Blame - docs/dyn/cloudasset_v1.v1.html - platform/external/python/google-api-python-client

2019-06-14 16:50:42 -0700

[diff] [blame]

79

<p class="firstline">Batch gets the update history of assets that overlap a time window.</p>

80

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

81

<code><a href="#exportAssets">exportAssets(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

82

<p class="firstline">Exports assets with time and resource types to a given Cloud Storage</p>

83

<h3>Method Details</h3>

84

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

85

<code class="details" id="batchGetAssetsHistory">batchGetAssetsHistory(parent, assetNames=None, contentType=None, readTimeWindow_endTime=None, readTimeWindow_startTime=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

86

<pre>Batch gets the update history of assets that overlap a time window.

87

For RESOURCE content, this API outputs history with asset in both

88

non-delete or deleted status.

89

For IAM_POLICY content, this API outputs history when the asset and its

90

attached IAM POLICY both exist. This can create gaps in the output history.

91

If a specified asset does not exist, this API returns an INVALID_ARGUMENT

error.

Args:

parent: string, Required. The relative name of the root asset. It can only be an

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

96

organization number (such as "organizations/123"), a project ID (such as

97

"projects/my-project-id")", or a project number (such as "projects/12345"). (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

98

assetNames: string, A list of the full names of the assets. For example:

99

`//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.

100

See [Resource

101

Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)

102

and [Resource Name

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

103

Format](https://cloud.google.com/asset-inventory/docs/resource-name-format)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

104

for more info.

105

106

The request becomes a no-op if the asset name list is empty, and the max

107

size of the asset name list is 100 in one request. (repeated)

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

108

contentType: string, Optional. The content type.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

109

readTimeWindow_endTime: string, End time of the time window (inclusive). If not specified, the current

110

timestamp is used instead.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

111

readTimeWindow_startTime: string, Start time of the time window (exclusive).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

112

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

119

120

{ # Batch get assets history response.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

121

"assets": [ # A list of assets with valid time windows.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

122

{ # An asset in Google Cloud and its temporal metadata, including the time window

123

# when it was observed and its status during that window.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

124

"deleted": True or False, # Whether the asset has been deleted or not.

125

"window": { # A time window specified by its "start_time" and "end_time". # The time window when the asset data and state was observed.

126

"endTime": "A String", # End time of the time window (inclusive). If not specified, the current

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

127

# timestamp is used instead.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

128

"startTime": "A String", # Start time of the time window (exclusive).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

129

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

130

"asset": { # An asset in Google Cloud. An asset can be any resource in the Google Cloud # An asset in Google Cloud.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

131

# [resource

132

# hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy),

133

# a resource outside the Google Cloud resource hierarchy (such as Google

134

# Kubernetes Engine clusters and objects), or a Cloud IAM policy.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

135

"assetType": "A String", # The type of the asset. For example: "compute.googleapis.com/Disk"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

136

#

137

# See [Supported asset

138

# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types)

139

# for more information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

140

"accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary

141

# attributes to use Google Cloud services) and `ServicePerimeters` (which

142

# define regions of services able to freely pass data within a perimeter). An

143

# access policy is globally visible within an organization, and the

144

# restrictions it specifies apply to all projects within an organization.

145

"name": "A String", # Output only. Resource name of the `AccessPolicy`. Format:

146

# `accessPolicies/{policy_id}`

147

"etag": "A String", # Output only. An opaque identifier for the current version of the

148

# `AccessPolicy`. This will always be a strongly validated etag, meaning that

149

# two Access Polices will be identical if and only if their etags are

150

# identical. Clients should not expect this to be in any specific format.

151

"parent": "A String", # Required. The parent of this `AccessPolicy` in the Cloud Resource

152

# Hierarchy. Currently immutable once created. Format:

153

# `organizations/{organization_id}`

154

"title": "A String", # Required. Human readable title. Does not affect behavior.

155

},

156

"ancestors": [ # The ancestry path of an asset in Google Cloud [resource

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

157

# hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy),

158

# represented as a list of relative resource names. An ancestry path starts

159

# with the closest ancestor in the hierarchy and ends at root. If the asset

160

# is a project, folder, or organization, the ancestry path starts from the

161

# asset itself.

162

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

163

# For example: `["projects/123456789", "folders/5432", "organizations/1234"]`

164

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

165

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

166

"servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely

167

# import and export data amongst themselves, but not export outside of the

168

# `ServicePerimeter`. If a request with a source within this `ServicePerimeter`

169

# has a target outside of the `ServicePerimeter`, the request will be blocked.

170

# Otherwise the request is allowed. There are two types of Service Perimeter -

171

# Regular and Bridge. Regular Service Perimeters cannot overlap, a single

172

# Google Cloud project can only belong to a single regular Service Perimeter.

173

# Service Perimeter Bridges can contain only Google Cloud projects as members,

174

# a single Google Cloud project may belong to multiple Service Perimeter

175

# Bridges.

176

"name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`

177

# component must begin with a letter and only include alphanumeric and '_'.

178

# Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`

179

"perimeterType": "A String", # Perimeter type indicator. A single project is

180

# allowed to be a member of single regular perimeter, but multiple service

181

# perimeter bridges. A project cannot be a included in a perimeter bridge

182

# without being included in regular perimeter. For perimeter bridges,

183

# the restricted service list as well as access level lists must be

184

# empty.

185

"title": "A String", # Human readable title. Must be unique within the Policy.

