Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / dd49464a6262c0d1f71efcf11f131e2f591fe5f6 / . / docs / dyn / accesscontextmanager_v1.accessPolicies.servicePerimeters.html
blob: f5e1626354d73edd61cb6ed2f7389f253e0c86e9 [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="accesscontextmanager_v1.html">Access Context Manager API</a> . <a href="accesscontextmanager_v1.accessPolicies.html">accessPolicies</a> . <a href="accesscontextmanager_v1.accessPolicies.servicePerimeters.html">servicePerimeters</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]78 <code><a href="#commit">commit(parent, body=None, x__xgafv=None)</a></code></p>
79<p class="firstline">Commit the dry-run spec for all the Service Perimeters in an</p>
80<p class="toc_element">
81 <code><a href="#create">create(parent, body=None, x__xgafv=None)</a></code></p>
82<p class="firstline">Create a Service Perimeter. The</p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]83<p class="toc_element">
84 <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]85<p class="firstline">Delete a Service Perimeter by resource</p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]86<p class="toc_element">
87 <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]88<p class="firstline">Get a Service Perimeter by resource</p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]89<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]90 <code><a href="#list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]91<p class="firstline">List all Service Perimeters for an</p>
92<p class="toc_element">
93 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
94<p class="firstline">Retrieves the next page of results.</p>
95<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]96 <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
97<p class="firstline">Update a Service Perimeter. The</p>
98<p class="toc_element">
99 <code><a href="#replaceAll">replaceAll(parent, body=None, x__xgafv=None)</a></code></p>
100<p class="firstline">Replace all existing Service Perimeters in an</p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]101<h3>Method Details</h3>
102<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]103 <code class="details" id="commit">commit(parent, body=None, x__xgafv=None)</code>
104 <pre>Commit the dry-run spec for all the Service Perimeters in an
105Access Policy.
106A commit operation on a Service Perimeter involves copying its `spec` field
107to that Service Perimeter's `status` field. Only Service Perimeters with
108`use_explicit_dry_run_spec` field set to true are affected by a commit
109operation. The longrunning operation from this RPC will have a successful
110status once the dry-run specs for all the Service Perimeters have been
111committed. If a commit fails, it will cause the longrunning operation to
112return an error response and the entire commit operation will be cancelled.
113When successful, Operation.response field will contain
114CommitServicePerimetersResponse. The `dry_run` and the `spec` fields will
115be cleared after a successful commit operation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]116
117Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]118 parent: string, Required. Resource name for the parent Access Policy which owns all
119Service Perimeters in scope for
120the commit operation.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]121
122Format: `accessPolicies/{policy_id}` (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]123 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]124 The object takes the form of:
125
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]126{ # A request to commit dry-run specs in all Service Perimeters belonging to
127 # an Access Policy.
128 "etag": "A String", # Optional. The etag for the version of the Access Policy that this
129 # commit operation is to be performed on. If, at the time of commit, the
130 # etag for the Access Policy stored in Access Context Manager is different
131 # from the specified etag, then the commit operation will not be performed
132 # and the call will fail. This field is not required. If etag is not
133 # provided, the operation will be performed as if a valid etag is provided.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]134 }
135
136 x__xgafv: string, V1 error format.
137 Allowed values
138 1 - v1 error format
139 2 - v2 error format
140
141Returns:
142 An object of the form:
143
144 { # This resource represents a long-running operation that is the result of a
145 # network API call.
146 "metadata": { # Service-specific metadata associated with the operation. It typically
147 # contains progress information and common metadata such as create time.
148 # Some services might not provide such metadata. Any method that returns a
149 # long-running operation should document the metadata type, if any.
150 "a_key": "", # Properties of the object. Contains field @type with type URL.
151 },
152 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
153 # different programming environments, including REST APIs and RPC APIs. It is
154 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
155 # three pieces of data: error code, error message, and error details.
156 #
157 # You can find out more about this error model and how to work with it in the
158 # [API Design Guide](https://cloud.google.com/apis/design/errors).
159 "message": "A String", # A developer-facing error message, which should be in English. Any
160 # user-facing error message should be localized and sent in the
161 # google.rpc.Status.details field, or localized by the client.
162 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
163 "details": [ # A list of messages that carry the error details. There is a common set of
164 # message types for APIs to use.
165 {
166 "a_key": "", # Properties of the object. Contains field @type with type URL.
167 },
168 ],
169 },
170 "done": True or False, # If the value is `false`, it means the operation is still in progress.
171 # If `true`, the operation is completed, and either `error` or `response` is
172 # available.
