|
|
|
|
@ -88,7 +88,7 @@ message TimeWindow { |
|
|
|
|
// [resource |
|
|
|
|
// hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), |
|
|
|
|
// a resource outside the Google Cloud resource hierarchy (such as Google |
|
|
|
|
// Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy), |
|
|
|
|
// Kubernetes Engine clusters and objects), or a policy (e.g. IAM policy), |
|
|
|
|
// or a relationship (e.g. an INSTANCE_TO_INSTANCEGROUP relationship). |
|
|
|
|
// See [Supported asset |
|
|
|
|
// types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) |
|
|
|
|
@ -121,9 +121,9 @@ message Asset { |
|
|
|
|
// A representation of the resource. |
|
|
|
|
Resource resource = 3; |
|
|
|
|
|
|
|
|
|
// A representation of the Cloud IAM policy set on a Google Cloud resource. |
|
|
|
|
// There can be a maximum of one Cloud IAM policy set on any given resource. |
|
|
|
|
// In addition, Cloud IAM policies inherit their granted access scope from any |
|
|
|
|
// A representation of the IAM policy set on a Google Cloud resource. |
|
|
|
|
// There can be a maximum of one IAM policy set on any given resource. |
|
|
|
|
// In addition, IAM policies inherit their granted access scope from any |
|
|
|
|
// policies set on parent resources in the resource hierarchy. Therefore, the |
|
|
|
|
// effectively policy is the union of both the policy set on this resource |
|
|
|
|
// and each policy set on all of the resource's ancestry resource levels in |
|
|
|
|
@ -151,7 +151,8 @@ message Asset { |
|
|
|
|
|
|
|
|
|
// Please also refer to the [service perimeter user |
|
|
|
|
// guide](https://cloud.google.com/vpc-service-controls/docs/overview). |
|
|
|
|
google.identity.accesscontextmanager.v1.ServicePerimeter service_perimeter = 9; |
|
|
|
|
google.identity.accesscontextmanager.v1.ServicePerimeter service_perimeter = |
|
|
|
|
9; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// A representation of runtime OS Inventory information. See [this |
|
|
|
|
@ -213,7 +214,7 @@ message Resource { |
|
|
|
|
// for more information. |
|
|
|
|
// |
|
|
|
|
// For Google Cloud assets, this value is the parent resource defined in the |
|
|
|
|
// [Cloud IAM policy |
|
|
|
|
// [IAM policy |
|
|
|
|
// hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy). |
|
|
|
|
// Example: |
|
|
|
|
// `//cloudresourcemanager.googleapis.com/projects/my_project_123` |
|
|
|
|
@ -270,7 +271,7 @@ message RelationshipAttributes { |
|
|
|
|
// ancestors. An asset can be any resource in the Google Cloud [resource |
|
|
|
|
// hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy), |
|
|
|
|
// a resource outside the Google Cloud resource hierarchy (such as Google |
|
|
|
|
// Kubernetes Engine clusters and objects), or a policy (e.g. Cloud IAM policy). |
|
|
|
|
// Kubernetes Engine clusters and objects), or a policy (e.g. IAM policy). |
|
|
|
|
// See [Supported asset |
|
|
|
|
// types](https://cloud.google.com/asset-inventory/docs/supported-asset-types) |
|
|
|
|
// for more information. |
|
|
|
|
@ -282,8 +283,8 @@ message RelatedAsset { |
|
|
|
|
// names](https://cloud.google.com/apis/design/resource_names#full_resource_name) |
|
|
|
|
// for more information. |
|
|
|
|
string asset = 1 [(google.api.resource_reference) = { |
|
|
|
|
type: "cloudasset.googleapis.com/Asset" |
|
|
|
|
}]; |
|
|
|
|
type: "cloudasset.googleapis.com/Asset" |
|
|
|
|
}]; |
|
|
|
|
|
|
|
|
|
// The type of the asset. Example: `compute.googleapis.com/Disk` |
|
|
|
|
// |
|
|
|
|
@ -389,7 +390,8 @@ message ResourceSearchResult { |
|
|
|
|
// * Use a free text query. Example: `us-west*` |
|
|
|
|
string location = 6; |
|
|
|
|
|
|
|
|
|
// Labels associated with this resource. See [Labelling and grouping GCP |
|
|
|
|
// Labels associated with this resource. See [Labelling and grouping Google |
|
|
|
|
// Cloud |
|
|
|
|
// resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources) |
|
|
|
|
// for more information. This field is available only when the resource's |
|
|
|
|
// Protobuf contains it. |
|
|
|
|
@ -404,7 +406,8 @@ message ResourceSearchResult { |
|
|
|
|
map<string, string> labels = 7; |
|
|
|
|
|
|
|
|
|
// Network tags associated with this resource. Like labels, network tags are a |
|
|
|
|
