Blame - docs/dyn/cloudasset_v1.v1.html - platform/external/python/google-api-python-client

<code><a href="#batchGetAssetsHistory">batchGetAssetsHistory(parent, contentType=None, assetNames=None, readTimeWindow_startTime=None, readTimeWindow_endTime=None, x__xgafv=None)</a></code></p>

79

<p class="firstline">Batch gets the update history of assets that overlap a time window.</p>

80

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

81

<code><a href="#exportAssets">exportAssets(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

82

<p class="firstline">Exports assets with time and resource types to a given Cloud Storage</p>

83

<h3>Method Details</h3>

84

85

<code class="details" id="batchGetAssetsHistory">batchGetAssetsHistory(parent, contentType=None, assetNames=None, readTimeWindow_startTime=None, readTimeWindow_endTime=None, x__xgafv=None)</code>

86

<pre>Batch gets the update history of assets that overlap a time window.

87

For RESOURCE content, this API outputs history with asset in both

88

non-delete or deleted status.

89

For IAM_POLICY content, this API outputs history when the asset and its

90

attached IAM POLICY both exist. This can create gaps in the output history.

91

If a specified asset does not exist, this API returns an INVALID_ARGUMENT

error.

Args:

parent: string, Required. The relative name of the root asset. It can only be an

96

organization number (such as "organizations/123"), a project ID (such as

97

"projects/my-project-id")", or a project number (such as "projects/12345"). (required)

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

98

contentType: string, Optional. The content type.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

99

assetNames: string, A list of the full names of the assets. For example:

100

`//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.

101

See [Resource

102

Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)

103

and [Resource Name

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

104

Format](https://cloud.google.com/asset-inventory/docs/resource-name-format)

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

105

for more info.

106

107

The request becomes a no-op if the asset name list is empty, and the max

108

size of the asset name list is 100 in one request. (repeated)

109

readTimeWindow_startTime: string, Start time of the time window (exclusive).

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

110

readTimeWindow_endTime: string, End time of the time window (inclusive). If not specified, the current

111

timestamp is used instead.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

112

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

119

120

{ # Batch get assets history response.

121

"assets": [ # A list of assets with valid time windows.

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

122

{ # An asset in Google Cloud and its temporal metadata, including the time window

123

# when it was observed and its status during that window.

124

"deleted": True or False, # Whether the asset has been deleted or not.

125

"window": { # A time window specified by its "start_time" and "end_time". # The time window when the asset data and state was observed.

126

"endTime": "A String", # End time of the time window (inclusive). If not specified, the current

127

# timestamp is used instead.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

128

"startTime": "A String", # Start time of the time window (exclusive).

129

},

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

130

"asset": { # An asset in Google Cloud. An asset can be any resource in the Google Cloud # An asset in Google Cloud.

131

# [resource

132

# hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy),

133

# a resource outside the Google Cloud resource hierarchy (such as Google

134

# Kubernetes Engine clusters and objects), or a Cloud IAM policy.

135

"assetType": "A String", # The type of the asset. For example: "compute.googleapis.com/Disk"

136

#

137

# See [Supported asset

138

# types](https://cloud.google.com/asset-inventory/docs/supported-asset-types)

139

# for more information.

140

"ancestors": [ # The ancestry path of an asset in Google Cloud [resource

141

# hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy),

142

# represented as a list of relative resource names. An ancestry path starts

143

# with the closest ancestor in the hierarchy and ends at root. If the asset

144

# is a project, folder, or organization, the ancestry path starts from the

145

# asset itself.

146

#

147

# For example: `["projects/123456789", "folders/5432", "organizations/1234"]`

148

"A String",

149

],

150

"resource": { # A representation of a Google Cloud resource. # A representation of the resource.

151

"resourceUrl": "A String", # The REST URL for accessing the resource. An HTTP `GET` request using this

152

# URL returns the resource itself. For example:

153

# "https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123"

154

#

155

# This value is unspecified for resources without a REST API.

156

"parent": "A String", # The full name of the immediate parent of this resource. See

157

# [Resource

158

# Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)

159

# for more information.

160

#

161

# For Google Cloud assets, this value is the parent resource defined in the

162

# [Cloud IAM policy

163

# hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy).

164

# For example:

165

# "//cloudresourcemanager.googleapis.com/projects/my_project_123"

166

#

167

# For third-party assets, this field may be set differently.

168

"discoveryDocumentUri": "A String", # The URL of the discovery document containing the resource's JSON schema.

169

# For example:

170

# "https://www.googleapis.com/discovery/v1/apis/compute/v1/rest"

171

#

172

# This value is unspecified for resources that do not have an API based on a

173

# discovery document, such as Cloud Bigtable.

174

"discoveryName": "A String", # The JSON schema name listed in the discovery document. For example:

175

# "Project"

176

#

177

# This value is unspecified for resources that do not have an API based on a

178

# discovery document, such as Cloud Bigtable.

179

"version": "A String", # The API version. For example: "v1"

180

"data": { # The content of the resource, in which some sensitive fields are removed

181

# and may not be present.

182

"a_key": "", # Properties of the object.