186

"useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly

187

# exists for all Service Perimeters, and that spec is identical to the

188

# status for those Service Perimeters. When this flag is set, it inhibits the

189

# generation of the implicit spec, thereby allowing the user to explicitly

190

# provide a configuration ("spec") to use in a dry-run version of the Service

191

# Perimeter. This allows the user to test changes to the enforced config

192

# ("status") without actually enforcing them. This testing is done through

193

# analyzing the differences between currently enforced and suggested

194

# restrictions. use_explicit_dry_run_spec must bet set to True if any of the

195

# fields in the spec are set to non-default values.

196

"description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect

197

# behavior.

198

"status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,

199

# restricted services and access levels that determine perimeter

200

# content and boundaries.

201

# describe specific Service Perimeter configuration.

202

"resources": [ # A list of Google Cloud resources that are inside of the service perimeter.

203

# Currently only projects are allowed. Format: `projects/{project_number}`

204

"A String",

205

],

206

"accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the

207

# `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed

208

# must be in the same policy as this `ServicePerimeter`. Referencing a

209

# nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are

210

# listed, resources within the perimeter can only be accessed via Google

211

# Cloud calls with request origins within the perimeter. Example:

212

# `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.

213

# For Service Perimeter Bridge, must be empty.

214

"A String",

215

],

216

"restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter

217

# restrictions. For example, if `storage.googleapis.com` is specified, access

218

# to the storage buckets inside the perimeter must meet the perimeter's

219

# access restrictions.

220

"A String",

221

],

222

"vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.

223

# Perimeter.

224

"enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of

225

# APIs specified in 'allowed_services'.

226

"allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty

227

# unless 'enable_restriction' is True.

"A String",

],

},

},

"spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration

233

# allows to specify and test ServicePerimeter configuration without enforcing

234

# actual access restrictions. Only allowed to be set when the

235

# "use_explicit_dry_run_spec" flag is set.

236

# describe specific Service Perimeter configuration.

237

"resources": [ # A list of Google Cloud resources that are inside of the service perimeter.

238

# Currently only projects are allowed. Format: `projects/{project_number}`

239

"A String",

240

],

241

"accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the

242

# `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed

243

# must be in the same policy as this `ServicePerimeter`. Referencing a

244

# nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are

245

# listed, resources within the perimeter can only be accessed via Google

246

# Cloud calls with request origins within the perimeter. Example:

247

# `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.

248

# For Service Perimeter Bridge, must be empty.

249

"A String",

250

],

251

"restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter

252

# restrictions. For example, if `storage.googleapis.com` is specified, access

253

# to the storage buckets inside the perimeter must meet the perimeter's

254

# access restrictions.

255

"A String",

256

],

257

"vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.

258

# Perimeter.

259

"enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of

260

# APIs specified in 'allowed_services'.

261

"allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty

262

# unless 'enable_restriction' is True.

"A String",

],

},

},

},

"resource": { # A representation of a Google Cloud resource. # A representation of the resource.

269

"discoveryName": "A String", # The JSON schema name listed in the discovery document. For example:

270

# "Project"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

271

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

272

# This value is unspecified for resources that do not have an API based on a

273

# discovery document, such as Cloud Bigtable.

274

"version": "A String", # The API version. For example: "v1"

275

"data": { # The content of the resource, in which some sensitive fields are removed

276

# and may not be present.

277

"a_key": "", # Properties of the object.

278

},

279

"discoveryDocumentUri": "A String", # The URL of the discovery document containing the resource's JSON schema.

