metadata) @name = args[:name] if args.key?(:name) @response = args[:response] if args.key?(:response) end end # A restriction on the OS type and version of devices making requests. class OsConstraint include Google::Apis::Core::Hashable # The minimum allowed OS version. If not set, any version of this OS # satisfies the constraint. Format: `"major.minor.patch"`. # Examples: `"10.5.301"`, `"9.2.1"`. # Corresponds to the JSON property `minimumVersion` # @return [String] attr_accessor :minimum_version # Required. The allowed OS type. # Corresponds to the JSON property `osType` # @return [String] attr_accessor :os_type def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @minimum_version = args[:minimum_version] if args.key?(:minimum_version) @os_type = args[:os_type] if args.key?(:os_type) end end # `ServicePerimeter` describes a set of GCP resources which can freely import # and export data amongst themselves, but not export outside of the # `ServicePerimeter`. If a request with a source within this `ServicePerimeter` # has a target outside of the `ServicePerimeter`, the request will be blocked. # Otherwise the request is allowed. There are two types of Service Perimeter - # Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP # project can only belong to a single regular Service Perimeter. Service # Perimeter Bridges can contain only GCP projects as members, a single GCP # project may belong to multiple Service Perimeter Bridges. class ServicePerimeter include Google::Apis::Core::Hashable # Output only. Time the `ServicePerimeter` was created in UTC. # Corresponds to the JSON property `createTime` # @return [String] attr_accessor :create_time # Description of the `ServicePerimeter` and its use. Does not affect # behavior. # Corresponds to the JSON property `description` # @return [String] attr_accessor :description # Required. Resource name for the ServicePerimeter. The `short_name` # component must begin with a letter and only include alphanumeric and '_'. # Format: `accessPolicies/`policy_id`/servicePerimeters/`short_name`` # Corresponds to the JSON property `name` # @return [String] attr_accessor :name # Perimeter type indicator. A single project is # allowed to be a member of single regular perimeter, but multiple service # perimeter bridges. A project cannot be a included in a perimeter bridge # without being included in regular perimeter. For perimeter bridges, # restricted/unrestricted service lists as well as access lists must be # empty. # Corresponds to the JSON property `perimeterType` # @return [String] attr_accessor :perimeter_type # `ServicePerimeterConfig` specifies a set of GCP resources that describe # specific Service Perimeter configuration. # Corresponds to the JSON property `status` # @return [Google::Apis::AccesscontextmanagerV1beta::ServicePerimeterConfig] attr_accessor :status # Human readable title. Must be unique within the Policy. # Corresponds to the JSON property `title` # @return [String] attr_accessor :title # Output only. Time the `ServicePerimeter` was updated in UTC. # Corresponds to the JSON property `updateTime` # @return [String] attr_accessor :update_time def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @create_time = args[:create_time] if args.key?(:create_time) @description = args[:description] if args.key?(:description) @name = args[:name] if args.key?(:name) @perimeter_type = args[:perimeter_type] if args.key?(:perimeter_type) @status = args[:status] if args.key?(:status) @title = args[:title] if args.key?(:title) @update_time = args[:update_time] if args.key?(:update_time) end end # `ServicePerimeterConfig` specifies a set of GCP resources that describe # specific Service Perimeter configuration. class ServicePerimeterConfig include Google::Apis::Core::Hashable # A list of `AccessLevel` resource names that allow resources within the # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed # must be in the same policy as this `ServicePerimeter`. Referencing a # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are # listed, resources within the perimeter can only be accessed via GCP calls # with request origins within the perimeter. Example: # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`. # For Service Perimeter Bridge, must be empty. # Corresponds to the JSON property `accessLevels` # @return [Array] attr_accessor :access_levels # A list of GCP resources that are inside of the service perimeter. # Currently only projects are allowed. Format: `projects/`project_number`` # Corresponds to the JSON property `resources` # @return [Array] attr_accessor :resources # GCP services that are subject to the Service Perimeter restrictions. May # contain a list of services or a single wildcard "*". For example, if # `storage.googleapis.com` is specified, access to the storage buckets # inside the perimeter must meet the perimeter's access restrictions. # Wildcard means that unless explicitly specified by "unrestricted_services" # list, any service is treated as restricted. One of the fields # "restricted_services", "unrestricted_services" must