183

},

184

},

185

"name": "A String", # The full name of the asset. For example:

186

# "//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1"

187

#

188

# See [Resource

189

# names](https://cloud.google.com/apis/design/resource_names#full_resource_name)

190

# for more information.

191

"orgPolicy": [ # A representation of an [organization

192

# policy](https://cloud.google.com/resource-manager/docs/organization-policy/overview#organization_policy).

193

# There can be more than one organization policy with different constraints

194

# set on a given resource.

195

{ # Defines a Cloud Organization `Policy` which is used to specify `Constraints`

196

# for configurations of Cloud Platform resources.

197

"updateTime": "A String", # The time stamp the `Policy` was previously updated. This is set by the

198

# server, not specified by the caller, and represents the last time a call to

199

# `SetOrgPolicy` was made for that `Policy`. Any value set by the client will

200

# be ignored.

201

"version": 42, # Version of the `Policy`. Default version is 0;

202

"constraint": "A String", # The name of the `Constraint` the `Policy` is configuring, for example,

203

# `constraints/serviceuser.services`.

204

#

205

# Immutable after creation.

206

"restoreDefault": { # Ignores policies set above this resource and restores the # Restores the default behavior of the constraint; independent of

207

# `Constraint` type.

208

# `constraint_default` enforcement behavior of the specific `Constraint` at

209

# this resource.

210

#

211

# Suppose that `constraint_default` is set to `ALLOW` for the

212

# `Constraint` `constraints/serviceuser.services`. Suppose that organization

213

# foo.com sets a `Policy` at their Organization resource node that restricts

214

# the allowed service activations to deny all service activations. They

215

# could then set a `Policy` with the `policy_type` `restore_default` on

216

# several experimental projects, restoring the `constraint_default`

217

# enforcement of the `Constraint` for only those projects, allowing those

218

# projects to have all services activated.

219

},

220

"listPolicy": { # Used in `policy_type` to specify how `list_policy` behaves at this # List of values either allowed or disallowed.

221

# resource.

222

#

223

# `ListPolicy` can define specific values and subtrees of Cloud Resource

224

# Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that

225

# are allowed or denied by setting the `allowed_values` and `denied_values`

226

# fields. This is achieved by using the `under:` and optional `is:` prefixes.

227

# The `under:` prefix is used to denote resource subtree values.

228

# The `is:` prefix is used to denote specific values, and is required only

229

# if the value contains a ":". Values prefixed with "is:" are treated the

230

# same as values with no prefix.

231

# Ancestry subtrees must be in one of the following formats:

232

# - "projects/<project-id>", e.g. "projects/tokyo-rain-123"

233

# - "folders/<folder-id>", e.g. "folders/1234"

234

# - "organizations/<organization-id>", e.g. "organizations/1234"

235

# The `supports_under` field of the associated `Constraint` defines whether

236

# ancestry prefixes can be used. You can set `allowed_values` and

237

# `denied_values` in the same `Policy` if `all_values` is

238

# `ALL_VALUES_UNSPECIFIED`. `ALLOW` or `DENY` are used to allow or deny all

239

# values. If `all_values` is set to either `ALLOW` or `DENY`,

240

# `allowed_values` and `denied_values` must be unset.

241

"allValues": "A String", # The policy all_values state.

242

"allowedValues": [ # List of values allowed at this resource. Can only be set if `all_values`

243

# is set to `ALL_VALUES_UNSPECIFIED`.

244

"A String",

245

],

246

"inheritFromParent": True or False, # Determines the inheritance behavior for this `Policy`.