173 "response": { # The normal response of the operation in case of success. If the original
174 # method returns no data on success, such as `Delete`, the response is
175 # `google.protobuf.Empty`. If the original method is standard
176 # `Get`/`Create`/`Update`, the response should be the resource. For other
177 # methods, the response should have the type `XxxResponse`, where `Xxx`
178 # is the original method name. For example, if the original method name
179 # is `TakeSnapshot()`, the inferred response type is
180 # `TakeSnapshotResponse`.
181 "a_key": "", # Properties of the object. Contains field @type with type URL.
182 },
183 "name": "A String", # The server-assigned name, which is only unique within the same service that
184 # originally returns it. If you use the default HTTP mapping, the
185 # `name` should be a resource name ending with `operations/{unique_id}`.
186 }</pre>
187</div>
188
189<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]190 <code class="details" id="create">create(parent, body=None, x__xgafv=None)</code>
191 <pre>Create a Service Perimeter. The
192longrunning operation from this RPC will have a successful status once the
193Service Perimeter has
194propagated to long-lasting storage. Service Perimeters containing
195errors will result in an error response for the first error encountered.
196
197Args:
198 parent: string, Required. Resource name for the access policy which owns this Service
199Perimeter.
200
201Format: `accessPolicies/{policy_id}` (required)
202 body: object, The request body.
203 The object takes the form of:
204
205{ # `ServicePerimeter` describes a set of Google Cloud resources which can freely
206 # import and export data amongst themselves, but not export outside of the
207 # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
208 # has a target outside of the `ServicePerimeter`, the request will be blocked.
209 # Otherwise the request is allowed. There are two types of Service Perimeter -
210 # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
211 # Google Cloud project can only belong to a single regular Service Perimeter.
212 # Service Perimeter Bridges can contain only Google Cloud projects as members,
213 # a single Google Cloud project may belong to multiple Service Perimeter
214 # Bridges.
215 "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,
216 # restricted services and access levels that determine perimeter
217 # content and boundaries.
218 # describe specific Service Perimeter configuration.
219 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
220 # restrictions. For example, if `storage.googleapis.com` is specified, access
221 # to the storage buckets inside the perimeter must meet the perimeter's
222 # access restrictions.
223 "A String",
224 ],
225 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
226 # Perimeter.
227 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
228 # APIs specified in 'allowed_services'.
229 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
230 # unless 'enable_restriction' is True.
231 "A String",
232 ],
233 },
234 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
235 # Currently only projects are allowed. Format: `projects/{project_number}`
236 "A String",
237 ],
238 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
239 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
240 # must be in the same policy as this `ServicePerimeter`. Referencing a
241 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
242 # listed, resources within the perimeter can only be accessed via Google
243 # Cloud calls with request origins within the perimeter. Example:
244 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
245 # For Service Perimeter Bridge, must be empty.
246 "A String",
247 ],
248 },
249 "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect
250 # behavior.
251 "title": "A String", # Human readable title. Must be unique within the Policy.
252 "perimeterType": "A String", # Perimeter type indicator. A single project is
253 # allowed to be a member of single regular perimeter, but multiple service
254 # perimeter bridges. A project cannot be a included in a perimeter bridge
255 # without being included in regular perimeter. For perimeter bridges,
256 # the restricted service list as well as access level lists must be
257 # empty.
258 "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
259 # exists for all Service Perimeters, and that spec is identical to the
260 # status for those Service Perimeters. When this flag is set, it inhibits the
261 # generation of the implicit spec, thereby allowing the user to explicitly
262 # provide a configuration ("spec") to use in a dry-run version of the Service
263 # Perimeter. This allows the user to test changes to the enforced config
264 # ("status") without actually enforcing them. This testing is done through
265 # analyzing the differences between currently enforced and suggested
266 # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
267 # fields in the spec are set to non-default values.
268 "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration
269 # allows to specify and test ServicePerimeter configuration without enforcing
270 # actual access restrictions. Only allowed to be set when the
271 # "use_explicit_dry_run_spec" flag is set.
272 # describe specific Service Perimeter configuration.
273 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
274 # restrictions. For example, if `storage.googleapis.com` is specified, access
275 # to the storage buckets inside the perimeter must meet the perimeter's
276 # access restrictions.
277 "A String",
278 ],
279 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
280 # Perimeter.
281 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
282 # APIs specified in 'allowed_services'.
283 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
284 # unless 'enable_restriction' is True.
285 "A String",
286 ],
287 },
288 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
289 # Currently only projects are allowed. Format: `projects/{project_number}`
290 "A String",
291 ],
292 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
293 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
294 # must be in the same policy as this `ServicePerimeter`. Referencing a
295 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
296 # listed, resources within the perimeter can only be accessed via Google
297 # Cloud calls with request origins within the perimeter. Example:
298 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
299 # For Service Perimeter Bridge, must be empty.
300 "A String",
301 ],
302 },
303 "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`
304 # component must begin with a letter and only include alphanumeric and '_'.
