# frozen_string_literal: true # Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # Auto-generated by gapic-generator-ruby. DO NOT EDIT! module Google module Cloud module Asset module V1 # Represents the metadata of the longrunning operation for the # AnalyzeIamPolicyLongrunning rpc. # @!attribute [r] create_time # @return [::Google::Protobuf::Timestamp] # Output only. The time the operation was created. class AnalyzeIamPolicyLongrunningMetadata include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Export asset request. # @!attribute [rw] parent # @return [::String] # Required. The relative name of the root asset. This can only be an # organization number (such as "organizations/123"), a project ID (such as # "projects/my-project-id"), or a project number (such as "projects/12345"), # or a folder number (such as "folders/123"). # @!attribute [rw] read_time # @return [::Google::Protobuf::Timestamp] # Timestamp to take an asset snapshot. This can only be set to a timestamp # between the current time and the current time minus 35 days (inclusive). # If not specified, the current time will be used. Due to delays in resource # data collection and indexing, there is a volatile window during which # running the same query may get different results. # @!attribute [rw] asset_types # @return [::Array<::String>] # A list of asset types to take a snapshot for. For example: # "compute.googleapis.com/Disk". # # Regular expressions are also supported. For example: # # * "compute.googleapis.com.*" snapshots resources whose asset type starts # with "compute.googleapis.com". # * ".*Instance" snapshots resources whose asset type ends with "Instance". # * ".*Instance.*" snapshots resources whose asset type contains "Instance". # # See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported # regular expression syntax. If the regular expression does not match any # supported asset type, an INVALID_ARGUMENT error will be returned. # # If specified, only matching assets will be returned, otherwise, it will # snapshot all asset types. See [Introduction to Cloud Asset # Inventory](https://cloud.google.com/asset-inventory/docs/overview) # for all supported asset types. # @!attribute [rw] content_type # @return [::Google::Cloud::Asset::V1::ContentType] # Asset content type. If not specified, no content but the asset name will be # returned. # @!attribute [rw] output_config # @return [::Google::Cloud::Asset::V1::OutputConfig] # Required. Output configuration indicating where the results will be output # to. # @!attribute [rw] relationship_types # @return [::Array<::String>] # A list of relationship types to export, for example: # `INSTANCE_TO_INSTANCEGROUP`. This field should only be specified if # content_type=RELATIONSHIP. # * If specified: # it snapshots specified relationships. It returns an error if # any of the [relationship_types] doesn't belong to the supported # relationship types of the [asset_types] or if any of the [asset_types] # doesn't belong to the source types of the [relationship_types]. # * Otherwise: # it snapshots the supported relationships for all [asset_types] or returns # an error if any of the [asset_types] has no relationship support. # An unspecified asset types field means all supported asset_types. # See [Introduction to Cloud Asset # Inventory](https://cloud.google.com/asset-inventory/docs/overview) for all # supported asset types and relationship types. class ExportAssetsRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # The export asset response. This message is returned by the # google.longrunning.Operations.GetOperation # method in the returned # {::Google::Longrunning::Operation#response google.longrunning.Operation.response} # field. # @!attribute [rw] read_time # @return [::Google::Protobuf::Timestamp] # Time the snapshot was taken. # @!attribute [rw] output_config # @return [::Google::Cloud::Asset::V1::OutputConfig] # Output configuration indicating where the results were output to. # @!attribute [rw] output_result # @return [::Google::Cloud::Asset::V1::OutputResult] # Output result indicating where the assets were exported to. For example, a # set of actual Google Cloud Storage object uris where the assets are # exported to. The uris can be different from what [output_config] has # specified, as the service will split the output object into multiple ones # once it exceeds a single Google Cloud Storage object limit. class ExportAssetsResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # ListAssets request. # @!attribute [rw] parent # @return [::String] # Required. Name of the organization, folder, or project the assets belong # to. Format: "organizations/[organization-number]" (such as # "organizations/123"), "projects/[project-id]" (such as # "projects/my-project-id"), "projects/[project-number]" (such as # "projects/12345"), or "folders/[folder-number]" (such as "folders/12345"). # @!attribute [rw] read_time # @return [::Google::Protobuf::Timestamp] # Timestamp to take an asset snapshot. This can only be set to a timestamp # between the current time and the current time minus 35 days (inclusive). # If not specified, the current time will be used. Due to delays in resource # data collection and indexing, there is a volatile window during which # running the same query may get different results. # @!attribute [rw] asset_types # @return [::Array<::String>] # A list of asset types to take a snapshot for. For example: # "compute.googleapis.com/Disk". # # Regular expression is also supported. For example: # # * "compute.googleapis.com.*" snapshots resources whose asset type starts # with "compute.googleapis.com". # * ".*Instance" snapshots resources whose asset type ends with "Instance". # * ".*Instance.*" snapshots resources whose asset type contains "Instance". # # See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported # regular expression syntax. If the regular expression does not match any # supported asset type, an INVALID_ARGUMENT error will be returned. # # If specified, only matching assets will be returned, otherwise, it will # snapshot all asset types. See [Introduction to Cloud Asset # Inventory](https://cloud.google.com/asset-inventory/docs/overview) # for all supported asset types. # @!attribute [rw] content_type # @return [::Google::Cloud::Asset::V1::ContentType] # Asset content type. If not specified, no content but the asset name will # be returned. # @!attribute [rw] page_size # @return [::Integer] # The maximum number of assets to be returned in a single response. Default # is 100, minimum is 1, and maximum is 1000. # @!attribute [rw] page_token # @return [::String] # The `next_page_token` returned from the previous `ListAssetsResponse`, or # unspecified for the first `ListAssetsRequest`. It is a continuation of a # prior `ListAssets` call, and the API should return the next page of assets. # @!attribute [rw] relationship_types # @return [::Array<::String>] # A list of relationship types to output, for example: # `INSTANCE_TO_INSTANCEGROUP`. This field should only be specified if # content_type=RELATIONSHIP. # * If specified: # it snapshots specified relationships. It returns an error if # any of the [relationship_types] doesn't belong to the supported # relationship types of the [asset_types] or if any of the [asset_types] # doesn't belong to the source types of the [relationship_types]. # * Otherwise: # it snapshots the supported relationships for all [asset_types] or returns # an error if any of the [asset_types] has no relationship support. # An unspecified asset types field means all supported asset_types. # See [Introduction to Cloud Asset # Inventory](https://cloud.google.com/asset-inventory/docs/overview) # for all supported asset types and relationship types. class ListAssetsRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # ListAssets response. # @!attribute [rw] read_time # @return [::Google::Protobuf::Timestamp] # Time the snapshot was taken. # @!attribute [rw] assets # @return [::Array<::Google::Cloud::Asset::V1::Asset>] # Assets. # @!attribute [rw] next_page_token # @return [::String] # Token to retrieve the next page of results. It expires 72 hours after the # page token for the first page is generated. Set to empty if there are no # remaining results. class ListAssetsResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Batch get assets history request. # @!attribute [rw] parent # @return [::String] # Required. The relative name of the root asset. It can only be an # organization number (such as "organizations/123"), a project ID (such as # "projects/my-project-id")", or a project number (such as "projects/12345"). # @!attribute [rw] asset_names # @return [::Array<::String>] # A