280

# For example:

281

# "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest"

282

#

283

# This value is unspecified for resources that do not have an API based on a

284

# discovery document, such as Cloud Bigtable.

285

"parent": "A String", # The full name of the immediate parent of this resource. See

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

286

# [Resource

287

# Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)

288

# for more information.

289

#

290

# For Google Cloud assets, this value is the parent resource defined in the

291

# [Cloud IAM policy

292

# hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy).

293

# For example:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

294

# "//cloudresourcemanager.googleapis.com/projects/my_project_123"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

295

#

296

# For third-party assets, this field may be set differently.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

297

"resourceUrl": "A String", # The REST URL for accessing the resource. An HTTP `GET` request using this

298

# URL returns the resource itself. For example:

299

# "https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

300

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

301

# This value is unspecified for resources without a REST API.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

302

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

303

"name": "A String", # The full name of the asset. For example:

304

# "//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

305

#

306

# See [Resource

307

# names](https://cloud.google.com/apis/design/resource_names#full_resource_name)

308

# for more information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

309

"orgPolicy": [ # A representation of an [organization

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

310

# policy](https://cloud.google.com/resource-manager/docs/organization-policy/overview#organization_policy).

311

# There can be more than one organization policy with different constraints

312

# set on a given resource.

313

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

314

# for configurations of Cloud Platform resources.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

315

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

316

# resource.

317

#

318

# `ListPolicy` can define specific values and subtrees of Cloud Resource

319

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

320

# are allowed or denied by setting the `allowed_values` and `denied_values`

321

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

322

# The `under:` prefix is used to denote resource subtree values.

323

# The `is:` prefix is used to denote specific values, and is required only

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

324

# if the value contains a ":". Values prefixed with "is:" are treated the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

325

# same as values with no prefix.

326

# Ancestry subtrees must be in one of the following formats:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

327

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

328

# - "folders/<folder-id>", e.g. "folders/1234"

329

# - "organizations/<organization-id>", e.g. "organizations/1234"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

330

# The `supports_under` field of the associated `Constraint` defines whether

331

# ancestry prefixes can be used. You can set `allowed_values` and

332

# `denied_values` in the same `Policy` if `all_values` is

333

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

334

# values. If `all_values` is set to either `ALLOW` or `DENY`,

335

# `allowed_values` and `denied_values` must be unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

336

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

337

# is set to `ALL_VALUES_UNSPECIFIED`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

338

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

339

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

340

"allValues": "A String", # The policy all_values state.