305 # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
306}
307
308 x__xgafv: string, V1 error format.
309 Allowed values
310 1 - v1 error format
311 2 - v2 error format
312
313Returns:
314 An object of the form:
315
316 { # This resource represents a long-running operation that is the result of a
317 # network API call.
318 "metadata": { # Service-specific metadata associated with the operation. It typically
319 # contains progress information and common metadata such as create time.
320 # Some services might not provide such metadata. Any method that returns a
321 # long-running operation should document the metadata type, if any.
322 "a_key": "", # Properties of the object. Contains field @type with type URL.
323 },
324 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
325 # different programming environments, including REST APIs and RPC APIs. It is
326 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
327 # three pieces of data: error code, error message, and error details.
328 #
329 # You can find out more about this error model and how to work with it in the
330 # [API Design Guide](https://cloud.google.com/apis/design/errors).
331 "message": "A String", # A developer-facing error message, which should be in English. Any
332 # user-facing error message should be localized and sent in the
333 # google.rpc.Status.details field, or localized by the client.
334 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
335 "details": [ # A list of messages that carry the error details. There is a common set of
336 # message types for APIs to use.
337 {
338 "a_key": "", # Properties of the object. Contains field @type with type URL.
339 },
340 ],
341 },
342 "done": True or False, # If the value is `false`, it means the operation is still in progress.
343 # If `true`, the operation is completed, and either `error` or `response` is
344 # available.
345 "response": { # The normal response of the operation in case of success. If the original
346 # method returns no data on success, such as `Delete`, the response is
347 # `google.protobuf.Empty`. If the original method is standard
348 # `Get`/`Create`/`Update`, the response should be the resource. For other
349 # methods, the response should have the type `XxxResponse`, where `Xxx`
350 # is the original method name. For example, if the original method name
351 # is `TakeSnapshot()`, the inferred response type is
352 # `TakeSnapshotResponse`.
353 "a_key": "", # Properties of the object. Contains field @type with type URL.
354 },
355 "name": "A String", # The server-assigned name, which is only unique within the same service that
356 # originally returns it. If you use the default HTTP mapping, the
357 # `name` should be a resource name ending with `operations/{unique_id}`.
358 }</pre>
359</div>
360
361<div class="method">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]362 <code class="details" id="delete">delete(name, x__xgafv=None)</code>
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]363 <pre>Delete a Service Perimeter by resource
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]364name. The longrunning operation from this RPC will have a successful status
365once the Service Perimeter has been
366removed from long-lasting storage.
367
368Args:
369 name: string, Required. Resource name for the Service Perimeter.
370
371Format:
372`accessPolicies/{policy_id}/servicePerimeters/{service_perimeter_id}` (required)
373 x__xgafv: string, V1 error format.
374 Allowed values
375 1 - v1 error format
376 2 - v2 error format
377
378Returns:
379 An object of the form:
380
381 { # This resource represents a long-running operation that is the result of a
382 # network API call.
383 "metadata": { # Service-specific metadata associated with the operation. It typically
384 # contains progress information and common metadata such as create time.
385 # Some services might not provide such metadata. Any method that returns a
386 # long-running operation should document the metadata type, if any.
387 "a_key": "", # Properties of the object. Contains field @type with type URL.
388 },
389 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
390 # different programming environments, including REST APIs and RPC APIs. It is
391 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
392 # three pieces of data: error code, error message, and error details.
393 #
394 # You can find out more about this error model and how to work with it in the
395 # [API Design Guide](https://cloud.google.com/apis/design/errors).
396 "message": "A String", # A developer-facing error message, which should be in English. Any
397 # user-facing error message should be localized and sent in the
398 # google.rpc.Status.details field, or localized by the client.
399 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
400 "details": [ # A list of messages that carry the error details. There is a common set of
401 # message types for APIs to use.
402 {
403 "a_key": "", # Properties of the object. Contains field @type with type URL.
404 },
405 ],
406 },
407 "done": True or False, # If the value is `false`, it means the operation is still in progress.
408 # If `true`, the operation is completed, and either `error` or `response` is
409 # available.
410 "response": { # The normal response of the operation in case of success. If the original
411 # method returns no data on success, such as `Delete`, the response is
412 # `google.protobuf.Empty`. If the original method is standard
413 # `Get`/`Create`/`Update`, the response should be the resource. For other
414 # methods, the response should have the type `XxxResponse`, where `Xxx`
415 # is the original method name. For example, if the original method name
416 # is `TakeSnapshot()`, the inferred response type is
417 # `TakeSnapshotResponse`.
418 "a_key": "", # Properties of the object. Contains field @type with type URL.
419 },
420 "name": "A String", # The server-assigned name, which is only unique within the same service that
421 # originally returns it. If you use the default HTTP mapping, the
422 # `name` should be a resource name ending with `operations/{unique_id}`.