list of the full names of the assets. # See: https://cloud.google.com/asset-inventory/docs/resource-name-format # Example: # # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. # # The request becomes a no-op if the asset name list is empty, and the max # size of the asset name list is 100 in one request. # @!attribute [rw] content_type # @return [::Google::Cloud::Asset::V1::ContentType] # Optional. The content type. # @!attribute [rw] read_time_window # @return [::Google::Cloud::Asset::V1::TimeWindow] # Optional. The time window for the asset history. Both start_time and # end_time are optional and if set, it must be after the current time minus # 35 days. If end_time is not set, it is default to current timestamp. # If start_time is not set, the snapshot of the assets at end_time will be # returned. The returned results contain all temporal assets whose time # window overlap with read_time_window. # @!attribute [rw] relationship_types # @return [::Array<::String>] # Optional. A list of relationship types to output, for example: # `INSTANCE_TO_INSTANCEGROUP`. This field should only be specified if # content_type=RELATIONSHIP. # * If specified: # it outputs specified relationships' history on the [asset_names]. It # returns an error if any of the [relationship_types] doesn't belong to the # supported relationship types of the [asset_names] or if any of the # [asset_names]'s types doesn't belong to the source types of the # [relationship_types]. # * Otherwise: # it outputs the supported relationships' history on the [asset_names] or # returns an error if any of the [asset_names]'s types has no relationship # support. # See [Introduction to Cloud Asset # Inventory](https://cloud.google.com/asset-inventory/docs/overview) for all # supported asset types and relationship types. class BatchGetAssetsHistoryRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Batch get assets history response. # @!attribute [rw] assets # @return [::Array<::Google::Cloud::Asset::V1::TemporalAsset>] # A list of assets with valid time windows. class BatchGetAssetsHistoryResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Create asset feed request. # @!attribute [rw] parent # @return [::String] # Required. The name of the project/folder/organization where this feed # should be created in. It can only be an organization number (such as # "organizations/123"), a folder number (such as "folders/123"), a project ID # (such as "projects/my-project-id")", or a project number (such as # "projects/12345"). # @!attribute [rw] feed_id # @return [::String] # Required. This is the client-assigned asset feed identifier and it needs to # be unique under a specific parent project/folder/organization. # @!attribute [rw] feed # @return [::Google::Cloud::Asset::V1::Feed] # Required. The feed details. The field `name` must be empty and it will be # generated in the format of: projects/project_number/feeds/feed_id # folders/folder_number/feeds/feed_id # organizations/organization_number/feeds/feed_id class CreateFeedRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Get asset feed request. # @!attribute [rw] name # @return [::String] # Required. The name of the Feed and it must be in the format of: # projects/project_number/feeds/feed_id # folders/folder_number/feeds/feed_id # organizations/organization_number/feeds/feed_id class GetFeedRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # List asset feeds request. # @!attribute [rw] parent # @return [::String] # Required. The parent project/folder/organization whose feeds are to be # listed. It can only be using project/folder/organization number (such as # "folders/12345")", or a project ID (such as "projects/my-project-id"). class ListFeedsRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # @!attribute [rw] feeds # @return [::Array<::Google::Cloud::Asset::V1::Feed>] # A list of feeds. class ListFeedsResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Update asset feed request. # @!attribute [rw] feed # @return [::Google::Cloud::Asset::V1::Feed] # Required. The new values of feed details. It must match an existing feed # and the field `name` must be in the format of: # projects/project_number/feeds/feed_id or # folders/folder_number/feeds/feed_id or # organizations/organization_number/feeds/feed_id. # @!attribute [rw] update_mask # @return [::Google::Protobuf::FieldMask] # Required. Only updates the `feed` fields indicated by this mask. # The field mask must not be empty, and it must not contain fields that # are immutable or only set by the server. class UpdateFeedRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # @!attribute [rw] name # @return [::String] # Required. The name of the feed and it must be in the format of: # projects/project_number/feeds/feed_id # folders/folder_number/feeds/feed_id # organizations/organization_number/feeds/feed_id class DeleteFeedRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Output configuration for export assets destination. # @!attribute [rw] gcs_destination # @return [::Google::Cloud::Asset::V1::GcsDestination] # Destination on Cloud Storage. # @!attribute [rw] bigquery_destination # @return [::Google::Cloud::Asset::V1::BigQueryDestination] # Destination on BigQuery. The output table stores the fields in asset # Protobuf as columns in BigQuery. class OutputConfig include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Output result of export assets. # @!attribute [rw] gcs_result # @return [::Google::Cloud::Asset::V1::GcsOutputResult] # Export result on Cloud Storage. class OutputResult include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A Cloud Storage output result. # @!attribute [rw] uris # @return [::Array<::String>] # List of uris of the Cloud Storage objects. Example: # "gs://bucket_name/object_name". class GcsOutputResult include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A Cloud Storage location. # @!attribute [rw] uri # @return [::String] # The uri of the Cloud Storage object. It's the same uri that is used by # gsutil. Example: "gs://bucket_name/object_name". See [Viewing and # Editing Object # Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata) # for more information. # # If the specified Cloud Storage object already exists and there is no # [hold](https://cloud.google.com/storage/docs/object-holds), it will be # overwritten with the exported result. # @!attribute [rw] uri_prefix # @return [::String] # The uri prefix of all generated Cloud Storage objects. Example: # "gs://bucket_name/object_name_prefix". Each object uri is in format: # "gs://bucket_name/object_name_prefix// and only # contains assets for that type. starts from 0. Example: # "gs://bucket_name/object_name_prefix/compute.googleapis.com/Disk/0" is # the first shard of output objects containing all # compute.googleapis.com/Disk assets. An INVALID_ARGUMENT error will be # returned if file with the same name "gs://bucket_name/object_name_prefix" # already exists. class GcsDestination include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A BigQuery destination for exporting assets to. # @!attribute [rw] dataset # @return [::String] # Required. The BigQuery dataset in format # "projects/projectId/datasets/datasetId", to which the snapshot result # should be exported. If this dataset does not exist, the export call returns # an INVALID_ARGUMENT error. Setting the `contentType` for `exportAssets` # determines the # [schema](/asset-inventory/docs/exporting-to-bigquery#bigquery-schema) # of the BigQuery table. Setting `separateTablesPerAssetType` to `TRUE` also # influences the schema. # @!attribute [rw] table # @return [::String] # Required. The BigQuery table to which the snapshot result should be # written. If this table does not exist, a new table with the given name # will be created. # @!attribute [rw] force # @return [::Boolean] # If the destination table already exists and this flag is `TRUE`, the # table will be overwritten by the contents of assets snapshot. If the flag # is `FALSE` or unset and the destination table already exists, the export # call returns an INVALID_ARGUMEMT error. # @!attribute [rw] partition_spec # @return [::Google::Cloud::Asset::V1::PartitionSpec] # [partition_spec] determines whether to export to partitioned table(s) and # how to partition the data. # # If [partition_spec] is unset or [partition_spec.partition_key] is unset or # `PARTITION_KEY_UNSPECIFIED`, the snapshot results will be exported to # non-partitioned table(s). [force] will decide whether to overwrite existing # table(s). # # If [partition_spec] is specified. First, the snapshot results will be # written to partitioned table(s) with two additional timestamp columns, # readTime and