341

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

342

# is set to `ALL_VALUES_UNSPECIFIED`.

343

"A String",

344

],

345

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

346

# that matches the value specified in this `Policy`. If `suggested_value`

347

# is not set, it will inherit the value specified higher in the hierarchy,

348

# unless `inherit_from_parent` is `false`.

349

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

350

#

351

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

352

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

353

# set to `true`, then the values from the effective `Policy` of the parent

354

# resource are inherited, meaning the values set in this `Policy` are

355

# added to the values inherited up the hierarchy.

356

#

357

# Setting `Policy` hierarchies that inherit both allowed values and denied

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

358

# values isn't recommended in most circumstances to keep the configuration

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

359

# simple and understandable. However, it is possible to set a `Policy` with

360

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

361

# In this case, the values that are allowed must be in `allowed_values` and

362

# not present in `denied_values`.

363

#

364

# For example, suppose you have a `Constraint`

365

# `constraints/serviceuser.services`, which has a `constraint_type` of

366

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

367

# Suppose that at the Organization level, a `Policy` is applied that

368

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

369

# `Policy` is applied to a project below the Organization that has

370

# `inherit_from_parent` set to `false` and field all_values set to DENY,

371

# then an attempt to activate any API will be denied.

372

#

373

# The following examples demonstrate different possible layerings for

374

# `projects/bar` parented by `organizations/foo`:

375

#

376

# Example 1 (no inherited values):

377

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

378

# {allowed_values: "E1" allowed_values:"E2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

379

# `projects/bar` has `inherit_from_parent` `false` and values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

380

# {allowed_values: "E3" allowed_values: "E4"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

381

# The accepted values at `organizations/foo` are `E1`, `E2`.

382

# The accepted values at `projects/bar` are `E3`, and `E4`.

383

#

384

# Example 2 (inherited values):

385

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

386

# {allowed_values: "E1" allowed_values:"E2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

387

# `projects/bar` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

388

# {value: "E3" value: "E4" inherit_from_parent: true}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

389

# The accepted values at `organizations/foo` are `E1`, `E2`.

390

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

391

#

392

# Example 3 (inheriting both allowed and denied values):

393

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

394

# {allowed_values: "E1" allowed_values: "E2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

396

# {denied_values: "E1"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

397

# The accepted values at `organizations/foo` are `E1`, `E2`.

398

# The value accepted at `projects/bar` is `E2`.

399

#

400

# Example 4 (RestoreDefault):

401

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

402

# {allowed_values: "E1" allowed_values:"E2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

403

# `projects/bar` has a `Policy` with values:

404

# {RestoreDefault: {}}

405

# The accepted values at `organizations/foo` are `E1`, `E2`.

406

# The accepted values at `projects/bar` are either all or none depending on

407

# the value of `constraint_default` (if `ALLOW`, all; if

408

# `DENY`, none).

409

#

410

# Example 5 (no policy inherits parent policy):

411

# `organizations/foo` has no `Policy` set.

412

# `projects/bar` has no `Policy` set.

413

# The accepted values at both levels are either all or none depending on

414

# the value of `constraint_default` (if `ALLOW`, all; if

415

# `DENY`, none).

416

#

417

# Example 6 (ListConstraint allowing all):

418

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

419

# {allowed_values: "E1" allowed_values: "E2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

420

# `projects/bar` has a `Policy` with:

421

# {all: ALLOW}

422

# The accepted values at `organizations/foo` are `E1`, E2`.

423

# Any value is accepted at `projects/bar`.

424

#

425

# Example 7 (ListConstraint allowing none):

426

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

427

# {allowed_values: "E1" allowed_values: "E2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

428

# `projects/bar` has a `Policy` with:

429

# {all: DENY}

430

# The accepted values at `organizations/foo` are `E1`, E2`.

431

# No value is accepted at `projects/bar`.

432

#

433

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

434

# Given the following resource hierarchy

435

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

436

# `organizations/foo` has a `Policy` with values:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

437

# {allowed_values: "under:organizations/O1"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

438

# `projects/bar` has a `Policy` with:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

439

# {allowed_values: "under:projects/P3"}

440

# {denied_values: "under:folders/F2"}

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

441

# The accepted values at `organizations/foo` are `organizations/O1`,

442

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

443

# `projects/P3`.

444

# The accepted values at `projects/bar` are `organizations/O1`,

445

# `folders/F1`, `projects/P1`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

446

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

447

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

448

# concurrency control.

449

#

450

# When the `Policy` is returned from either a `GetPolicy` or a

451

# `ListOrgPolicy` request, this `etag` indicates the version of the current

452

# `Policy` to use when executing a read-modify-write loop.

453

#

454

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

455

# `etag` will be unset.

456

#

457

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

458

# that was returned from a `GetOrgPolicy` request as part of a

459

# read-modify-write loop for concurrency control. Not setting the `etag`in a

460

# `SetOrgPolicy` request will result in an unconditional write of the

461

# `Policy`.

462

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

463

# resource.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

464

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

465

# configuration is acceptable.

466

#

467

# Suppose you have a `Constraint`

468

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

469

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

470

# behavior:

471

# - If the `Policy` at this resource has enforced set to `false`, serial

472

# port connection attempts will be allowed.

473

# - If the `Policy` at this resource has enforced set to `true`, serial

474

# port connection attempts will be refused.

475

# - If the `Policy` at this resource is `RestoreDefault`, serial port

476

# connection attempts will be allowed.

477

# - If no `Policy` is set at this resource or anywhere higher in the

478

# resource hierarchy, serial port connection attempts will be allowed.

479

# - If no `Policy` is set at this resource, but one exists higher in the

480

# resource hierarchy, the behavior is as if the`Policy` were set at

481

# this resource.

482

#

483

# The following examples demonstrate the different possible layerings:

484

#

485

# Example 1 (nearest `Constraint` wins):

486

# `organizations/foo` has a `Policy` with:

487

# {enforced: false}

488

# `projects/bar` has no `Policy` set.

489

# The constraint at `projects/bar` and `organizations/foo` will not be

490

# enforced.

491

#

492

# Example 2 (enforcement gets replaced):

493

# `organizations/foo` has a `Policy` with:

494

# {enforced: false}

495

# `projects/bar` has a `Policy` with:

496

# {enforced: true}

497

# The constraint at `organizations/foo` is not enforced.

498

# The constraint at `projects/bar` is enforced.

499

#

500

# Example 3 (RestoreDefault):

501

# `organizations/foo` has a `Policy` with:

502

# {enforced: true}

503

# `projects/bar` has a `Policy` with:

504

# {RestoreDefault: {}}

505

# The constraint at `organizations/foo` is enforced.

506

# The constraint at `projects/bar` is not enforced, because

507

# `constraint_default` for the `Constraint` is `ALLOW`.

508

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

509

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

510

# `constraints/serviceuser.services`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

511

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

512

# Immutable after creation.

513

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

514

# server, not specified by the caller, and represents the last time a call to

515

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

516

# be ignored.

517

"version": 42, # Version of the `Policy`. Default version is 0;

518

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

519

# `Constraint` type.

520

# `constraint_default` enforcement behavior of the specific `Constraint` at

521

# this resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

522

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

523

# Suppose that `constraint_default` is set to `ALLOW` for the

524

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

525

# foo.com sets a `Policy` at their Organization resource node that restricts

526

# the allowed service activations to deny all service activations. They

527

# could then set a `Policy` with the `policy_type` `restore_default` on

528

# several experimental projects, restoring the `constraint_default`

529

# enforcement of the `Constraint` for only those projects, allowing those

530

# projects to have all services activated.

531

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

532

},

533

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

534

"iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access # A representation of the Cloud IAM policy set on a Google Cloud resource.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