// type of annotations used to group GCP resources. See [Labelling GCP |
|
|
|
|
// type of annotations used to group Google Cloud resources. See [Labelling |
|
|
|
|
// Google Cloud |
|
|
|
|
// resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources) |
|
|
|
|
// for more information. This field is available only when the resource's |
|
|
|
|
// Protobuf contains it. |
|
|
|
|
@ -422,8 +425,8 @@ message ResourceSearchResult { |
|
|
|
|
// name. |
|
|
|
|
// |
|
|
|
|
// This field only presents for the purpose of backward compatibility. Please |
|
|
|
|
// use the `kms_keys` field to retrieve KMS key information. This field is |
|
|
|
|
// available only when the resource's Protobuf contains it and will only be |
|
|
|
|
// use the `kms_keys` field to retrieve Cloud KMS key information. This field |
|
|
|
|
// is available only when the resource's Protobuf contains it and will only be |
|
|
|
|
// populated for [these resource |
|
|
|
|
// types](https://cloud.google.com/asset-inventory/docs/legacy-field-names#resource_types_with_the_to_be_deprecated_kmskey_field) |
|
|
|
|
// for backward compatible purposes. |
|
|
|
|
@ -485,7 +488,7 @@ message ResourceSearchResult { |
|
|
|
|
// SUSPENDING, SUSPENDED, REPAIRING, and TERMINATED. See `status` definition |
|
|
|
|
// in [API |
|
|
|
|
// Reference](https://cloud.google.com/compute/docs/reference/rest/v1/instances). |
|
|
|
|
// If the resource is a project provided by Cloud Resource Manager, its state |
|
|
|
|
// If the resource is a project provided by Resource Manager, its state |
|
|
|
|
// will include LIFECYCLE_STATE_UNSPECIFIED, ACTIVE, DELETE_REQUESTED and |
|
|
|
|
// DELETE_IN_PROGRESS. See `lifecycleState` definition in [API |
|
|
|
|
// Reference](https://cloud.google.com/resource-manager/reference/rest/v1/projects). |
|
|
|
|
@ -500,15 +503,15 @@ message ResourceSearchResult { |
|
|
|
|
// vary from one resource type to another. Examples: `projectId` for Project, |
|
|
|
|
// `dnsName` for DNS ManagedZone. This field contains a subset of the resource |
|
|
|
|
// metadata fields that are returned by the List or Get APIs provided by the |
|
|
|
|
// corresponding GCP service (e.g., Compute Engine). see [API references and |
|
|
|
|
// supported searchable |
|
|
|
|
// corresponding Google Cloud service (e.g., Compute Engine). see [API |
|
|
|
|
// references and supported searchable |
|
|
|
|
// attributes](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types) |
|
|
|
|
// to see which fields are included. |
|
|
|
|
// |
|
|
|
|
// You can search values of these fields through free text search. However, |
|
|
|
|
// you should not consume the field programically as the field names and |
|
|
|
|
// values may change as the GCP service updates to a new incompatible API |
|
|
|
|
// version. |
|
|
|
|
// values may change as the Google Cloud service updates to a new incompatible |
|
|
|
|
// API version. |
|
|
|
|
// |
|
|
|
|
// To search against the `additional_attributes`: |
|
|
|
|
// |
|
|
|
|
@ -700,11 +703,11 @@ message IamPolicySearchResult { |
|
|
|
|
// * specify the `asset_types` field in your search request. |
|
|
|
|
string asset_type = 5; |
|
|
|
|
|
|
|
|
|
// The project that the associated GCP resource belongs to, in the form of |
|
|
|
|
// projects/{PROJECT_NUMBER}. If an IAM policy is set on a resource (like VM |
|
|
|
|
// instance, Cloud Storage bucket), the project field will indicate the |
|
|
|
|
// project that contains the resource. If an IAM policy is set on a folder or |
|
|
|
|
// orgnization, this field will be empty. |
|
|
|
|
// The project that the associated Google Cloud resource belongs to, in the |
|
|
|
|
// form of projects/{PROJECT_NUMBER}. If an IAM policy is set on a resource |
|
|
|
|
// (like VM instance, Cloud Storage bucket), the project field will indicate |
|
|
|
|
// the project that contains the resource. If an IAM policy is set on a folder |
|
|
|
|
// or orgnization, this field will be empty. |
|
|
|
|
// |
|
|
|
|
// To search against the `project`: |
|
|
|
|
// |
|
|
|
|
@ -876,8 +879,10 @@ message IamPolicyAnalysisResult { |
|
|
|
|
repeated Access accesses = 2; |
|
|
|
|
|
|
|
|
|
// Resource edges of the graph starting from the policy attached |