requestTime, one of which will be the partition key. Secondly, # in the case when any destination table already exists, it will first try to # update existing table's schema as necessary by appending additional # columns. Then, if [force] is `TRUE`, the corresponding partition will be # overwritten by the snapshot results (data in different partitions will # remain intact); if [force] is unset or `FALSE`, it will append the data. An # error will be returned if the schema update or data appension fails. # @!attribute [rw] separate_tables_per_asset_type # @return [::Boolean] # If this flag is `TRUE`, the snapshot results will be written to one or # multiple tables, each of which contains results of one asset type. The # [force] and [partition_spec] fields will apply to each of them. # # Field [table] will be concatenated with "_" and the asset type names (see # https://cloud.google.com/asset-inventory/docs/supported-asset-types for # supported asset types) to construct per-asset-type table names, in which # all non-alphanumeric characters like "." and "/" will be substituted by # "_". Example: if field [table] is "mytable" and snapshot results # contain "storage.googleapis.com/Bucket" assets, the corresponding table # name will be "mytable_storage_googleapis_com_Bucket". If any of these # tables does not exist, a new table with the concatenated name will be # created. # # When [content_type] in the ExportAssetsRequest is `RESOURCE`, the schema of # each table will include RECORD-type columns mapped to the nested fields in # the Asset.resource.data field of that asset type (up to the 15 nested level # BigQuery supports # (https://cloud.google.com/bigquery/docs/nested-repeated#limitations)). The # fields in >15 nested levels will be stored in JSON format string as a child # column of its parent RECORD column. # # If error occurs when exporting to any table, the whole export call will # return an error but the export results that already succeed will persist. # Example: if exporting to table_type_A succeeds when exporting to # table_type_B fails during one export call, the results in table_type_A will # persist and there will not be partial results persisting in a table. class BigQueryDestination include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Specifications of BigQuery partitioned table as export destination. # @!attribute [rw] partition_key # @return [::Google::Cloud::Asset::V1::PartitionSpec::PartitionKey] # The partition key for BigQuery partitioned table. class PartitionSpec include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # This enum is used to determine the partition key column when exporting # assets to BigQuery partitioned table(s). Note that, if the partition key is # a timestamp column, the actual partition is based on its date value # (expressed in UTC. see details in # https://cloud.google.com/bigquery/docs/partitioned-tables#date_timestamp_partitioned_tables). module PartitionKey # Unspecified partition key. If used, it means using non-partitioned table. PARTITION_KEY_UNSPECIFIED = 0 # The time when the snapshot is taken. If specified as partition key, the # result table(s) is partitoned by the additional timestamp column, # readTime. If [read_time] in ExportAssetsRequest is specified, the # readTime column's value will be the same as it. Otherwise, its value will # be the current time that is used to take the snapshot. READ_TIME = 1 # The time when the request is received and started to be processed. If # specified as partition key, the result table(s) is partitoned by the # requestTime column, an additional timestamp column representing when the # request was received. REQUEST_TIME = 2 end end # A Pub/Sub destination. # @!attribute [rw] topic # @return [::String] # The name of the Pub/Sub topic to publish to. # Example: `projects/PROJECT_ID/topics/TOPIC_ID`. class PubsubDestination include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Output configuration for asset feed destination. # @!attribute [rw] pubsub_destination # @return [::Google::Cloud::Asset::V1::PubsubDestination] # Destination on Pub/Sub. class FeedOutputConfig include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # An asset feed used to export asset updates to a destinations. # An asset feed filter controls what updates are exported. # The asset feed must be created within a project, organization, or # folder. Supported destinations are: # Pub/Sub topics. # @!attribute [rw] name # @return [::String] # Required. The format will be # projects/\\{project_number}/feeds/\\{client-assigned_feed_identifier} or # folders/\\{folder_number}/feeds/\\{client-assigned_feed_identifier} or # organizations/\\{organization_number}/feeds/\\{client-assigned_feed_identifier} # # The client-assigned feed identifier must be unique within the parent # project/folder/organization. # @!attribute [rw] asset_names # @return [::Array<::String>] # A list of the full names of the assets to receive updates. You must specify # either or both of asset_names and asset_types. Only asset updates matching # specified asset_names or asset_types are exported to the feed. # Example: # `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`. # For a list of the full names for supported asset types, see [Resource # name format](/asset-inventory/docs/resource-name-format). # @!attribute [rw] asset_types # @return [::Array<::String>] # A list of types of the assets to receive updates. You must specify either # or both of asset_names and asset_types. Only asset updates matching # specified asset_names or asset_types are exported to the feed. # Example: `"compute.googleapis.com/Disk"` # # For a list of all supported asset types, see # [Supported asset types](/asset-inventory/docs/supported-asset-types). # @!attribute [rw] content_type # @return [::Google::Cloud::Asset::V1::ContentType] # Asset content type. If not specified, no content but the asset name and # type will be returned. # @!attribute [rw] feed_output_config # @return [::Google::Cloud::Asset::V1::FeedOutputConfig] # Required. Feed output configuration defining where the asset updates are # published to. # @!attribute [rw] condition # @return [::Google::Type::Expr] # A condition which determines whether an asset update should be published. # If specified, an asset will be returned only when the expression evaluates # to true. # When set, `expression` field in the `Expr` must be a valid [CEL expression] # (https://github.com/google/cel-spec) on a TemporalAsset with name # `temporal_asset`. Example: a Feed with expression ("temporal_asset.deleted # == true") will only publish Asset deletions. Other fields of `Expr` are # optional. # # See our [user # guide](https://cloud.google.com/asset-inventory/docs/monitoring-asset-changes-with-condition) # for detailed instructions. # @!attribute [rw] relationship_types # @return [::Array<::String>] # A list of relationship types to output, for example: # `INSTANCE_TO_INSTANCEGROUP`. This field should only be specified if # content_type=RELATIONSHIP. # * If specified: # it outputs specified relationship updates on the [asset_names] or the # [asset_types]. It returns an error if any of the [relationship_types] # doesn't belong to the supported relationship types of the [asset_names] or # [asset_types], or any of the [asset_names] or the [asset_types] doesn't # belong to the source types of the [relationship_types]. # * Otherwise: # it outputs the supported relationships of the types of [asset_names] and # [asset_types] or returns an error if any of the [asset_names] or the # [asset_types] has no replationship support. # See [Introduction to Cloud Asset # Inventory](https://cloud.google.com/asset-inventory/docs/overview) # for all supported asset types and relationship types. class Feed include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Search all resources request. # @!attribute [rw] scope # @return [::String] # Required. A scope can be a project, a folder, or an organization. The # search is limited to the resources within the `scope`. The caller must be # granted the # [`cloudasset.assets.searchAllResources`](https://cloud.google.com/asset-inventory/docs/access-control#required_permissions) # permission on the desired scope. # # The allowed values are: # # * projects/\\{PROJECT_ID} (e.g., "projects/foo-bar") # * projects/\\{PROJECT_NUMBER} (e.g., "projects/12345678") # * folders/\\{FOLDER_NUMBER} (e.g., "folders/1234567") # * organizations/\\{ORGANIZATION_NUMBER} (e.g., "organizations/123456") # @!attribute [rw] query # @return [::String] # Optional. The query statement. See [how to construct a # query](https://cloud.google.com/asset-inventory/docs/searching-resources#how_to_construct_a_query) # for more information. If not specified or empty, it will search all the # resources within the specified `scope`. # # Examples: # # * `name:Important` to find Cloud resources whose name contains # "Important" as a word. # * `name=Important` to find the Cloud resource whose name is exactly # "Important". # * `displayName:Impor*` to find Cloud resources whose display name # contains "Impor" as a prefix of any word in the field. # * `location:us-west*` to find Cloud resources whose location contains both # "us" and "west" as prefixes. # * `labels:prod` to find Cloud resources whose labels contain "prod" as # a key or value. # * `labels.env:prod` to find Cloud resources that have a label "env" # and its value is "prod". # * `labels.env:*` to find Cloud resources that have a label "env". # * `kmsKey:key` to find Cloud resources encrypted with a customer-managed # encryption key whose name contains the word "key". # * `state:ACTIVE` to find Cloud resources whose state contains "ACTIVE" as a # word. # * `NOT state:ACTIVE` to find Cloud resources whose state doesn't contain # "ACTIVE" as a word. # * `createTime<1609459200` to find Cloud resources that were created before # "2021-01-01 00:00:00 UTC". 