247

#

248

# By default, a `ListPolicy` set at a resource supercedes any `Policy` set

249

# anywhere up the resource hierarchy. However, if `inherit_from_parent` is

250

# set to `true`, then the values from the effective `Policy` of the parent

251

# resource are inherited, meaning the values set in this `Policy` are

252

# added to the values inherited up the hierarchy.

253

#

254

# Setting `Policy` hierarchies that inherit both allowed values and denied

255

# values isn't recommended in most circumstances to keep the configuration

256

# simple and understandable. However, it is possible to set a `Policy` with

257

# `allowed_values` set that inherits a `Policy` with `denied_values` set.

258

# In this case, the values that are allowed must be in `allowed_values` and

259

# not present in `denied_values`.

260

#

261

# For example, suppose you have a `Constraint`

262

# `constraints/serviceuser.services`, which has a `constraint_type` of

263

# `list_constraint`, and with `constraint_default` set to `ALLOW`.

264

# Suppose that at the Organization level, a `Policy` is applied that

265

# restricts the allowed API activations to {`E1`, `E2`}. Then, if a

266

# `Policy` is applied to a project below the Organization that has

267

# `inherit_from_parent` set to `false` and field all_values set to DENY,

268

# then an attempt to activate any API will be denied.

269

#

270

# The following examples demonstrate different possible layerings for

271

# `projects/bar` parented by `organizations/foo`:

272

#

273

# Example 1 (no inherited values):

274

# `organizations/foo` has a `Policy` with values:

275

# {allowed_values: "E1" allowed_values:"E2"}

276

# `projects/bar` has `inherit_from_parent` `false` and values:

277

# {allowed_values: "E3" allowed_values: "E4"}

278

# The accepted values at `organizations/foo` are `E1`, `E2`.

279

# The accepted values at `projects/bar` are `E3`, and `E4`.

280

#

281

# Example 2 (inherited values):

282

# `organizations/foo` has a `Policy` with values:

283

# {allowed_values: "E1" allowed_values:"E2"}

284

# `projects/bar` has a `Policy` with values:

285

# {value: "E3" value: "E4" inherit_from_parent: true}

286

# The accepted values at `organizations/foo` are `E1`, `E2`.

287

# The accepted values at `projects/bar` are `E1`, `E2`, `E3`, and `E4`.

288

#

289

# Example 3 (inheriting both allowed and denied values):

290

# `organizations/foo` has a `Policy` with values:

291

# {allowed_values: "E1" allowed_values: "E2"}

292

# `projects/bar` has a `Policy` with:

293

# {denied_values: "E1"}

294

# The accepted values at `organizations/foo` are `E1`, `E2`.

295

# The value accepted at `projects/bar` is `E2`.

296

#

297

# Example 4 (RestoreDefault):

298

# `organizations/foo` has a `Policy` with values:

299

# {allowed_values: "E1" allowed_values:"E2"}

300

# `projects/bar` has a `Policy` with values:

301

# {RestoreDefault: {}}

302

# The accepted values at `organizations/foo` are `E1`, `E2`.

303

# The accepted values at `projects/bar` are either all or none depending on

304

# the value of `constraint_default` (if `ALLOW`, all; if

305

# `DENY`, none).

306

#

307

# Example 5 (no policy inherits parent policy):

308

# `organizations/foo` has no `Policy` set.

309

# `projects/bar` has no `Policy` set.

310

# The accepted values at both levels are either all or none depending on

311

# the value of `constraint_default` (if `ALLOW`, all; if

312

# `DENY`, none).

313

#

314

# Example 6 (ListConstraint allowing all):

315

# `organizations/foo` has a `Policy` with values:

316

# {allowed_values: "E1" allowed_values: "E2"}

317

# `projects/bar` has a `Policy` with:

318

# {all: ALLOW}

319

# The accepted values at `organizations/foo` are `E1`, E2`.

320

# Any value is accepted at `projects/bar`.

321

#

322

# Example 7 (ListConstraint allowing none):

323

# `organizations/foo` has a `Policy` with values:

324

# {allowed_values: "E1" allowed_values: "E2"}

325

# `projects/bar` has a `Policy` with:

326

# {all: DENY}

327

# The accepted values at `organizations/foo` are `E1`, E2`.

328

# No value is accepted at `projects/bar`.

329

#

330

# Example 10 (allowed and denied subtrees of Resource Manager hierarchy):

331

# Given the following resource hierarchy

332

# O1->{F1, F2}; F1->{P1}; F2->{P2, P3},

333

# `organizations/foo` has a `Policy` with values:

334

# {allowed_values: "under:organizations/O1"}

335

# `projects/bar` has a `Policy` with:

336

# {allowed_values: "under:projects/P3"}

337

# {denied_values: "under:folders/F2"}

338

# The accepted values at `organizations/foo` are `organizations/O1`,

339

# `folders/F1`, `folders/F2`, `projects/P1`, `projects/P2`,

340

# `projects/P3`.

341

# The accepted values at `projects/bar` are `organizations/O1`,

342

# `folders/F1`, `projects/P1`.

343

"suggestedValue": "A String", # Optional. The Google Cloud Console will try to default to a configuration

344

# that matches the value specified in this `Policy`. If `suggested_value`

345

# is not set, it will inherit the value specified higher in the hierarchy,

346

# unless `inherit_from_parent` is `false`.

347

"deniedValues": [ # List of values denied at this resource. Can only be set if `all_values`

348

# is set to `ALL_VALUES_UNSPECIFIED`.

"A String",

],

},

"booleanPolicy": { # Used in `policy_type` to specify how `boolean_policy` will behave at this # For boolean `Constraints`, whether to enforce the `Constraint` or not.

353

# resource.

354

"enforced": True or False, # If `true`, then the `Policy` is enforced. If `false`, then any