|
|
|
|
// resource to any descendant resources. The [Edge.source_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.source_node] contains |
|
|
|
|
// the full resource name of a parent resource and [Edge.target_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.target_node] |
|
|
|
|
// resource to any descendant resources. The |
|
|
|
|
// [Edge.source_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.source_node] |
|
|
|
|
// contains the full resource name of a parent resource and |
|
|
|
|
// [Edge.target_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.target_node] |
|
|
|
|
// contains the full resource name of a child resource. This field is |
|
|
|
|
// present only if the output_resource_edges option is enabled in request. |
|
|
|
|
repeated Edge resource_edges = 3; |
|
|
|
|
@ -896,32 +901,41 @@ message IamPolicyAnalysisResult { |
|
|
|
|
repeated Identity identities = 1; |
|
|
|
|
|
|
|
|
|
// Group identity edges of the graph starting from the binding's |
|
|
|
|
// group members to any node of the [identities][google.cloud.asset.v1.IamPolicyAnalysisResult.IdentityList.identities]. The [Edge.source_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.source_node] |
|
|
|
|
// group members to any node of the |
|
|
|
|
// [identities][google.cloud.asset.v1.IamPolicyAnalysisResult.IdentityList.identities]. |
|
|
|
|
// The |
|
|
|
|
// [Edge.source_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.source_node] |
|
|
|
|
// contains a group, such as `group:parent@google.com`. The |
|
|
|
|
// [Edge.target_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.target_node] contains a member of the group, |
|
|
|
|
// such as `group:child@google.com` or `user:foo@google.com`. |
|
|
|
|
// This field is present only if the output_group_edges option is enabled in |
|
|
|
|
// request. |
|
|
|
|
// [Edge.target_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.target_node] |
|
|
|
|
// contains a member of the group, such as `group:child@google.com` or |
|
|
|
|
// `user:foo@google.com`. This field is present only if the |
|
|
|
|
// output_group_edges option is enabled in request. |
|
|
|
|
repeated Edge group_edges = 2; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// The [full resource |
|
|
|
|
// name](https://cloud.google.com/asset-inventory/docs/resource-name-format) |
|
|
|
|
// of the resource to which the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] policy attaches. |
|
|
|
|
// of the resource to which the |
|
|
|
|
// [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] |
|
|
|
|
// policy attaches. |
|
|
|
|
string attached_resource_full_name = 1; |
|
|
|
|
|
|
|
|
|
// The Cloud IAM policy binding under analysis. |
|
|
|
|
// The IAM policy binding under analysis. |
|
|
|
|
google.iam.v1.Binding iam_binding = 2; |
|
|
|
|
|
|
|
|
|
// The access control lists derived from the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] that match or |
|
|
|
|
// potentially match resource and access selectors specified in the request. |
|
|
|
|
// The access control lists derived from the |
|
|
|
|
// [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] |
|
|
|
|
// that match or potentially match resource and access selectors specified in |
|
|
|
|
// the request. |
|
|
|
|
repeated AccessControlList access_control_lists = 3; |
|
|
|
|
|
|
|
|
|
// The identity list derived from members of the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] that match or |
|
|
|
|
// potentially match identity selector specified in the request. |
|
|
|
|
// The identity list derived from members of the |
|
|
|
|
// [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] |
|
|
|
|
// that match or potentially match identity selector specified in the request. |
|
|
|
|
IdentityList identity_list = 4; |
|
|
|
|
|
|
|
|
|
// Represents whether all analyses on the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] have successfully |
|
|
|
|
// finished. |
|
|
|
|
// Represents whether all analyses on the |
|
|
|
|
// [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] |
|
|
|
|
// have successfully finished. |
|
|
|
|
bool fully_explored = 5; |
|
|
|
|
} |
|
|
|
|
|
Google APIs
2 years ago
committed by
Copybara-Service