1609459200 is the epoch timestamp of # "2021-01-01 00:00:00 UTC" in seconds. # * `updateTime>1609459200` to find Cloud resources that were updated after # "2021-01-01 00:00:00 UTC". 1609459200 is the epoch timestamp of # "2021-01-01 00:00:00 UTC" in seconds. # * `Important` to find Cloud resources that contain "Important" as a word # in any of the searchable fields. # * `Impor*` to find Cloud resources that contain "Impor" as a prefix of any # word in any of the searchable fields. # * `Important location:(us-west1 OR global)` to find Cloud # resources that contain "Important" as a word in any of the searchable # fields and are also located in the "us-west1" region or the "global" # location. # @!attribute [rw] asset_types # @return [::Array<::String>] # Optional. A list of asset types that this request searches for. If empty, # it will search all the [searchable asset # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types). # # Regular expressions are also supported. For example: # # * "compute.googleapis.com.*" snapshots resources whose asset type starts # with "compute.googleapis.com". # * ".*Instance" snapshots resources whose asset type ends with "Instance". # * ".*Instance.*" snapshots resources whose asset type contains "Instance". # # See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported # regular expression syntax. If the regular expression does not match any # supported asset type, an INVALID_ARGUMENT error will be returned. # @!attribute [rw] page_size # @return [::Integer] # Optional. The page size for search result pagination. Page size is capped # at 500 even if a larger value is given. If set to zero, server will pick an # appropriate default. Returned results may be fewer than requested. When # this happens, there could be more results as long as `next_page_token` is # returned. # @!attribute [rw] page_token # @return [::String] # Optional. If present, then retrieve the next batch of results from the # preceding call to this method. `page_token` must be the value of # `next_page_token` from the previous response. The values of all other # method parameters, must be identical to those in the previous call. # @!attribute [rw] order_by # @return [::String] # Optional. A comma-separated list of fields specifying the sorting order of # the results. The default order is ascending. Add " DESC" after the field # name to indicate descending order. Redundant space characters are ignored. # Example: "location DESC, name". # Only singular primitive fields in the response are sortable: # # * name # * assetType # * project # * displayName # * description # * location # * kmsKey # * createTime # * updateTime # * state # * parentFullResourceName # * parentAssetType # # All the other fields such as repeated fields (e.g., `networkTags`), map # fields (e.g., `labels`) and struct fields (e.g., `additionalAttributes`) # are not supported. # @!attribute [rw] read_mask # @return [::Google::Protobuf::FieldMask] # Optional. A comma-separated list of fields specifying which fields to be # returned in ResourceSearchResult. Only '*' or combination of top level # fields can be specified. Field names of both snake_case and camelCase are # supported. Examples: `"*"`, `"name,location"`, `"name,versionedResources"`. # # The read_mask paths must be valid field paths listed but not limited to # (both snake_case and camelCase are supported): # # * name # * assetType # * project # * displayName # * description # * location # * tagKeys # * tagValues # * tagValueIds # * labels # * networkTags # * kmsKey # * createTime # * updateTime # * state # * additionalAttributes # * versionedResources # # If read_mask is not specified, all fields except versionedResources will # be returned. # If only '*' is specified, all fields including versionedResources will be # returned. # Any invalid field path will trigger INVALID_ARGUMENT error. class SearchAllResourcesRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Search all resources response. # @!attribute [rw] results # @return [::Array<::Google::Cloud::Asset::V1::ResourceSearchResult>] # A list of Resources that match the search query. It contains the resource # standard metadata information. # @!attribute [rw] next_page_token # @return [::String] # If there are more results than those appearing in this response, then # `next_page_token` is included. To get the next set of results, call this # method again using the value of `next_page_token` as `page_token`. class SearchAllResourcesResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Search all IAM policies request. # @!attribute [rw] scope # @return [::String] # Required. A scope can be a project, a folder, or an organization. The # search is limited to the IAM policies within the `scope`. The caller must # be granted the # [`cloudasset.assets.searchAllIamPolicies`](https://cloud.google.com/asset-inventory/docs/access-control#required_permissions) # permission on the desired scope. # # The allowed values are: # # * projects/\\{PROJECT_ID} (e.g., "projects/foo-bar") # * projects/\\{PROJECT_NUMBER} (e.g., "projects/12345678") # * folders/\\{FOLDER_NUMBER} (e.g., "folders/1234567") # * organizations/\\{ORGANIZATION_NUMBER} (e.g., "organizations/123456") # @!attribute [rw] query # @return [::String] # Optional. The query statement. See [how to construct a # query](https://cloud.google.com/asset-inventory/docs/searching-iam-policies#how_to_construct_a_query) # for more information. If not specified or empty, it will search all the # IAM policies within the specified `scope`. Note that the query string is # compared against each Cloud IAM policy binding, including its principals, # roles, and Cloud IAM conditions. The returned Cloud IAM policies will only # contain the bindings that match your query. To learn more about the IAM # policy structure, see [IAM policy # doc](https://cloud.google.com/iam/docs/policies#structure). # # Examples: # # * `policy:amy@gmail.com` to find IAM policy bindings that specify user # "amy@gmail.com". # * `policy:roles/compute.admin` to find IAM policy bindings that specify # the Compute Admin role. # * `policy:comp*` to find IAM policy bindings that contain "comp" as a # prefix of any word in the binding. # * `policy.role.permissions:storage.buckets.update` to find IAM policy # bindings that specify a role containing "storage.buckets.update" # permission. Note that if callers don't have `iam.roles.get` access to a # role's included permissions, policy bindings that specify this role will # be dropped from the search results. # * `policy.role.permissions:upd*` to find IAM policy bindings that specify a # role containing "upd" as a prefix of any word in the role permission. # Note that if callers don't have `iam.roles.get` access to a role's # included permissions, policy bindings that specify this role will be # dropped from the search results. # * `resource:organizations/123456` to find IAM policy bindings # that are set on "organizations/123456". # * `resource=//cloudresourcemanager.googleapis.com/projects/myproject` to # find IAM policy bindings that are set on the project named "myproject". # * `Important` to find IAM policy bindings that contain "Important" as a # word in any of the searchable fields (except for the included # permissions). # * `resource:(instance1 OR instance2) policy:amy` to find # IAM policy bindings that are set on resources "instance1" or # "instance2" and also specify user "amy". # * `roles:roles/compute.admin` to find IAM policy bindings that specify the # Compute Admin role. # * `memberTypes:user` to find IAM policy bindings that contain the # principal type "user". # @!attribute [rw] page_size # @return [::Integer] # Optional. The page size for search result pagination. Page size is capped # at 500 even if a larger value is given. If set to zero, server will pick an # appropriate default. Returned results may be fewer than requested. When # this happens, there could be more results as long as `next_page_token` is # returned. # @!attribute [rw] page_token # @return [::String] # Optional. If present, retrieve the next batch of results from the preceding # call to this method. `page_token` must be the value of `next_page_token` # from the previous response. The values of all other method parameters must # be identical to those in the previous call. # @!attribute [rw] asset_types # @return [::Array<::String>] # Optional. A list of asset types that the IAM policies are attached to. If # empty, it will search the IAM policies that are attached to all the # [searchable asset # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types). # # Regular expressions are also supported. For example: # # * "compute.googleapis.com.