contain a wildcard "*", # otherwise the Service Perimeter specification is invalid. It also means # that both field being empty is invalid as well. "restricted_services" can # be empty if and only if "unrestricted_services" list contains a "*" # wildcard. # Corresponds to the JSON property `restrictedServices` # @return [Array] attr_accessor :restricted_services # GCP services that are not subject to the Service Perimeter restrictions. # May contain a list of services or a single wildcard "*". For example, if # `logging.googleapis.com` is unrestricted, users can access logs inside the # perimeter as if the perimeter doesn't exist, and it also means VMs inside # the perimeter can access logs outside the perimeter. # The wildcard means that unless explicitly specified by # "restricted_services" list, any service is treated as unrestricted. One of # the fields "restricted_services", "unrestricted_services" must contain a # wildcard "*", otherwise the Service Perimeter specification is invalid. It # also means that both field being empty is invalid as well. # "unrestricted_services" can be empty if and only if "restricted_services" # list contains a "*" wildcard. # Corresponds to the JSON property `unrestrictedServices` # @return [Array] attr_accessor :unrestricted_services def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @access_levels = args[:access_levels] if args.key?(:access_levels) @resources = args[:resources] if args.key?(:resources) @restricted_services = args[:restricted_services] if args.key?(:restricted_services) @unrestricted_services = args[:unrestricted_services] if args.key?(:unrestricted_services) end end # The `Status` type defines a logical error model that is suitable for different # programming environments, including REST APIs and RPC APIs. It is used by # [gRPC](https://github.com/grpc). The error model is designed to be: # - Simple to use and understand for most users # - Flexible enough to meet unexpected needs # # Overview # The `Status` message contains three pieces of data: error code, error message, # and error details. The error code should be an enum value of # google.rpc.Code, but it may accept additional error codes if needed. The # error message should be a developer-facing English message that helps # developers *understand* and *resolve* the error. If a localized user-facing # error message is needed, put the localized message in the error details or # localize it in the client. The optional error details may contain arbitrary # information about the error. There is a predefined set of error detail types # in the package `google.rpc` that can be used for common error conditions. # # Language mapping # The `Status` message is the logical representation of the error model, but it # is not necessarily the actual wire format. When the `Status` message is # exposed in different client libraries and different wire protocols, it can be # mapped differently. For example, it will likely be mapped to some exceptions # in Java, but more likely mapped to some error codes in C. # # Other uses # The error model and the `Status` message can be used in a variety of # environments, either with or without APIs, to provide a # consistent developer experience across different environments. # Example uses of this error model include: # - Partial errors. If a service needs to return partial errors to the client, # it may embed the `Status` in the normal response to indicate the partial # errors. # - Workflow errors. A typical workflow has multiple steps. Each step may # have a `Status` message for error reporting. # - Batch operations. If a client uses batch request and batch response, the # `Status` message should be used directly inside batch response, one for # each error sub-response. # - Asynchronous operations. If an API call embeds asynchronous operation # results in its response, the status of those operations should be # represented directly using the `Status` message. # - Logging. If some API errors are stored in logs, the message `Status` could # be used directly after any stripping needed for security/privacy reasons. class Status include Google::Apis::Core::Hashable # The status code, which should be an enum value of google.rpc.Code. # Corresponds to the JSON property `code` # @return [Fixnum] attr_accessor :code # A list of messages that carry the error details. There is a common set of # message types for APIs to use. # Corresponds to the JSON property `details` # @return [Array>] attr_accessor :details # A developer-facing error message, which should be in English. Any # user-facing error message should be localized and sent in the # google.rpc.Status.details field, or localized by the client. # Corresponds to the JSON property `message` # @return [String] attr_accessor :message def initialize(**args) update!(**args) end # Update properties of this object def update!(**args) @code = args[:code] if args.key?(:code) @details = args[:details] if args.key?(:details) @message = args[:message] if args.key?(:message) end end end end end