423 }</pre>
424</div>
425
426<div class="method">
427 <code class="details" id="get">get(name, x__xgafv=None)</code>
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]428 <pre>Get a Service Perimeter by resource
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]429name.
430
431Args:
432 name: string, Required. Resource name for the Service Perimeter.
433
434Format:
435`accessPolicies/{policy_id}/servicePerimeters/{service_perimeters_id}` (required)
436 x__xgafv: string, V1 error format.
437 Allowed values
438 1 - v1 error format
439 2 - v2 error format
440
441Returns:
442 An object of the form:
443
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]444 { # `ServicePerimeter` describes a set of Google Cloud resources which can freely
445 # import and export data amongst themselves, but not export outside of the
446 # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
447 # has a target outside of the `ServicePerimeter`, the request will be blocked.
448 # Otherwise the request is allowed. There are two types of Service Perimeter -
449 # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
450 # Google Cloud project can only belong to a single regular Service Perimeter.
451 # Service Perimeter Bridges can contain only Google Cloud projects as members,
452 # a single Google Cloud project may belong to multiple Service Perimeter
453 # Bridges.
454 "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,
455 # restricted services and access levels that determine perimeter
456 # content and boundaries.
457 # describe specific Service Perimeter configuration.
458 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
459 # restrictions. For example, if `storage.googleapis.com` is specified, access
460 # to the storage buckets inside the perimeter must meet the perimeter's
461 # access restrictions.
462 "A String",
463 ],
464 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
465 # Perimeter.
466 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
467 # APIs specified in 'allowed_services'.
468 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
469 # unless 'enable_restriction' is True.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]470 "A String",
471 ],
472 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]473 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
474 # Currently only projects are allowed. Format: `projects/{project_number}`
475 "A String",
476 ],
477 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
478 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
479 # must be in the same policy as this `ServicePerimeter`. Referencing a
480 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
481 # listed, resources within the perimeter can only be accessed via Google
482 # Cloud calls with request origins within the perimeter. Example:
483 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
484 # For Service Perimeter Bridge, must be empty.
485 "A String",
486 ],
487 },
488 "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect
489 # behavior.
490 "title": "A String", # Human readable title. Must be unique within the Policy.
491 "perimeterType": "A String", # Perimeter type indicator. A single project is
492 # allowed to be a member of single regular perimeter, but multiple service
493 # perimeter bridges. A project cannot be a included in a perimeter bridge
494 # without being included in regular perimeter. For perimeter bridges,
495 # the restricted service list as well as access level lists must be
496 # empty.
497 "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
498 # exists for all Service Perimeters, and that spec is identical to the
499 # status for those Service Perimeters. When this flag is set, it inhibits the
500 # generation of the implicit spec, thereby allowing the user to explicitly
501 # provide a configuration ("spec") to use in a dry-run version of the Service
502 # Perimeter. This allows the user to test changes to the enforced config
503 # ("status") without actually enforcing them. This testing is done through
504 # analyzing the differences between currently enforced and suggested
505 # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
506 # fields in the spec are set to non-default values.
507 "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration
508 # allows to specify and test ServicePerimeter configuration without enforcing
509 # actual access restrictions. Only allowed to be set when the
510 # "use_explicit_dry_run_spec" flag is set.
511 # describe specific Service Perimeter configuration.
512 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
513 # restrictions. For example, if `storage.googleapis.com` is specified, access
514 # to the storage buckets inside the perimeter must meet the perimeter's
515 # access restrictions.
516 "A String",
517 ],
518 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
519 # Perimeter.
520 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
521 # APIs specified in 'allowed_services'.
522 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
523 # unless 'enable_restriction' is True.
524 "A String",
525 ],
526 },
527 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
528 # Currently only projects are allowed. Format: `projects/{project_number}`
529 "A String",
530 ],
531 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
532 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
533 # must be in the same policy as this `ServicePerimeter`. Referencing a
534 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
535 # listed, resources within the perimeter can only be accessed via Google
536 # Cloud calls with request origins within the perimeter. Example:
537 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
538 # For Service Perimeter Bridge, must be empty.
539 "A String",
540 ],
541 },
542 "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`
543 # component must begin with a letter and only include alphanumeric and '_'.
544 # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
545 }</pre>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]546</div>
547
548<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]549 <code class="details" id="list">list(parent, pageSize=None, pageToken=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]550 <pre>List all Service Perimeters for an
551access policy.
552
553Args:
554 parent: string, Required. Resource name for the access policy to list Service Perimeters from.
555
556Format:
557`accessPolicies/{policy_id}` (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]558 pageSize: integer, Number of Service Perimeters to include
559in the list. Default 100.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]560 pageToken: string, Next page token for the next batch of Service Perimeter instances.