*" snapshots IAM policies attached to asset type # starts with "compute.googleapis.com". # * ".*Instance" snapshots IAM policies attached to asset type ends with # "Instance". # * ".*Instance.*" snapshots IAM policies attached to asset type contains # "Instance". # # See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported # regular expression syntax. If the regular expression does not match any # supported asset type, an INVALID_ARGUMENT error will be returned. # @!attribute [rw] order_by # @return [::String] # Optional. A comma-separated list of fields specifying the sorting order of # the results. The default order is ascending. Add " DESC" after the field # name to indicate descending order. Redundant space characters are ignored. # Example: "assetType DESC, resource". # Only singular primitive fields in the response are sortable: # * resource # * assetType # * project # All the other fields such as repeated fields (e.g., `folders`) and # non-primitive fields (e.g., `policy`) are not supported. class SearchAllIamPoliciesRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Search all IAM policies response. # @!attribute [rw] results # @return [::Array<::Google::Cloud::Asset::V1::IamPolicySearchResult>] # A list of IamPolicy that match the search query. Related information such # as the associated resource is returned along with the policy. # @!attribute [rw] next_page_token # @return [::String] # Set if there are more results than those appearing in this response; to get # the next set of results, call this method again, using this value as the # `page_token`. class SearchAllIamPoliciesResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # IAM policy analysis query message. # @!attribute [rw] scope # @return [::String] # Required. The relative name of the root asset. Only resources and IAM # policies within the scope will be analyzed. # # This can only be an organization number (such as "organizations/123"), a # folder number (such as "folders/123"), a project ID (such as # "projects/my-project-id"), or a project number (such as "projects/12345"). # # To know how to get organization id, visit [here # ](https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id). # # To know how to get folder or project id, visit [here # ](https://cloud.google.com/resource-manager/docs/creating-managing-folders#viewing_or_listing_folders_and_projects). # @!attribute [rw] resource_selector # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::ResourceSelector] # Optional. Specifies a resource for analysis. # @!attribute [rw] identity_selector # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::IdentitySelector] # Optional. Specifies an identity for analysis. # @!attribute [rw] access_selector # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::AccessSelector] # Optional. Specifies roles or permissions for analysis. This is optional. # @!attribute [rw] options # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::Options] # Optional. The query options. # @!attribute [rw] condition_context # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery::ConditionContext] # Optional. The hypothetical context for IAM conditions evaluation. class IamPolicyAnalysisQuery include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # Specifies the resource to analyze for access policies, which may be set # directly on the resource, or on ancestors such as organizations, folders or # projects. # @!attribute [rw] full_resource_name # @return [::String] # Required. The [full resource name] # (https://cloud.google.com/asset-inventory/docs/resource-name-format) # of a resource of [supported resource # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types). class ResourceSelector include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Specifies an identity for which to determine resource access, based on # roles assigned either directly to them or to the groups they belong to, # directly or indirectly. # @!attribute [rw] identity # @return [::String] # Required. The identity appear in the form of principals in # [IAM policy # binding](https://cloud.google.com/iam/reference/rest/v1/Binding). # # The examples of supported forms are: # "user:mike@example.com", # "group:admins@example.com", # "domain:google.com", # "serviceAccount:my-project-id@appspot.gserviceaccount.com". # # Notice that wildcard characters (such as * and ?) are not supported. # You must give a specific identity. class IdentitySelector include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Specifies roles and/or permissions to analyze, to determine both the # identities possessing them and the resources they control. If multiple # values are specified, results will include roles or permissions matching # any of them. The total number of roles and permissions should be equal or # less than 10. # @!attribute [rw] roles # @return [::Array<::String>] # Optional. The roles to appear in result. # @!attribute [rw] permissions # @return [::Array<::String>] # Optional. The permissions to appear in result. class AccessSelector include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Contains query options. # @!attribute [rw] expand_groups # @return [::Boolean] # Optional. If true, the identities section of the result will expand any # Google groups appearing in an IAM policy binding. # # If # {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#identity_selector IamPolicyAnalysisQuery.identity_selector} # is specified, the identity in the result will be determined by the # selector, and this flag is not allowed to set. # # If true, the default max expansion per group is 1000 for # AssetService.AnalyzeIamPolicy][]. # # Default is false. # @!attribute [rw] expand_roles # @return [::Boolean] # Optional. If true, the access section of result will expand any roles # appearing in IAM policy bindings to include their permissions. # # If # {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#access_selector IamPolicyAnalysisQuery.access_selector} # is specified, the access section of the result will be determined by the # selector, and this flag is not allowed to set. # # Default is false. # @!attribute [rw] expand_resources # @return [::Boolean] # Optional. If true and # {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} # is not specified, the resource section of the result will expand any # resource attached to an IAM policy to include resources lower in the # resource hierarchy. # # For example, if the request analyzes for which resources user A has # permission P, and the results include an IAM policy with P on a GCP # folder, the results will also include resources in that folder with # permission P. # # If true and # {::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery#resource_selector IamPolicyAnalysisQuery.resource_selector} # is specified, the resource section of the result will expand the # specified resource to include resources lower in the resource hierarchy. # Only project or lower resources are supported. Folder and organization # resource cannot be used together with this option. # # For example, if the request analyzes for which users have permission P on # a GCP project with this option enabled, the results will include all # users who have permission P on that project or any lower resource. # # If true, the default max expansion per resource is 1000 for # AssetService.AnalyzeIamPolicy][] and 100000 for # AssetService.AnalyzeIamPolicyLongrunning][]. # # Default