535

# There can be a maximum of one Cloud IAM policy set on any given resource.

536

# In addition, Cloud IAM policies inherit their granted access scope from any

537

# policies set on parent resources in the resource hierarchy. Therefore, the

538

# effectively policy is the union of both the policy set on this resource

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

539

# and each policy set on all of the resource's ancestry resource levels in

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

540

# the hierarchy. See

541

# [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for

542

# more information.

543

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

544

#

545

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

546

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

547

# `members` to a single `role`. Members can be user accounts, service accounts,

548

# Google groups, and domains (such as G Suite). A `role` is a named list of

549

# permissions; each `role` can be an IAM predefined role or a user-created

550

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

551

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

552

# Optionally, a `binding` can specify a `condition`, which is a logical

553

# expression that allows access to a resource only if the expression evaluates

554

# to `true`. A condition can add constraints based on attributes of the

555

# request, the resource, or both.

556

#

557

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

558

#

559

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

560

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

561

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

562

# "role": "roles/resourcemanager.organizationAdmin",

563

# "members": [

564

# "user:mike@example.com",

565

# "group:admins@example.com",

566

# "domain:google.com",

567

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

568

# ]

569

# },

570

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

571

# "role": "roles/resourcemanager.organizationViewer",

572

# "members": ["user:eve@example.com"],

573

# "condition": {

574

# "title": "expirable access",

575

# "description": "Does not grant access after Sep 2020",

576

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

577

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

578

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

579

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

580

# "etag": "BwWWja0YfJA=",

581

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

582

# }

583

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

584

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

589

# - group:admins@example.com

590

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

591

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

592

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

593

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

594

# - user:eve@example.com

595

# role: roles/resourcemanager.organizationViewer

596

# condition:

597

# title: expirable access

598

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

599

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

600

# - etag: BwWWja0YfJA=

601

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

602

#

603

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

604

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

605

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

606

# `condition` that determines how and when the `bindings` are applied. Each

607

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

608

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

609

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

610

# NOTE: An unsatisfied condition will not allow user access via current

611

# binding. Different bindings, including their conditions, are examined

612

# independently.

613

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

614

# are documented at https://github.com/google/cel-spec.

615

#

616

# Example (Comparison):

617

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

618

# title: "Summary size limit"

619

# description: "Determines if a summary is less than 100 chars"

620

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

621

#

622

# Example (Equality):

623

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

624

# title: "Requestor is owner"

625

# description: "Determines if requestor is the document owner"

626

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

627

#

628

# Example (Logic):

629

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

630

# title: "Public documents"

631

# description: "Determine whether the document should be publicly visible"

632

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

633

#

634

# Example (Data Manipulation):

635

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

636

# title: "Notification string"

637

# description: "Create a notification string with a timestamp."

638

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

639

#

640

# The exact variables and functions that may be referenced within an expression

641

# are determined by the service that evaluates it. See the service

642

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

643

"description": "A String", # Optional. Description of the expression. This is a longer text which

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

644

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

645

"expression": "A String", # Textual representation of an expression in Common Expression Language

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

646

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

647

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

648

# its purpose. This can be used e.g. in UIs which allow to enter the

649

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

650

"location": "A String", # Optional. String indicating the location of the expression for error

651

# reporting, e.g. a file name and a position in the file.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

652

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

653

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

654

# `members` can have the following values:

655

#

656

# * `allUsers`: A special identifier that represents anyone who is

657

# on the internet; with or without a Google account.

658

#

659

# * `allAuthenticatedUsers`: A special identifier that represents anyone

660

# who is authenticated with a Google account or a service account.

661

#

662

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

663

# account. For example, `alice@example.com` .

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

664

#

665

#

666

# * `serviceAccount:{emailid}`: An email address that represents a service

667

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

668

#

669

# * `group:{emailid}`: An email address that represents a Google group.

670

# For example, `admins@example.com`.

671

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

672

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

673

# identifier) representing a user that has been recently deleted. For

674

# example, `alice@example.com?uid=123456789012345678901`. If the user is

675

# recovered, this value reverts to `user:{emailid}` and the recovered user

676

# retains the role in the binding.

677

#

678

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

679

# unique identifier) representing a service account that has been recently

680

# deleted. For example,

681

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

682

# If the service account is undeleted, this value reverts to

683

# `serviceAccount:{emailid}` and the undeleted service account retains the

684

# role in the binding.

685

#

686

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

687

# identifier) representing a Google group that has been recently

688

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

689

# the group is recovered, this value reverts to `group:{emailid}` and the

690

# recovered group retains the role in the binding.

691

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

692

#

693

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

694

# users of that domain. For example, `google.com` or `example.com`.

695

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

696

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

697

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

698

"role": "A String", # Role that is assigned to `members`.