561Defaults to the first page of results.
562 x__xgafv: string, V1 error format.
563 Allowed values
564 1 - v1 error format
565 2 - v2 error format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]566
567Returns:
568 An object of the form:
569
570 { # A response to `ListServicePerimetersRequest`.
571 "nextPageToken": "A String", # The pagination token to retrieve the next page of results. If the value is
572 # empty, no further results remain.
573 "servicePerimeters": [ # List of the Service Perimeter instances.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]574 { # `ServicePerimeter` describes a set of Google Cloud resources which can freely
575 # import and export data amongst themselves, but not export outside of the
576 # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
577 # has a target outside of the `ServicePerimeter`, the request will be blocked.
578 # Otherwise the request is allowed. There are two types of Service Perimeter -
579 # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
580 # Google Cloud project can only belong to a single regular Service Perimeter.
581 # Service Perimeter Bridges can contain only Google Cloud projects as members,
582 # a single Google Cloud project may belong to multiple Service Perimeter
583 # Bridges.
584 "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,
585 # restricted services and access levels that determine perimeter
586 # content and boundaries.
587 # describe specific Service Perimeter configuration.
588 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
589 # restrictions. For example, if `storage.googleapis.com` is specified, access
590 # to the storage buckets inside the perimeter must meet the perimeter's
591 # access restrictions.
592 "A String",
593 ],
594 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
595 # Perimeter.
596 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
597 # APIs specified in 'allowed_services'.
598 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
599 # unless 'enable_restriction' is True.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]600 "A String",
601 ],
602 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]603 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
604 # Currently only projects are allowed. Format: `projects/{project_number}`
605 "A String",
606 ],
607 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
608 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
609 # must be in the same policy as this `ServicePerimeter`. Referencing a
610 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
611 # listed, resources within the perimeter can only be accessed via Google
612 # Cloud calls with request origins within the perimeter. Example:
613 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
614 # For Service Perimeter Bridge, must be empty.
615 "A String",
616 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]617 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]618 "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect
619 # behavior.
620 "title": "A String", # Human readable title. Must be unique within the Policy.
621 "perimeterType": "A String", # Perimeter type indicator. A single project is
622 # allowed to be a member of single regular perimeter, but multiple service
623 # perimeter bridges. A project cannot be a included in a perimeter bridge
624 # without being included in regular perimeter. For perimeter bridges,
625 # the restricted service list as well as access level lists must be
626 # empty.
627 "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
628 # exists for all Service Perimeters, and that spec is identical to the
629 # status for those Service Perimeters. When this flag is set, it inhibits the
630 # generation of the implicit spec, thereby allowing the user to explicitly
631 # provide a configuration ("spec") to use in a dry-run version of the Service
632 # Perimeter. This allows the user to test changes to the enforced config
633 # ("status") without actually enforcing them. This testing is done through
634 # analyzing the differences between currently enforced and suggested
635 # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
636 # fields in the spec are set to non-default values.
637 "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration
638 # allows to specify and test ServicePerimeter configuration without enforcing
639 # actual access restrictions. Only allowed to be set when the
640 # "use_explicit_dry_run_spec" flag is set.
641 # describe specific Service Perimeter configuration.
642 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
643 # restrictions. For example, if `storage.googleapis.com` is specified, access
644 # to the storage buckets inside the perimeter must meet the perimeter's
645 # access restrictions.
646 "A String",
647 ],
648 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
649 # Perimeter.
650 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
651 # APIs specified in 'allowed_services'.
652 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
653 # unless 'enable_restriction' is True.
654 "A String",
655 ],
656 },
657 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
658 # Currently only projects are allowed. Format: `projects/{project_number}`
659 "A String",
660 ],
661 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
662 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
663 # must be in the same policy as this `ServicePerimeter`. Referencing a
664 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
665 # listed, resources within the perimeter can only be accessed via Google
666 # Cloud calls with request origins within the perimeter. Example:
667 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
668 # For Service Perimeter Bridge, must be empty.
669 "A String",
670 ],
671 },
672 "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`
673 # component must begin with a letter and only include alphanumeric and '_'.
674 # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
675 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]676 ],
677 }</pre>
678</div>
679
680<div class="method">
681 <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
682 <pre>Retrieves the next page of results.
683
684Args:
685 previous_request: The request for the previous page. (required)
686 previous_response: The response from the request for the previous page. (required)
687
688Returns:
689 A request object that you can call 'execute()' on to request the next
690 page. Returns None if there are no more items in the collection.
691 </pre>
692</div>
693
694<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]695 <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
696 <pre>Update a Service Perimeter. The
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]697longrunning operation from this RPC will have a successful status once the
698changes to the Service Perimeter have
699propagated to long-lasting storage. Service Perimeter containing
700errors will result in an error response for the first error encountered.