355

# configuration is acceptable.

356

#

357

# Suppose you have a `Constraint`

358

# `constraints/compute.disableSerialPortAccess` with `constraint_default`

359

# set to `ALLOW`. A `Policy` for that `Constraint` exhibits the following

360

# behavior:

361

# - If the `Policy` at this resource has enforced set to `false`, serial

362

# port connection attempts will be allowed.

363

# - If the `Policy` at this resource has enforced set to `true`, serial

364

# port connection attempts will be refused.

365

# - If the `Policy` at this resource is `RestoreDefault`, serial port

366

# connection attempts will be allowed.

367

# - If no `Policy` is set at this resource or anywhere higher in the

368

# resource hierarchy, serial port connection attempts will be allowed.

369

# - If no `Policy` is set at this resource, but one exists higher in the

370

# resource hierarchy, the behavior is as if the`Policy` were set at

371

# this resource.

372

#

373

# The following examples demonstrate the different possible layerings:

374

#

375

# Example 1 (nearest `Constraint` wins):

376

# `organizations/foo` has a `Policy` with:

377

# {enforced: false}

378

# `projects/bar` has no `Policy` set.

379

# The constraint at `projects/bar` and `organizations/foo` will not be

380

# enforced.

381

#

382

# Example 2 (enforcement gets replaced):

383

# `organizations/foo` has a `Policy` with:

384

# {enforced: false}

385

# `projects/bar` has a `Policy` with:

386

# {enforced: true}

387

# The constraint at `organizations/foo` is not enforced.

388

# The constraint at `projects/bar` is enforced.

389

#

390

# Example 3 (RestoreDefault):

391

# `organizations/foo` has a `Policy` with:

392

# {enforced: true}

393

# `projects/bar` has a `Policy` with:

394

# {RestoreDefault: {}}

395

# The constraint at `organizations/foo` is enforced.

396

# The constraint at `projects/bar` is not enforced, because

397

# `constraint_default` for the `Constraint` is `ALLOW`.

398

},

399

"etag": "A String", # An opaque tag indicating the current version of the `Policy`, used for

400

# concurrency control.

401

#

402

# When the `Policy` is returned from either a `GetPolicy` or a

403

# `ListOrgPolicy` request, this `etag` indicates the version of the current

404

# `Policy` to use when executing a read-modify-write loop.

405

#

406

# When the `Policy` is returned from a `GetEffectivePolicy` request, the

407

# `etag` will be unset.

408

#

409

# When the `Policy` is used in a `SetOrgPolicy` method, use the `etag` value

410

# that was returned from a `GetOrgPolicy` request as part of a

411

# read-modify-write loop for concurrency control. Not setting the `etag`in a

412

# `SetOrgPolicy` request will result in an unconditional write of the

# `Policy`.

},

],

"accessPolicy": { # `AccessPolicy` is a container for `AccessLevels` (which define the necessary

417

# attributes to use Google Cloud services) and `ServicePerimeters` (which

418

# define regions of services able to freely pass data within a perimeter). An

419

# access policy is globally visible within an organization, and the

420

# restrictions it specifies apply to all projects within an organization.

421

"etag": "A String", # Output only. An opaque identifier for the current version of the

422

# `AccessPolicy`. This will always be a strongly validated etag, meaning that

423

# two Access Polices will be identical if and only if their etags are

424

# identical. Clients should not expect this to be in any specific format.

425

"name": "A String", # Output only. Resource name of the `AccessPolicy`. Format:

426

# `accessPolicies/{policy_id}`

427

"parent": "A String", # Required. The parent of this `AccessPolicy` in the Cloud Resource

428

# Hierarchy. Currently immutable once created. Format:

429

# `organizations/{organization_id}`

430

"title": "A String", # Required. Human readable title. Does not affect behavior.

431

},

432

"servicePerimeter": { # `ServicePerimeter` describes a set of Google Cloud resources which can freely

433

# import and export data amongst themselves, but not export outside of the

434

# `ServicePerimeter`. If a request with a source within this `ServicePerimeter`

435

# has a target outside of the `ServicePerimeter`, the request will be blocked.

436

# Otherwise the request is allowed. There are two types of Service Perimeter -

437

# Regular and Bridge. Regular Service Perimeters cannot overlap, a single

438

# Google Cloud project can only belong to a single regular Service Perimeter.

439

# Service Perimeter Bridges can contain only Google Cloud projects as members,

440

# a single Google Cloud project may belong to multiple Service Perimeter

441

# Bridges.

442

"status": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Current ServicePerimeter configuration. Specifies sets of resources,

443

# restricted services and access levels that determine perimeter

444

# content and boundaries.

445

# describe specific Service Perimeter configuration.

446

"restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter

447

# restrictions. For example, if `storage.googleapis.com` is specified, access

448

# to the storage buckets inside the perimeter must meet the perimeter's

449

# access restrictions.

450

"A String",

451

],

452

"vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.

453

# Perimeter.

454

"enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of

455

# APIs specified in 'allowed_services'.

456

"allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty

457

# unless 'enable_restriction' is True.

"A String",

],

},

"resources": [ # A list of Google Cloud resources that are inside of the service perimeter.

462

# Currently only projects are allowed. Format: `projects/{project_number}`

463

"A String",

464

],

465

"accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the

466

# `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed

467

# must be in the same policy as this `ServicePerimeter`. Referencing a

468

# nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are

469

# listed, resources within the perimeter can only be accessed via Google

470

# Cloud calls with request origins within the perimeter. Example:

471

# `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.

472

# For Service Perimeter Bridge, must be empty.

"A String",

],

},

"name": "A String", # Required. Resource name for the ServicePerimeter. The `short_name`

477

# component must begin with a letter and only include alphanumeric and '_'.

478

# Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`

479

"title": "A String", # Human readable title. Must be unique within the Policy.