699

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

700

},

701

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

702

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

703

# prevent simultaneous updates of a policy from overwriting each other.

704

# It is strongly suggested that systems make use of the `etag` in the

705

# read-modify-write cycle to perform policy updates in order to avoid race

706

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

707

# systems are expected to put that etag in the request to `setIamPolicy` to

708

# ensure that their change will be applied to the same version of the policy.

709

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

710

# **Important:** If you use IAM Conditions, you must include the `etag` field

711

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

712

# you to overwrite a version `3` policy with a version `1` policy, and all of

713

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

714

"version": 42, # Specifies the format of the policy.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

715

#

716

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

717

# are rejected.

718

#

719

# Any operation that affects conditional role bindings must specify version

720

# `3`. This requirement applies to the following operations:

721

#

722

# * Getting a policy that includes a conditional role binding

723

# * Adding a conditional role binding to a policy

724

# * Changing a conditional role binding in a policy

725

# * Removing any role binding, with or without a condition, from a policy

726

# that includes conditions

727

#

728

# **Important:** If you use IAM Conditions, you must include the `etag` field

729

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

730

# you to overwrite a version `3` policy with a version `1` policy, and all of

731

# the conditions in the version `3` policy are lost.

732

#

733

# If a policy does not include any conditions, operations on that policy may

734

# specify any valid version or leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

735

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

736

{ # Specifies the audit configuration for a service.

737

# The configuration determines which permission types are logged, and what

738

# identities, if any, are exempted from logging.

739

# An AuditConfig must have one or more AuditLogConfigs.

740

#

741

# If there are AuditConfigs for both `allServices` and a specific service,

742

# the union of the two AuditConfigs is used for that service: the log_types

743

# specified in each AuditConfig are enabled, and the exempted_members in each

744

# AuditLogConfig are exempted.

745

#

746

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

752

# "audit_log_configs": [

753

# {

754

# "log_type": "DATA_READ",

755

# "exempted_members": [

756

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

761

# },

762

# {

763

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

769

# "audit_log_configs": [

770

# {

771

# "log_type": "DATA_READ",

772

# },

773

# {

774

# "log_type": "DATA_WRITE",

775

# "exempted_members": [

776

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

785

# logging. It also exempts jose@example.com from DATA_READ logging, and

786

# aliya@example.com from DATA_WRITE logging.

787

"auditLogConfigs": [ # The configuration for logging of each type of permission.

788

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

793

# {

794

# "log_type": "DATA_READ",

795

# "exempted_members": [

796

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

806

# jose@example.com from DATA_READ logging.

807

"logType": "A String", # The log type that this config enables.

808

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

809

# permission.

810

# Follows the same format of Binding.members.

"A String",

],

},

],

"service": "A String", # Specifies a service that will be enabled for audit logging.

816

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

817

# `allServices` is a special value that covers all services.

818

},

819

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

820

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

821

"accessLevel": { # An `AccessLevel` is a label that can be applied to requests to Google Cloud

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

822

# services, along with a list of requirements necessary for the label to be

823

# applied.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

824

"custom": { # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language # A `CustomLevel` written in the Common Expression Language.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

825

# to represent the necessary conditions for the level to apply to a request.

826

# See CEL spec at: https://github.com/google/cel-spec

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

827

"expr": { # Represents a textual expression in the Common Expression Language (CEL) # Required. A Cloud CEL expression evaluating to a boolean.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

828

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

829

# are documented at https://github.com/google/cel-spec.

830

#

831

# Example (Comparison):

832

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

833

# title: "Summary size limit"

834

# description: "Determines if a summary is less than 100 chars"

835

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

836

#

837

# Example (Equality):

838

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

839

# title: "Requestor is owner"

840

# description: "Determines if requestor is the document owner"

841

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

842

#

843

# Example (Logic):

844

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

845

# title: "Public documents"

846

# description: "Determine whether the document should be publicly visible"

847

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

848

#

849

# Example (Data Manipulation):

850

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

851

# title: "Notification string"

852

# description: "Create a notification string with a timestamp."

853

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

854

#

855

# The exact variables and functions that may be referenced within an expression

856

# are determined by the service that evaluates it. See the service

857

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

858

"description": "A String", # Optional. Description of the expression. This is a longer text which

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

859

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

860

"expression": "A String", # Textual representation of an expression in Common Expression Language

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

861

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

862

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

863

# its purpose. This can be used e.g. in UIs which allow to enter the

864

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

865

"location": "A String", # Optional. String indicating the location of the expression for error

866

# reporting, e.g. a file name and a position in the file.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

867

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

868

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

869

"title": "A String", # Human readable title. Must be unique within the Policy.