701
702Args:
703 name: string, Required. Resource name for the ServicePerimeter. The `short_name`
704component must begin with a letter and only include alphanumeric and '_'.
705Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}` (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]706 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]707 The object takes the form of:
708
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]709{ # `ServicePerimeter` describes a set of Google Cloud resources which can freely
710 # import and export data amongst themselves, but not export outside of the
711 # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
712 # has a target outside of the `ServicePerimeter`, the request will be blocked.
713 # Otherwise the request is allowed. There are two types of Service Perimeter -
714 # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
715 # Google Cloud project can only belong to a single regular Service Perimeter.
716 # Service Perimeter Bridges can contain only Google Cloud projects as members,
717 # a single Google Cloud project may belong to multiple Service Perimeter
718 # Bridges.
719 "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,
720 # restricted services and access levels that determine perimeter
721 # content and boundaries.
722 # describe specific Service Perimeter configuration.
723 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
724 # restrictions. For example, if `storage.googleapis.com` is specified, access
725 # to the storage buckets inside the perimeter must meet the perimeter's
726 # access restrictions.
727 "A String",
728 ],
729 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
730 # Perimeter.
731 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
732 # APIs specified in 'allowed_services'.
733 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
734 # unless 'enable_restriction' is True.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]735 "A String",
736 ],
737 },
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]738 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
739 # Currently only projects are allowed. Format: `projects/{project_number}`
740 "A String",
741 ],
742 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
743 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
744 # must be in the same policy as this `ServicePerimeter`. Referencing a
745 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
746 # listed, resources within the perimeter can only be accessed via Google
747 # Cloud calls with request origins within the perimeter. Example:
748 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
749 # For Service Perimeter Bridge, must be empty.
750 "A String",
751 ],
752 },
753 "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect
754 # behavior.
755 "title": "A String", # Human readable title. Must be unique within the Policy.
756 "perimeterType": "A String", # Perimeter type indicator. A single project is
757 # allowed to be a member of single regular perimeter, but multiple service
758 # perimeter bridges. A project cannot be a included in a perimeter bridge
759 # without being included in regular perimeter. For perimeter bridges,
760 # the restricted service list as well as access level lists must be
761 # empty.
762 "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
763 # exists for all Service Perimeters, and that spec is identical to the
764 # status for those Service Perimeters. When this flag is set, it inhibits the
765 # generation of the implicit spec, thereby allowing the user to explicitly
766 # provide a configuration ("spec") to use in a dry-run version of the Service
767 # Perimeter. This allows the user to test changes to the enforced config
768 # ("status") without actually enforcing them. This testing is done through
769 # analyzing the differences between currently enforced and suggested
770 # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
771 # fields in the spec are set to non-default values.
772 "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration
773 # allows to specify and test ServicePerimeter configuration without enforcing
774 # actual access restrictions. Only allowed to be set when the
775 # "use_explicit_dry_run_spec" flag is set.
776 # describe specific Service Perimeter configuration.
777 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
778 # restrictions. For example, if `storage.googleapis.com` is specified, access
779 # to the storage buckets inside the perimeter must meet the perimeter's
780 # access restrictions.
781 "A String",
782 ],
783 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
784 # Perimeter.
785 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
786 # APIs specified in 'allowed_services'.
787 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
788 # unless 'enable_restriction' is True.
789 "A String",
790 ],
791 },
792 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
793 # Currently only projects are allowed. Format: `projects/{project_number}`
794 "A String",
795 ],
796 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
797 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
798 # must be in the same policy as this `ServicePerimeter`. Referencing a
799 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
800 # listed, resources within the perimeter can only be accessed via Google
801 # Cloud calls with request origins within the perimeter. Example:
802 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
803 # For Service Perimeter Bridge, must be empty.
804 "A String",
805 ],
806 },
807 "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`
808 # component must begin with a letter and only include alphanumeric and '_'.
809 # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
810}
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]811
812 updateMask: string, Required. Mask to control which fields get updated. Must be non-empty.
813 x__xgafv: string, V1 error format.
814 Allowed values
815 1 - v1 error format
816 2 - v2 error format
817
818Returns:
819 An object of the form:
820
821 { # This resource represents a long-running operation that is the result of a
822 # network API call.
823 "metadata": { # Service-specific metadata associated with the operation. It typically
824 # contains progress information and common metadata such as create time.
825 # Some services might not provide such metadata. Any method that returns a
826 # long-running operation should document the metadata type, if any.
827 "a_key": "", # Properties of the object. Contains field @type with type URL.
828 },
829 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
830 # different programming environments, including REST APIs and RPC APIs. It is
831 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
832 # three pieces of data: error code, error message, and error details.