480

"perimeterType": "A String", # Perimeter type indicator. A single project is

481

# allowed to be a member of single regular perimeter, but multiple service

482

# perimeter bridges. A project cannot be a included in a perimeter bridge

483

# without being included in regular perimeter. For perimeter bridges,

484

# the restricted service list as well as access level lists must be

485

# empty.

486

"useExplicitDryRunSpec": True or False, # Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly

487

# exists for all Service Perimeters, and that spec is identical to the

488

# status for those Service Perimeters. When this flag is set, it inhibits the

489

# generation of the implicit spec, thereby allowing the user to explicitly

490

# provide a configuration ("spec") to use in a dry-run version of the Service

491

# Perimeter. This allows the user to test changes to the enforced config

492

# ("status") without actually enforcing them. This testing is done through

493

# analyzing the differences between currently enforced and suggested

494

# restrictions. use_explicit_dry_run_spec must bet set to True if any of the

495

# fields in the spec are set to non-default values.

496

"spec": { # `ServicePerimeterConfig` specifies a set of Google Cloud resources that # Proposed (or dry run) ServicePerimeter configuration. This configuration

497

# allows to specify and test ServicePerimeter configuration without enforcing

498

# actual access restrictions. Only allowed to be set when the

499

# "use_explicit_dry_run_spec" flag is set.

500

# describe specific Service Perimeter configuration.

501

"restrictedServices": [ # Google Cloud services that are subject to the Service Perimeter

502

# restrictions. For example, if `storage.googleapis.com` is specified, access

503

# to the storage buckets inside the perimeter must meet the perimeter's

504

# access restrictions.

505

"A String",

506

],

507

"vpcAccessibleServices": { # Specifies how APIs are allowed to communicate within the Service # Configuration for APIs allowed within Perimeter.

508

# Perimeter.

509

"enableRestriction": True or False, # Whether to restrict API calls within the Service Perimeter to the list of

510

# APIs specified in 'allowed_services'.

511

"allowedServices": [ # The list of APIs usable within the Service Perimeter. Must be empty

512

# unless 'enable_restriction' is True.

"A String",

],

},

"resources": [ # A list of Google Cloud resources that are inside of the service perimeter.

517

# Currently only projects are allowed. Format: `projects/{project_number}`

518

"A String",

519

],

520

"accessLevels": [ # A list of `AccessLevel` resource names that allow resources within the

521

# `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed

522

# must be in the same policy as this `ServicePerimeter`. Referencing a

523

# nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are

524

# listed, resources within the perimeter can only be accessed via Google

525

# Cloud calls with request origins within the perimeter. Example:

526

# `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.

527

# For Service Perimeter Bridge, must be empty.

"A String",

],

},

"description": "A String", # Description of the `ServicePerimeter` and its use. Does not affect

532

# behavior.

533

},

534

"iamPolicy": { # An Identity and Access Management (IAM) policy, which specifies access # A representation of the Cloud IAM policy set on a Google Cloud resource.

535

# There can be a maximum of one Cloud IAM policy set on any given resource.

536

# In addition, Cloud IAM policies inherit their granted access scope from any

537

# policies set on parent resources in the resource hierarchy. Therefore, the

538

# effectively policy is the union of both the policy set on this resource

539

# and each policy set on all of the resource's ancestry resource levels in

540

# the hierarchy. See

541

# [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for

542

# more information.

543

# controls for Google Cloud resources.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

544

#

545

#

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

546

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

547

# `members` to a single `role`. Members can be user accounts, service accounts,

548

# Google groups, and domains (such as G Suite). A `role` is a named list of

549

# permissions; each `role` can be an IAM predefined role or a user-created

550

# custom role.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

551

#

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

552

# Optionally, a `binding` can specify a `condition`, which is a logical

553

# expression that allows access to a resource only if the expression evaluates

554

# to `true`. A condition can add constraints based on attributes of the

555

# request, the resource, or both.

556

#

557

# **JSON example:**

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# {

# "bindings": [

# {

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

562

# "role": "roles/resourcemanager.organizationAdmin",

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

563

# "members": [

564

# "user:mike@example.com",

565

# "group:admins@example.com",

566

# "domain:google.com",

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

567

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

568

# ]

569

# },

570

# {

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

571

# "role": "roles/resourcemanager.organizationViewer",

572

# "members": ["user:eve@example.com"],

573

# "condition": {

574

# "title": "expirable access",

575

# "description": "Does not grant access after Sep 2020",

576

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

577

# }

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

578

# }

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

579

# ],

580

# "etag": "BwWWja0YfJA=",

581

# "version": 3

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

582

# }

583

#

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

584

# **YAML example:**

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

589

# - group:admins@example.com

590

# - domain:google.com

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

591

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

592

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

593

# - members:

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

594

# - user:eve@example.com

595

# role: roles/resourcemanager.organizationViewer

596

# condition:

597

# title: expirable access

598

# description: Does not grant access after Sep 2020

599

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

600

# - etag: BwWWja0YfJA=

601

# - version: 3

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

602

#

603

# For a description of IAM and its features, see the

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

604

# [IAM documentation](https://cloud.google.com/iam/docs/).

605

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

606

# `condition` that determines how and when the `bindings` are applied. Each

607

# of the `bindings` must contain at least one member.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

608

{ # Associates `members` with a `role`.

609

"role": "A String", # Role that is assigned to `members`.