is false. # @!attribute [rw] output_resource_edges # @return [::Boolean] # Optional. If true, the result will output the relevant parent/child # relationships between resources. Default is false. # @!attribute [rw] output_group_edges # @return [::Boolean] # Optional. If true, the result will output the relevant membership # relationships between groups and other groups, and between groups and # principals. Default is false. # @!attribute [rw] analyze_service_account_impersonation # @return [::Boolean] # Optional. If true, the response will include access analysis from # identities to resources via service account impersonation. This is a very # expensive operation, because many derived queries will be executed. We # highly recommend you use # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} # rpc instead. # # For example, if the request analyzes for which resources user A has # permission P, and there's an IAM policy states user A has # iam.serviceAccounts.getAccessToken permission to a service account SA, # and there's another IAM policy states service account SA has permission P # to a GCP folder F, then user A potentially has access to the GCP folder # F. And those advanced analysis results will be included in # {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}. # # Another example, if the request analyzes for who has # permission P to a GCP folder F, and there's an IAM policy states user A # has iam.serviceAccounts.actAs permission to a service account SA, and # there's another IAM policy states service account SA has permission P to # the GCP folder F, then user A potentially has access to the GCP folder # F. And those advanced analysis results will be included in # {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis AnalyzeIamPolicyResponse.service_account_impersonation_analysis}. # # Only the following permissions are considered in this analysis: # # * `iam.serviceAccounts.actAs` # * `iam.serviceAccounts.signBlob` # * `iam.serviceAccounts.signJwt` # * `iam.serviceAccounts.getAccessToken` # * `iam.serviceAccounts.getOpenIdToken` # * `iam.serviceAccounts.implicitDelegation` # # Default is false. class Options include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # The IAM conditions context. # @!attribute [rw] access_time # @return [::Google::Protobuf::Timestamp] # The hypothetical access timestamp to evaluate IAM conditions. Note that # this value must not be earlier than the current time; otherwise, an # INVALID_ARGUMENT error will be returned. class ConditionContext include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # A request message for # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy AssetService.AnalyzeIamPolicy}. # @!attribute [rw] analysis_query # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery] # Required. The request query. # @!attribute [rw] saved_analysis_query # @return [::String] # Optional. The name of a saved query, which must be in the format of: # # * projects/project_number/savedQueries/saved_query_id # * folders/folder_number/savedQueries/saved_query_id # * organizations/organization_number/savedQueries/saved_query_id # # If both `analysis_query` and `saved_analysis_query` are provided, they # will be merged together with the `saved_analysis_query` as base and # the `analysis_query` as overrides. For more details of the merge behavior, # please refer to the # [MergeFrom](https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.message#Message.MergeFrom.details) # page. # # Note that you cannot override primitive fields with default value, such as # 0 or empty string, etc., because we use proto3, which doesn't support field # presence yet. # @!attribute [rw] execution_timeout # @return [::Google::Protobuf::Duration] # Optional. Amount of time executable has to complete. See JSON # representation of # [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json). # # If this field is set with a value less than the RPC deadline, and the # execution of your query hasn't finished in the specified # execution timeout, you will get a response with partial result. # Otherwise, your query's execution will continue until the RPC deadline. # If it's not finished until then, you will get a DEADLINE_EXCEEDED error. # # Default is empty. class AnalyzeIamPolicyRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A response message for # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy AssetService.AnalyzeIamPolicy}. # @!attribute [rw] main_analysis # @return [::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse::IamPolicyAnalysis] # The main analysis that matches the original request. # @!attribute [rw] service_account_impersonation_analysis # @return [::Array<::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse::IamPolicyAnalysis>] # The service account impersonation analysis if # [AnalyzeIamPolicyRequest.analyze_service_account_impersonation][] is # enabled. # @!attribute [rw] fully_explored # @return [::Boolean] # Represents whether all entries in the # {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#main_analysis main_analysis} # and # {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse#service_account_impersonation_analysis service_account_impersonation_analysis} # have been fully explored to answer the query in the request. class AnalyzeIamPolicyResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # An analysis message to group the query and results. # @!attribute [rw] analysis_query # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery] # The analysis query. # @!attribute [rw] analysis_results # @return [::Array<::Google::Cloud::Asset::V1::IamPolicyAnalysisResult>] # A list of # {::Google::Cloud::Asset::V1::IamPolicyAnalysisResult IamPolicyAnalysisResult} # that matches the analysis query, or empty if no result is found. # @!attribute [rw] fully_explored # @return [::Boolean] # Represents whether all entries in the # {::Google::Cloud::Asset::V1::AnalyzeIamPolicyResponse::IamPolicyAnalysis#analysis_results analysis_results} # have been fully explored to answer the query. # @!attribute [rw] non_critical_errors # @return [::Array<::Google::Cloud::Asset::V1::IamPolicyAnalysisState>] # A list of non-critical errors happened during the query handling. class IamPolicyAnalysis include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # Output configuration for export IAM policy analysis destination. # @!attribute [rw] gcs_destination # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisOutputConfig::GcsDestination] # Destination on Cloud Storage. # @!attribute [rw] bigquery_destination # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisOutputConfig::BigQueryDestination] # Destination on BigQuery. class IamPolicyAnalysisOutputConfig include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # A Cloud Storage location. # @!attribute [rw] uri # @return [::String] # Required. The uri of the Cloud Storage object. It's the same uri that is # used by gsutil. Example: "gs://bucket_name/object_name". See [Viewing and # Editing Object # Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata) # for more information. # # If the specified Cloud Storage object already exists and there is no # [hold](https://cloud.google.com/storage/docs/object-holds), it will be # overwritten with the analysis result. class GcsDestination include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A BigQuery destination. # @!attribute [rw] dataset # @return [::String] # Required. The BigQuery dataset in format # "projects/projectId/datasets/datasetId", to which the analysis results # should be exported. If this dataset does not exist, the export call will # return an INVALID_ARGUMENT error. # @!attribute [rw] table_prefix # @return [::String] # Required. The prefix of the BigQuery tables to which the analysis results # will be written. Tables will be created based on this table_prefix if not # exist: # * _analysis table will contain export operation's metadata. # * _analysis_result will contain all the # {::Google::Cloud::Asset::V1::IamPolicyAnalysisResult IamPolicyAnalysisResult}. # When [partition_key] is specified, both tables will be partitioned based # on the [partition_key]. # @!attribute [rw] partition_key # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisOutputConfig::BigQueryDestination::PartitionKey] # The partition key for BigQuery partitioned table. # @!attribute [rw] write_disposition # @return [::String] # Optional. Specifies the action that occurs if the destination table or # partition already exists. The following values are supported: # # * WRITE_TRUNCATE: If the table or partition already exists, BigQuery # overwrites the entire table or all the