833 #
834 # You can find out more about this error model and how to work with it in the
835 # [API Design Guide](https://cloud.google.com/apis/design/errors).
836 "message": "A String", # A developer-facing error message, which should be in English. Any
837 # user-facing error message should be localized and sent in the
838 # google.rpc.Status.details field, or localized by the client.
839 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
840 "details": [ # A list of messages that carry the error details. There is a common set of
841 # message types for APIs to use.
842 {
843 "a_key": "", # Properties of the object. Contains field @type with type URL.
844 },
845 ],
846 },
847 "done": True or False, # If the value is `false`, it means the operation is still in progress.
848 # If `true`, the operation is completed, and either `error` or `response` is
849 # available.
850 "response": { # The normal response of the operation in case of success. If the original
851 # method returns no data on success, such as `Delete`, the response is
852 # `google.protobuf.Empty`. If the original method is standard
853 # `Get`/`Create`/`Update`, the response should be the resource. For other
854 # methods, the response should have the type `XxxResponse`, where `Xxx`
855 # is the original method name. For example, if the original method name
856 # is `TakeSnapshot()`, the inferred response type is
857 # `TakeSnapshotResponse`.
858 "a_key": "", # Properties of the object. Contains field @type with type URL.
859 },
860 "name": "A String", # The server-assigned name, which is only unique within the same service that
861 # originally returns it. If you use the default HTTP mapping, the
862 # `name` should be a resource name ending with `operations/{unique_id}`.
863 }</pre>
864</div>
865
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]866<div class="method">
867 <code class="details" id="replaceAll">replaceAll(parent, body=None, x__xgafv=None)</code>
868 <pre>Replace all existing Service Perimeters in an
869Access Policy
870with the Service Perimeters provided.
871This is done atomically. The longrunning operation from this
872RPC will have a successful status once all replacements have propagated to
873long-lasting storage. Replacements containing errors will result in an
874error response for the first error encountered. Replacement will be
875cancelled on error, existing Service Perimeters will not be
876affected. Operation.response field will contain
877ReplaceServicePerimetersResponse.
878
879Args:
880 parent: string, Required. Resource name for the access policy which owns these
881Service Perimeters.
882
883Format: `accessPolicies/{policy_id}` (required)
884 body: object, The request body.
885 The object takes the form of:
886
887{ # A request to replace all existing Service Perimeters in an Access Policy
888 # with the Service Perimeters provided. This is done atomically.
889 "etag": "A String", # Optional. The etag for the version of the Access Policy that this
890 # replace operation is to be performed on. If, at the time of replace, the
891 # etag for the Access Policy stored in Access Context Manager is different
892 # from the specified etag, then the replace operation will not be performed
893 # and the call will fail. This field is not required. If etag is not
894 # provided, the operation will be performed as if a valid etag is provided.
895 "servicePerimeters": [ # Required. The desired Service Perimeters that should
896 # replace all existing Service Perimeters in the
897 # Access Policy.
898 { # `ServicePerimeter` describes a set of Google Cloud resources which can freely
899 # import and export data amongst themselves, but not export outside of the
900 # `ServicePerimeter`. If a request with a source within this `ServicePerimeter`
901 # has a target outside of the `ServicePerimeter`, the request will be blocked.
902 # Otherwise the request is allowed. There are two types of Service Perimeter -
903 # Regular and Bridge. Regular Service Perimeters cannot overlap, a single
904 # Google Cloud project can only belong to a single regular Service Perimeter.
905 # Service Perimeter Bridges can contain only Google Cloud projects as members,
906 # a single Google Cloud project may belong to multiple Service Perimeter
907 # Bridges.
908 "status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,
909 # restricted services and access levels that determine perimeter
910 # content and boundaries.
911 # describe specific Service Perimeter configuration.
912 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
913 # restrictions. For example, if `storage.googleapis.com` is specified, access
914 # to the storage buckets inside the perimeter must meet the perimeter's
915 # access restrictions.
916 "A String",
917 ],
918 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
919 # Perimeter.
920 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
921 # APIs specified in 'allowed_services'.
922 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
923 # unless 'enable_restriction' is True.
924 "A String",
925 ],
926 },
927 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
928 # Currently only projects are allowed. Format: `projects/{project_number}`
929 "A String",
930 ],
931 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
932 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
933 # must be in the same policy as this `ServicePerimeter`. Referencing a
934 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
935 # listed, resources within the perimeter can only be accessed via Google
936 # Cloud calls with request origins within the perimeter. Example:
937 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
938 # For Service Perimeter Bridge, must be empty.
939 "A String",
940 ],
941 },
942 "description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect
943 # behavior.
944 "title": "A String", # Human readable title. Must be unique within the Policy.