870

"name": "A String", # Required. Resource name for the Access Level. The `short_name` component

871

# must begin with a letter and only include alphanumeric and '_'. Format:

872

# `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length

873

# of the `short_name` component is 50 characters.

874

"basic": { # `BasicLevel` is an `AccessLevel` using a set of recommended features. # A `BasicLevel` composed of `Conditions`.

875

"conditions": [ # Required. A list of requirements for the `AccessLevel` to be granted.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

876

{ # A condition necessary for an `AccessLevel` to be granted. The Condition is an

877

# AND over its fields. So a Condition is true if: 1) the request IP is from one

878

# of the listed subnetworks AND 2) the originating device complies with the

879

# listed device policy AND 3) all listed access levels are granted AND 4) the

880

# request was sent at a time allowed by the DateTimeRestriction.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

881

"regions": [ # The request must originate from one of the provided countries/regions.

882

# Must be valid ISO 3166-1 alpha-2 codes.

883

"A String",

884

],

885

"requiredAccessLevels": [ # A list of other access levels defined in the same `Policy`, referenced by

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

886

# resource name. Referencing an `AccessLevel` which does not exist is an

887

# error. All access levels listed must be granted for the Condition

888

# to be true. Example:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

889

# "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`

890

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

891

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

892

"devicePolicy": { # `DevicePolicy` specifies device specific restrictions necessary to acquire a # Device specific restrictions, all restrictions must hold for the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

893

# Condition to be true. If not specified, all devices are allowed.

894

# given access level. A `DevicePolicy` specifies requirements for requests from

895

# devices to be granted access levels, it does not do any enforcement on the

896

# device. `DevicePolicy` acts as an AND over all specified fields, and each

897

# repeated field is an OR over its elements. Any unset fields are ignored. For

898

# example, if the proto is { os_type : DESKTOP_WINDOWS, os_type :

899

# DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be

900

# true for requests originating from encrypted Linux desktops and encrypted

901

# Windows desktops.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

902

"allowedEncryptionStatuses": [ # Allowed encryptions statuses, an empty list allows all statuses.

903

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

904

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

905

"allowedDeviceManagementLevels": [ # Allowed device management levels, an empty list allows all management

# levels.

"A String",

],

"osConstraints": [ # Allowed OS versions, an empty list allows all types and all versions.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

910

{ # A restriction on the OS type and version of devices making requests.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

911

"minimumVersion": "A String", # The minimum allowed OS version. If not set, any version of this OS

912

# satisfies the constraint. Format: `"major.minor.patch"`.

913

# Examples: `"10.5.301"`, `"9.2.1"`.

914

"osType": "A String", # Required. The allowed OS type.

915

"requireVerifiedChromeOs": True or False, # Only allows requests from devices with a verified Chrome OS.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

916

# Verifications includes requirements that the device is enterprise-managed,

917

# conformant to domain policies, and the caller has permission to call

918

# the API targeted by the request.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

919

},

920

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

921

"requireCorpOwned": True or False, # Whether the device needs to be corp owned.

922

"requireAdminApproval": True or False, # Whether the device needs to be approved by the customer admin.

923

"requireScreenlock": True or False, # Whether or not screenlock is required for the DevicePolicy to be true.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

924

# Defaults to `false`.

925

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

926

"members": [ # The request must be made by one of the provided user or service

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

927

# accounts. Groups are not supported.

928

# Syntax:

929

# `user:{emailid}`

930

# `serviceAccount:{emailid}`

931

# If not specified, a request may come from any user.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

932

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

933

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

934

"negate": True or False, # Whether to negate the Condition. If true, the Condition becomes a NAND over

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

935

# its non-empty fields, each field must be false for the Condition overall to

936

# be satisfied. Defaults to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

937

"ipSubnetworks": [ # CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for

938

# a CIDR IP address block, the specified IP address portion must be properly

939

# truncated (i.e. all the host bits must be zero) or the input is considered

940

# malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is

941

# not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas

942

# "2001:db8::1/32" is not. The originating IP of a request must be in one of

943

# the listed subnets in order for this Condition to be true. If empty, all IP

944

# addresses are allowed.

945

"A String",

946

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

947

},

948

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

949

"combiningFunction": "A String", # How the `conditions` list should be combined to determine if a request is

950

# granted this `AccessLevel`. If AND is used, each `Condition` in

951

# `conditions` must be satisfied for the `AccessLevel` to be applied. If OR

952

# is used, at least one `Condition` in `conditions` must be satisfied for the

953

# `AccessLevel` to be applied. Default behavior is AND.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

954

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

955

"description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

956

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

964

<code class="details" id="exportAssets">exportAssets(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

965

<pre>Exports assets with time and resource types to a given Cloud Storage

966

location. The output format is newline-delimited JSON.