610

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

611

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

612

# NOTE: An unsatisfied condition will not allow user access via current

613

# binding. Different bindings, including their conditions, are examined

614

# independently.

615

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

616

# are documented at https://github.com/google/cel-spec.

617

#

618

# Example (Comparison):

619

#

620

# title: "Summary size limit"

621

# description: "Determines if a summary is less than 100 chars"

622

# expression: "document.summary.size() < 100"

623

#

624

# Example (Equality):

625

#

626

# title: "Requestor is owner"

627

# description: "Determines if requestor is the document owner"

628

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

633

# description: "Determine whether the document should be publicly visible"

634

# expression: "document.type != 'private' && document.type != 'internal'"

635

#

636

# Example (Data Manipulation):

637

#

638

# title: "Notification string"

639

# description: "Create a notification string with a timestamp."

640

# expression: "'New message received at ' + string(document.create_time)"

641

#

642

# The exact variables and functions that may be referenced within an expression

643

# are determined by the service that evaluates it. See the service

644

# documentation for additional information.

645

"description": "A String", # Optional. Description of the expression. This is a longer text which

646

# describes the expression, e.g. when hovered over it in a UI.

647

"expression": "A String", # Textual representation of an expression in Common Expression Language

648

# syntax.

649

"location": "A String", # Optional. String indicating the location of the expression for error

650

# reporting, e.g. a file name and a position in the file.

651

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

652

# its purpose. This can be used e.g. in UIs which allow to enter the

653

# expression.

654

},

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

655

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

656

# `members` can have the following values:

657

#

658

# * `allUsers`: A special identifier that represents anyone who is

659

# on the internet; with or without a Google account.

660

#

661

# * `allAuthenticatedUsers`: A special identifier that represents anyone

662

# who is authenticated with a Google account or a service account.

663

#

664

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

665

# account. For example, `alice@example.com` .

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

666

#

667

#

668

# * `serviceAccount:{emailid}`: An email address that represents a service

669

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

670

#

671

# * `group:{emailid}`: An email address that represents a Google group.

672

# For example, `admins@example.com`.

673

#

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

674

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

675

# identifier) representing a user that has been recently deleted. For

676

# example, `alice@example.com?uid=123456789012345678901`. If the user is

677

# recovered, this value reverts to `user:{emailid}` and the recovered user

678

# retains the role in the binding.

679

#

680

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

681

# unique identifier) representing a service account that has been recently

682

# deleted. For example,

683

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

684

# If the service account is undeleted, this value reverts to

685

# `serviceAccount:{emailid}` and the undeleted service account retains the

686

# role in the binding.

687

#

688

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

689

# identifier) representing a Google group that has been recently

690

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

691

# the group is recovered, this value reverts to `group:{emailid}` and the

692

# recovered group retains the role in the binding.

693

#

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

694

#

695

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

696

# users of that domain. For example, `google.com` or `example.com`.

697

#

698

"A String",

699

],

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

700

},

701

],

702

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

703

{ # Specifies the audit configuration for a service.

704

# The configuration determines which permission types are logged, and what

705

# identities, if any, are exempted from logging.

706

# An AuditConfig must have one or more AuditLogConfigs.

707

#

708

# If there are AuditConfigs for both `allServices` and a specific service,

709

# the union of the two AuditConfigs is used for that service: the log_types

710

# specified in each AuditConfig are enabled, and the exempted_members in each

711

# AuditLogConfig are exempted.

712

#

713

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

719

# "audit_log_configs": [

720

# {

721

# "log_type": "DATA_READ",

722

# "exempted_members": [

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

723

# "user:jose@example.com"

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

728

# },

729

# {

730

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

735

# "service": "sampleservice.googleapis.com"

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

736

# "audit_log_configs": [

737

# {

738

# "log_type": "DATA_READ",

739

# },

740

# {

741

# "log_type": "DATA_WRITE",

742

# "exempted_members": [

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

743

# "user:aliya@example.com"

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

# ]

# }

# ]

# }

# ]

# }

#

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

751

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

752

# logging. It also exempts jose@example.com from DATA_READ logging, and

753

# aliya@example.com from DATA_WRITE logging.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

754

"auditLogConfigs": [ # The configuration for logging of each type of permission.

755

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

760

# {

761

# "log_type": "DATA_READ",

762

# "exempted_members": [

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

763

# "user:jose@example.com"

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

773

# jose@example.com from DATA_READ logging.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

774

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

775

# permission.

776

# Follows the same format of Binding.members.

777

"A String",

778

],

779

"logType": "A String", # The log type that this config enables.

780

},

781

],

782

"service": "A String", # Specifies a service that will be enabled for audit logging.

783

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

784

# `allServices` is a special value that covers all services.

785

},

786

],

787

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

788

# prevent simultaneous updates of a policy from overwriting each other.

789

# It is strongly suggested that systems make use of the `etag` in the

790

# read-modify-write cycle to perform policy updates in order to avoid race

791

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

792

# systems are expected to put that etag in the request to `setIamPolicy` to

793

# ensure that their change will be applied to the same version of the policy.

794

#

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

795

# **Important:** If you use IAM Conditions, you must include the `etag` field

796

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

797

# you to overwrite a version `3` policy with a version `1` policy, and all of

798

# the conditions in the version `3` policy are lost.

799

"version": 42, # Specifies the format of the policy.