945 "perimeterType": "A String", # Perimeter type indicator. A single project is
946 # allowed to be a member of single regular perimeter, but multiple service
947 # perimeter bridges. A project cannot be a included in a perimeter bridge
948 # without being included in regular perimeter. For perimeter bridges,
949 # the restricted service list as well as access level lists must be
950 # empty.
951 "useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
952 # exists for all Service Perimeters, and that spec is identical to the
953 # status for those Service Perimeters. When this flag is set, it inhibits the
954 # generation of the implicit spec, thereby allowing the user to explicitly
955 # provide a configuration ("spec") to use in a dry-run version of the Service
956 # Perimeter. This allows the user to test changes to the enforced config
957 # ("status") without actually enforcing them. This testing is done through
958 # analyzing the differences between currently enforced and suggested
959 # restrictions. use_explicit_dry_run_spec must bet set to True if any of the
960 # fields in the spec are set to non-default values.
961 "spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration
962 # allows to specify and test ServicePerimeter configuration without enforcing
963 # actual access restrictions. Only allowed to be set when the
964 # "use_explicit_dry_run_spec" flag is set.
965 # describe specific Service Perimeter configuration.
966 "restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter
967 # restrictions. For example, if `storage.googleapis.com` is specified, access
968 # to the storage buckets inside the perimeter must meet the perimeter's
969 # access restrictions.
970 "A String",
971 ],
972 "vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.
973 # Perimeter.
974 "enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of
975 # APIs specified in 'allowed_services'.
976 "allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty
977 # unless 'enable_restriction' is True.
978 "A String",
979 ],
980 },
981 "resources": [ # A list of Google Cloud resources that are inside of the service perimeter.
982 # Currently only projects are allowed. Format: `projects/{project_number}`
983 "A String",
984 ],
985 "accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the
986 # `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
987 # must be in the same policy as this `ServicePerimeter`. Referencing a
988 # nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
989 # listed, resources within the perimeter can only be accessed via Google
990 # Cloud calls with request origins within the perimeter. Example:
991 # `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
992 # For Service Perimeter Bridge, must be empty.
993 "A String",
994 ],
995 },
996 "name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`
997 # component must begin with a letter and only include alphanumeric and '_'.
998 # Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
999 },
1000 ],
1001 }
1002
1003 x__xgafv: string, V1 error format.
1004 Allowed values
1005 1 - v1 error format
1006 2 - v2 error format
1007
1008Returns:
1009 An object of the form:
1010
1011 { # This resource represents a long-running operation that is the result of a
1012 # network API call.
1013 "metadata": { # Service-specific metadata associated with the operation. It typically
1014 # contains progress information and common metadata such as create time.
1015 # Some services might not provide such metadata. Any method that returns a
1016 # long-running operation should document the metadata type, if any.
1017 "a_key": "", # Properties of the object. Contains field @type with type URL.
1018 },
1019 "error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.
1020 # different programming environments, including REST APIs and RPC APIs. It is
1021 # used by [gRPC](https://github.com/grpc). Each `Status` message contains
1022 # three pieces of data: error code, error message, and error details.
1023 #
1024 # You can find out more about this error model and how to work with it in the
1025 # [API Design Guide](https://cloud.google.com/apis/design/errors).
1026 "message": "A String", # A developer-facing error message, which should be in English. Any
1027 # user-facing error message should be localized and sent in the
1028 # google.rpc.Status.details field, or localized by the client.
1029 "code": 42, # The status code, which should be an enum value of google.rpc.Code.
1030 "details": [ # A list of messages that carry the error details. There is a common set of
1031 # message types for APIs to use.
1032 {
1033 "a_key": "", # Properties of the object. Contains field @type with type URL.
1034 },
1035 ],
1036 },
1037 "done": True or False, # If the value is `false`, it means the operation is still in progress.
1038 # If `true`, the operation is completed, and either `error` or `response` is
1039 # available.
1040 "response": { # The normal response of the operation in case of success. If the original
1041 # method returns no data on success, such as `Delete`, the response is
1042 # `google.protobuf.Empty`. If the original method is standard
1043 # `Get`/`Create`/`Update`, the response should be the resource. For other
1044 # methods, the response should have the type `XxxResponse`, where `Xxx`
1045 # is the original method name. For example, if the original method name
1046 # is `TakeSnapshot()`, the inferred response type is
1047 # `TakeSnapshotResponse`.
1048 "a_key": "", # Properties of the object. Contains field @type with type URL.
1049 },
1050 "name": "A String", # The server-assigned name, which is only unique within the same service that
1051 # originally returns it. If you use the default HTTP mapping, the
1052 # `name` should be a resource name ending with `operations/{unique_id}`.
1053 }</pre>
1054</div>
1055
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1056</body></html>