967

This API implements the google.longrunning.Operation API allowing you

968

to keep track of the export.

969

970

Args:

971

parent: string, Required. The relative name of the root asset. This can only be an

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

972

organization number (such as "organizations/123"), a project ID (such as

973

"projects/my-project-id"), or a project number (such as "projects/12345"),

974

or a folder number (such as "folders/123"). (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

975

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

976

The object takes the form of:

977

978

{ # Export asset request.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

979

"readTime": "A String", # Timestamp to take an asset snapshot. This can only be set to a timestamp

980

# between the current time and the current time minus 35 days (inclusive).

981

# If not specified, the current time will be used. Due to delays in resource

982

# data collection and indexing, there is a volatile window during which

983

# running the same query may get different results.

984

"contentType": "A String", # Asset content type. If not specified, no content but the asset name will be

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

985

# returned.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

986

"outputConfig": { # Output configuration for export assets destination. # Required. Output configuration indicating where the results will be output

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

987

# to. All results will be in newline delimited JSON format.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

988

"bigqueryDestination": { # A BigQuery destination. # Destination on BigQuery. The output table stores the fields in asset

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

989

# proto as columns in BigQuery. The resource/iam_policy field is converted

990

# to a record with each field to a column, except metadata to a single JSON

991

# string.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

992

"dataset": "A String", # Required. The BigQuery dataset in format

993

# "projects/projectId/datasets/datasetId", to which the snapshot result

994

# should be exported. If this dataset does not exist, the export call returns

995

# an INVALID_ARGUMENT error.

996

"force": True or False, # If the destination table already exists and this flag is `TRUE`, the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

997

# table will be overwritten by the contents of assets snapshot. If the flag

998

# is `FALSE` or unset and the destination table already exists, the export

999

# call returns an INVALID_ARGUMEMT error.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1000

"table": "A String", # Required. The BigQuery table to which the snapshot result should be

1001

# written. If this table does not exist, a new table with the given name

1002

# will be created.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1003

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1004

"gcsDestination": { # A Cloud Storage location. # Destination on Cloud Storage.

1005

"uriPrefix": "A String", # The uri prefix of all generated Cloud Storage objects. For example:

1006

# "gs://bucket_name/object_name_prefix". Each object uri is in format:

1007

# "gs://bucket_name/object_name_prefix/<asset type>/<shard number> and only

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1008

# contains assets for that type. <shard number> starts from 0. For example:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1009

# "gs://bucket_name/object_name_prefix/compute.googleapis.com/Disk/0" is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1010

# the first shard of output objects containing all

1011

# compute.googleapis.com/Disk assets. An INVALID_ARGUMENT error will be

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1012

# returned if file with the same name "gs://bucket_name/object_name_prefix"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1013

# already exists.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1014

"uri": "A String", # The uri of the Cloud Storage object. It's the same uri that is used by

1015

# gsutil. For example: "gs://bucket_name/object_name". See [Viewing and

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1016

# Editing Object

1017

# Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata)

1018

# for more information.

1019

},

1020

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1021

"assetTypes": [ # A list of asset types of which to take a snapshot for. For example:

1022

# "compute.googleapis.com/Disk". If specified, only matching assets will be

1023

# returned. See [Introduction to Cloud Asset

1024

# Inventory](https://cloud.google.com/asset-inventory/docs/overview)

1025

# for all supported asset types.

1026

"A String",

1027

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1028

}

1029

1030

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1037

1038

{ # This resource represents a long-running operation that is the result of a

1039

# network API call.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1040

"done": True or False, # If the value is `false`, it means the operation is still in progress.

1041

# If `true`, the operation is completed, and either `error` or `response` is

1042

# available.

1043

"response": { # The normal response of the operation in case of success. If the original

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1044

# method returns no data on success, such as `Delete`, the response is

1045

# `google.protobuf.Empty`. If the original method is standard

1046

# `Get`/`Create`/`Update`, the response should be the resource. For other

1047

# methods, the response should have the type `XxxResponse`, where `Xxx`

1048

# is the original method name. For example, if the original method name

1049

# is `TakeSnapshot()`, the inferred response type is

1050

# `TakeSnapshotResponse`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1051

"a_key": "", # Properties of the object. Contains field @type with type URL.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1052

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1053

"name": "A String", # The server-assigned name, which is only unique within the same service that

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1054

# originally returns it. If you use the default HTTP mapping, the

1055

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1056

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1057

# different programming environments, including REST APIs and RPC APIs. It is

Dan O'Meara