800

#

801

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

802

# are rejected.

803

#

804

# Any operation that affects conditional role bindings must specify version

805

# `3`. This requirement applies to the following operations:

806

#

807

# * Getting a policy that includes a conditional role binding

808

# * Adding a conditional role binding to a policy

809

# * Changing a conditional role binding in a policy

810

# * Removing any role binding, with or without a condition, from a policy

811

# that includes conditions

812

#

813

# **Important:** If you use IAM Conditions, you must include the `etag` field

814

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

815

# you to overwrite a version `3` policy with a version `1` policy, and all of

816

# the conditions in the version `3` policy are lost.

817

#

818

# If a policy does not include any conditions, operations on that policy may

819

# specify any valid version or leave the field unset.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

820

},

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

821

"accessLevel": { # An `AccessLevel` is a label that can be applied to requests to Google Cloud

822

# services, along with a list of requirements necessary for the label to be

823

# applied.

824

"custom": { # `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language # A `CustomLevel` written in the Common Expression Language.

825

# to represent the necessary conditions for the level to apply to a request.

826

# See CEL spec at: https://github.com/google/cel-spec

827

"expr": { # Represents a textual expression in the Common Expression Language (CEL) # Required. A Cloud CEL expression evaluating to a boolean.

828

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

829

# are documented at https://github.com/google/cel-spec.

830

#

831

# Example (Comparison):

832

#

833

# title: "Summary size limit"

834

# description: "Determines if a summary is less than 100 chars"

835

# expression: "document.summary.size() < 100"

836

#

837

# Example (Equality):

838

#

839

# title: "Requestor is owner"

840

# description: "Determines if requestor is the document owner"

841

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

846

# description: "Determine whether the document should be publicly visible"

847

# expression: "document.type != 'private' && document.type != 'internal'"

848

#

849

# Example (Data Manipulation):

850

#

851

# title: "Notification string"

852

# description: "Create a notification string with a timestamp."

853

# expression: "'New message received at ' + string(document.create_time)"

854

#

855

# The exact variables and functions that may be referenced within an expression

856

# are determined by the service that evaluates it. See the service

857

# documentation for additional information.

858

"description": "A String", # Optional. Description of the expression. This is a longer text which

859

# describes the expression, e.g. when hovered over it in a UI.

860

"expression": "A String", # Textual representation of an expression in Common Expression Language

861

# syntax.

862

"location": "A String", # Optional. String indicating the location of the expression for error

863

# reporting, e.g. a file name and a position in the file.

864

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

865

# its purpose. This can be used e.g. in UIs which allow to enter the

866

# expression.

867

},

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

868

},

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

869

"description": "A String", # Description of the `AccessLevel` and its use. Does not affect behavior.

870

"basic": { # `BasicLevel` is an `AccessLevel` using a set of recommended features. # A `BasicLevel` composed of `Conditions`.

871

"combiningFunction": "A String", # How the `conditions` list should be combined to determine if a request is

872

# granted this `AccessLevel`. If AND is used, each `Condition` in

873

# `conditions` must be satisfied for the `AccessLevel` to be applied. If OR

874

# is used, at least one `Condition` in `conditions` must be satisfied for the

875

# `AccessLevel` to be applied. Default behavior is AND.

876

"conditions": [ # Required. A list of requirements for the `AccessLevel` to be granted.

877

{ # A condition necessary for an `AccessLevel` to be granted. The Condition is an

878

# AND over its fields. So a Condition is true if: 1) the request IP is from one

879

# of the listed subnetworks AND 2) the originating device complies with the

880

# listed device policy AND 3) all listed access levels are granted AND 4) the

881

# request was sent at a time allowed by the DateTimeRestriction.

882

"requiredAccessLevels": [ # A list of other access levels defined in the same `Policy`, referenced by

883

# resource name. Referencing an `AccessLevel` which does not exist is an

884

# error. All access levels listed must be granted for the Condition

885

# to be true. Example:

886

# "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`

887

"A String",

888

],

889

"devicePolicy": { # `DevicePolicy` specifies device specific restrictions necessary to acquire a # Device specific restrictions, all restrictions must hold for the

890

# Condition to be true. If not specified, all devices are allowed.

891

# given access level. A `DevicePolicy` specifies requirements for requests from

892

# devices to be granted access levels, it does not do any enforcement on the

893

# device. `DevicePolicy` acts as an AND over all specified fields, and each

894

# repeated field is an OR over its elements. Any unset fields are ignored. For

895

# example, if the proto is { os_type : DESKTOP_WINDOWS, os_type :

896

# DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be

897

# true for requests originating from encrypted Linux desktops and encrypted

898

# Windows desktops.

899

"allowedEncryptionStatuses": [ # Allowed encryptions statuses, an empty list allows all statuses.

900

"A String",

901

],

902

"osConstraints": [ # Allowed OS versions, an empty list allows all types and all versions.

903

{ # A restriction on the OS type and version of devices making requests.

904

"osType": "A String", # Required. The allowed OS type.

905

"requireVerifiedChromeOs": True or False, # Only allows requests from devices with a verified Chrome OS.

906

# Verifications includes requirements that the device is enterprise-managed,

907

# conformant to domain policies, and the caller has permission to call

908

# the API targeted by the request.

909

"minimumVersion": "A String", # The minimum allowed OS version. If not set, any version of this OS

910

# satisfies the constraint. Format: `"major.minor.patch"`.

911

# Examples: `"10.5.301"`, `"9.2.1"`.

912

},

913

],

914

"requireAdminApproval": True or False, # Whether the device needs to be approved by the customer admin.