partitions data. # * WRITE_APPEND: If the table or partition already exists, BigQuery # appends the data to the table or the latest partition. # * WRITE_EMPTY: If the table already exists and contains data, an error is # returned. # # The default value is WRITE_APPEND. Each action is atomic and only occurs # if BigQuery is able to complete the job successfully. Details are at # https://cloud.google.com/bigquery/docs/loading-data-local#appending_to_or_overwriting_a_table_using_a_local_file. class BigQueryDestination include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # This enum determines the partition key column for the bigquery tables. # Partitioning can improve query performance and reduce query cost by # filtering partitions. Refer to # https://cloud.google.com/bigquery/docs/partitioned-tables for details. module PartitionKey # Unspecified partition key. Tables won't be partitioned using this # option. PARTITION_KEY_UNSPECIFIED = 0 # The time when the request is received. If specified as partition key, # the result table(s) is partitoned by the RequestTime column, an # additional timestamp column representing when the request was received. REQUEST_TIME = 1 end end end # A request message for # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning}. # @!attribute [rw] analysis_query # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery] # Required. The request query. # @!attribute [rw] saved_analysis_query # @return [::String] # Optional. The name of a saved query, which must be in the format of: # # * projects/project_number/savedQueries/saved_query_id # * folders/folder_number/savedQueries/saved_query_id # * organizations/organization_number/savedQueries/saved_query_id # # If both `analysis_query` and `saved_analysis_query` are provided, they # will be merged together with the `saved_analysis_query` as base and # the `analysis_query` as overrides. For more details of the merge behavior, # please refer to the # [MergeFrom](https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.message#Message.MergeFrom.details) # doc. # # Note that you cannot override primitive fields with default value, such as # 0 or empty string, etc., because we use proto3, which doesn't support field # presence yet. # @!attribute [rw] output_config # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisOutputConfig] # Required. Output configuration indicating where the results will be output # to. class AnalyzeIamPolicyLongrunningRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A response message for # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning}. class AnalyzeIamPolicyLongrunningResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A saved query which can be shared with others or used later. # @!attribute [rw] name # @return [::String] # The resource name of the saved query. The format must be: # # * projects/project_number/savedQueries/saved_query_id # * folders/folder_number/savedQueries/saved_query_id # * organizations/organization_number/savedQueries/saved_query_id # @!attribute [rw] description # @return [::String] # The description of this saved query. This value should be fewer than 255 # characters. # @!attribute [r] create_time # @return [::Google::Protobuf::Timestamp] # Output only. The create time of this saved query. # @!attribute [r] creator # @return [::String] # Output only. The account's email address who has created this saved query. # @!attribute [r] last_update_time # @return [::Google::Protobuf::Timestamp] # Output only. The last update time of this saved query. # @!attribute [r] last_updater # @return [::String] # Output only. The account's email address who has updated this saved query # most recently. # @!attribute [rw] labels # @return [::Google::Protobuf::Map{::String => ::String}] # Labels applied on the resource. # This value should not contain more than 10 entries. The key and value of # each entry must be non-empty and fewer than 64 characters. # @!attribute [rw] content # @return [::Google::Cloud::Asset::V1::SavedQuery::QueryContent] # The query content. class SavedQuery include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # The query content. # @!attribute [rw] iam_policy_analysis_query # @return [::Google::Cloud::Asset::V1::IamPolicyAnalysisQuery] # An IAM Policy Analysis query, which could be used in # the # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy AssetService.AnalyzeIamPolicy} # rpc or the # {::Google::Cloud::Asset::V1::AssetService::Client#analyze_iam_policy_longrunning AssetService.AnalyzeIamPolicyLongrunning} # rpc. class QueryContent include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # @!attribute [rw] key # @return [::String] # @!attribute [rw] value # @return [::String] class LabelsEntry include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end # Request to create a saved query. # @!attribute [rw] parent # @return [::String] # Required. The name of the project/folder/organization where this # saved_query should be created in. It can only be an organization number # (such as "organizations/123"), a folder number (such as "folders/123"), a # project ID (such as "projects/my-project-id")", or a project number (such # as "projects/12345"). # @!attribute [rw] saved_query # @return [::Google::Cloud::Asset::V1::SavedQuery] # Required. The saved_query details. The `name` field must be empty as it # will be generated based on the parent and saved_query_id. # @!attribute [rw] saved_query_id # @return [::String] # Required. The ID to use for the saved query, which must be unique in the # specified parent. It will become the final component of the saved query's # resource name. # # This value should be 4-63 characters, and valid characters # are /[a-z][0-9]-/. # # Notice that this field is required in the saved query creation, and the # `name` field of the `saved_query` will be ignored. class CreateSavedQueryRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Request to get a saved query. # @!attribute [rw] name # @return [::String] # Required. The name of the saved query and it must be in the format of: # # * projects/project_number/savedQueries/saved_query_id # * folders/folder_number/savedQueries/saved_query_id # * organizations/organization_number/savedQueries/saved_query_id class GetSavedQueryRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Request to list saved queries. # @!attribute [rw] parent # @return [::String] # Required. The parent project/folder/organization whose savedQueries are to # be listed. It can only be using project/folder/organization number (such as # "folders/12345")", or a project ID (such as "projects/my-project-id"). # @!attribute [rw] filter # @return [::String] # Optional. The expression to filter resources. # The expression is a list of zero or more restrictions combined via logical # operators `AND` and `OR`. When `AND` and `OR` are both used in the # expression, parentheses must be appropriately used to group the # combinations. The expression may also contain regular expressions. # # See https://google.aip.dev/160 for more information on the grammar. # @!attribute [rw] page_size # @return [::Integer] # Optional. The maximum number of saved queries to return per page. The # service may return fewer than this value. If unspecified, at most 50 will # be returned. # The maximum value is 1000; values above 1000 will be coerced to 1000. # @!attribute [rw] page_token # @return [::String] # Optional. A page token, received from a previous `ListSavedQueries` call. # Provide this to retrieve the subsequent page. # # When paginating, all other parameters provided to `ListSavedQueries` must # match the call that provided the page token. class ListSavedQueriesRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Response of listing saved queries. # @!attribute [rw] saved_queries # @return [::Array<::Google::Cloud::Asset::V1::SavedQuery>] # A list of savedQueries. # @!attribute [rw] next_page_token # @return [::String] # A token, which can be sent as `page_token` to retrieve the next page. # If this field is omitted, there are no subsequent pages. class ListSavedQueriesResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Request to update a saved query. # @!attribute [rw] saved_query # @return [::Google::Cloud::Asset::V1::SavedQuery] # Required. The saved query to update. # # The saved query's `name` field is used to identify the one to update, # which has format as below: # # * projects/project_number/savedQueries/saved_query_id # * folders/folder_number/savedQueries/saved_query_id # * organizations/organization_number/savedQueries/saved_query_id # @!attribute [rw] update_mask # @return [::Google::Protobuf::FieldMask] # Required. The list of fields to update. class UpdateSavedQueryRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # Request to delete a saved query. # @!attribute [rw] name # @return [::String] # Required. The name of the saved query to delete. It must be in the format # of: # # * projects/project_number/savedQueries/saved_query_id # * folders/folder_number/savedQueries/saved_query_id # * organizations/organization_number/savedQueries/saved_query_id class DeleteSavedQueryRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # The request message for performing resource move analysis. # @!attribute [rw] resource # @return [::String] # Required. Name of the resource to perform the analysis against. # Only GCP Project are supported as of today. Hence, this can only be Project # ID (such as "projects/my-project-id") or a Project Number (such as # "projects/12345"). # @!attribute [rw] destination_parent # @return [::String] # Required. Name of the GCP Folder or Organization to reparent the target # resource. The analysis will be performed against hypothetically moving the # resource to this specified desitination parent. This can only be a Folder # number (such as "folders/123") or an Organization number (such as # "organizations/123"). # @!attribute [rw] view # @return [::Google::Cloud::Asset::V1::AnalyzeMoveRequest::AnalysisView] # Analysis view indicating what information should be included in the # analysis response. If unspecified, the default view is FULL. class AnalyzeMoveRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # View enum for supporting partial analysis responses. module AnalysisView # The default/unset value. # The API will default to the FULL view. ANALYSIS_VIEW_UNSPECIFIED = 0 # Full analysis including all level of impacts of the specified resource # move. FULL = 1 # Basic analysis only including blockers which will prevent the specified # resource move at runtime. BASIC = 2 end end # The response message for resource move analysis. # @!attribute [rw] move_analysis # @return [::Array<::Google::Cloud::Asset::V1::MoveAnalysis>] # The list of analyses returned from performing the intended resource move # analysis. The analysis is grouped by different Cloud services. class AnalyzeMoveResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A message to group the analysis information. # @!attribute [rw] display_name # @return [::String] # The user friendly display name of the analysis. E.g. IAM, Organization # Policy etc. # @!attribute [rw] analysis # @return [::Google::Cloud::Asset::V1::MoveAnalysisResult] # Analysis result of moving the target resource. # @!attribute [rw] error # @return [::Google::Rpc::Status] # Description of error encountered when performing the analysis. class MoveAnalysis include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # An analysis result including blockers and warnings. # @!attribute [rw] blockers # @return [::Array<::Google::Cloud::Asset::V1::MoveImpact>] # Blocking information that would prevent the target resource from moving # to the specified destination at runtime. # @!attribute [rw] warnings # @return [::Array<::Google::Cloud::Asset::V1::MoveImpact>] # Warning information indicating that moving the target resource to the # specified destination might be unsafe. This can include important policy # information and configuration changes, but will not block moves at runtime. class MoveAnalysisResult include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A message to group impacts of moving the target resource. # @!attribute [rw] detail # @return [::String] # User friendly impact detail in a free form message. class MoveImpact include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A request message for # {::Google::Cloud::Asset::V1::AssetService::Client#batch_get_effective_iam_policies AssetService.BatchGetEffectiveIamPolicies}. # @!attribute [rw] scope # @return [::String] # Required. Only IAM policies on or below the scope will be returned. # # This can only be an organization number (such as "organizations/123"), a # folder number (such as "folders/123"), a project ID (such as # "projects/my-project-id"), or a project number (such as "projects/12345"). # # To know how to get organization id, visit [here # ](https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id). # # To know how to get folder or project id, visit [here # ](https://cloud.google.com/resource-manager/docs/creating-managing-folders#viewing_or_listing_folders_and_projects). # @!attribute [rw] names # @return [::Array<::String>] # Required. The names refer to the [full_resource_names] # (https://cloud.google.com/asset-inventory/docs/resource-name-format) # of [searchable asset # types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types). # A maximum of 20 resources' effective policies can be retrieved in a batch. class BatchGetEffectiveIamPoliciesRequest include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end # A response message for # {::Google::Cloud::Asset::V1::AssetService::Client#batch_get_effective_iam_policies AssetService.BatchGetEffectiveIamPolicies}. # @!attribute [rw] policy_results # @return [::Array<::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy>] # The effective policies for a batch of resources. Note that the results # order is the same as the order of # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesRequest#names BatchGetEffectiveIamPoliciesRequest.names}. # When a resource does not have any effective IAM policies, its corresponding # policy_result will contain empty # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy#policies EffectiveIamPolicy.policies}. class BatchGetEffectiveIamPoliciesResponse include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # The effective IAM policies on one resource. # @!attribute [rw] full_resource_name # @return [::String] # The [full_resource_name] # (https://cloud.google.com/asset-inventory/docs/resource-name-format) # for which the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy#policies policies} # are computed. This is one of the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesRequest#names BatchGetEffectiveIamPoliciesRequest.names} # the caller provides in the request. # @!attribute [rw] policies # @return [::Array<::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy::PolicyInfo>] # The effective policies for the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy#full_resource_name full_resource_name}. # # These policies include the policy set on the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy#full_resource_name full_resource_name} # and those set on its parents and ancestors up to the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesRequest#scope BatchGetEffectiveIamPoliciesRequest.scope}. # Note that these policies are not filtered according to the resource type # of the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy#full_resource_name full_resource_name}. # # These policies are hierarchically ordered by # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy::PolicyInfo#attached_resource PolicyInfo.attached_resource} # starting from # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy#full_resource_name full_resource_name} # itself to its parents and ancestors, such that policies[i]'s # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy::PolicyInfo#attached_resource PolicyInfo.attached_resource} # is the child of policies[i+1]'s # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy::PolicyInfo#attached_resource PolicyInfo.attached_resource}, # if policies[i+1] exists. class EffectiveIamPolicy include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods # The IAM policy and its attached resource. # @!attribute [rw] attached_resource # @return [::String] # The full resource name the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy::PolicyInfo#policy policy} # is directly attached to. # @!attribute [rw] policy # @return [::Google::Iam::V1::Policy] # The IAM policy that's directly attached to the # {::Google::Cloud::Asset::V1::BatchGetEffectiveIamPoliciesResponse::EffectiveIamPolicy::PolicyInfo#attached_resource attached_resource}. class PolicyInfo include ::Google::Protobuf::MessageExts extend ::Google::Protobuf::MessageExts::ClassMethods end end end # Asset content type. module ContentType # Unspecified content type. CONTENT_TYPE_UNSPECIFIED = 0 # Resource metadata. RESOURCE = 1 # The actual IAM policy set on a resource. IAM_POLICY = 2 # The Cloud Organization Policy set on an asset. ORG_POLICY = 4 # The Cloud Access context manager Policy set on an asset. ACCESS_POLICY = 5 # The runtime OS Inventory information. OS_INVENTORY = 6 # The related resources. RELATIONSHIP = 7 end end end end end