915

"requireCorpOwned": True or False, # Whether the device needs to be corp owned.

916

"allowedDeviceManagementLevels": [ # Allowed device management levels, an empty list allows all management

# levels.

"A String",

],

"requireScreenlock": True or False, # Whether or not screenlock is required for the DevicePolicy to be true.

921

# Defaults to `false`.

922

},

923

"ipSubnetworks": [ # CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for

924

# a CIDR IP address block, the specified IP address portion must be properly

925

# truncated (i.e. all the host bits must be zero) or the input is considered

926

# malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is

927

# not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas

928

# "2001:db8::1/32" is not. The originating IP of a request must be in one of

929

# the listed subnets in order for this Condition to be true. If empty, all IP

930

# addresses are allowed.

931

"A String",

932

],

933

"regions": [ # The request must originate from one of the provided countries/regions.

934

# Must be valid ISO 3166-1 alpha-2 codes.

935

"A String",

936

],

937

"members": [ # The request must be made by one of the provided user or service

938

# accounts. Groups are not supported.

939

# Syntax:

940

# `user:{emailid}`

941

# `serviceAccount:{emailid}`

942

# If not specified, a request may come from any user.

943

"A String",

944

],

945

"negate": True or False, # Whether to negate the Condition. If true, the Condition becomes a NAND over

946

# its non-empty fields, each field must be false for the Condition overall to

947

# be satisfied. Defaults to false.

},

],

},

"name": "A String", # Required. Resource name for the Access Level. The `short_name` component

952

# must begin with a letter and only include alphanumeric and '_'. Format:

953

# `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length

954

# of the `short_name` component is 50 characters.

955

"title": "A String", # Human readable title. Must be unique within the Policy.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

956

},

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

964

<code class="details" id="exportAssets">exportAssets(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

965

<pre>Exports assets with time and resource types to a given Cloud Storage

966

location. The output format is newline-delimited JSON.

967

This API implements the google.longrunning.Operation API allowing you

968

to keep track of the export.

969

970

Args:

971

parent: string, Required. The relative name of the root asset. This can only be an

972

organization number (such as "organizations/123"), a project ID (such as

973

"projects/my-project-id"), or a project number (such as "projects/12345"),

974

or a folder number (such as "folders/123"). (required)

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

975

body: object, The request body.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

976

The object takes the form of:

977

978

{ # Export asset request.

979

"assetTypes": [ # A list of asset types of which to take a snapshot for. For example:

980

# "compute.googleapis.com/Disk". If specified, only matching assets will be

981

# returned. See [Introduction to Cloud Asset

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

982

# Inventory](https://cloud.google.com/asset-inventory/docs/overview)

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

983

# for all supported asset types.

984

"A String",

985

],

986

"contentType": "A String", # Asset content type. If not specified, no content but the asset name will be

987

# returned.

988

"outputConfig": { # Output configuration for export assets destination. # Required. Output configuration indicating where the results will be output

989

# to. All results will be in newline delimited JSON format.

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

990

"bigqueryDestination": { # A BigQuery destination. # Destination on BigQuery. The output table stores the fields in asset

991

# proto as columns in BigQuery. The resource/iam_policy field is converted

992

# to a record with each field to a column, except metadata to a single JSON

993

# string.

994

"table": "A String", # Required. The BigQuery table to which the snapshot result should be

995

# written. If this table does not exist, a new table with the given name

996

# will be created.

997

"force": True or False, # If the destination table already exists and this flag is `TRUE`, the

998

# table will be overwritten by the contents of assets snapshot. If the flag

999

# is `FALSE` or unset and the destination table already exists, the export

1000

# call returns an INVALID_ARGUMEMT error.

1001

"dataset": "A String", # Required. The BigQuery dataset in format

1002

# "projects/projectId/datasets/datasetId", to which the snapshot result

1003

# should be exported. If this dataset does not exist, the export call returns

1004

# an INVALID_ARGUMENT error.

1005

},

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

1006

"gcsDestination": { # A Cloud Storage location. # Destination on Cloud Storage.

1007

"uriPrefix": "A String", # The uri prefix of all generated Cloud Storage objects. For example:

1008

# "gs://bucket_name/object_name_prefix". Each object uri is in format:

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

1009

# "gs://bucket_name/object_name_prefix/<asset type>/<shard number> and only

1010

# contains assets for that type. <shard number> starts from 0. For example:

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

1011

# "gs://bucket_name/object_name_prefix/compute.googleapis.com/Disk/0" is

1012

# the first shard of output objects containing all

1013

# compute.googleapis.com/Disk assets. An INVALID_ARGUMENT error will be

1014

# returned if file with the same name "gs://bucket_name/object_name_prefix"

1015

# already exists.

1016

"uri": "A String", # The uri of the Cloud Storage object. It's the same uri that is used by

1017

# gsutil. For example: "gs://bucket_name/object_name". See [Viewing and

1018

# Editing Object

1019

# Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata)

1020

# for more information.

1021

},

1022

},

1023

"readTime": "A String", # Timestamp to take an asset snapshot. This can only be set to a timestamp

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

1024

# between the current time and the current time minus 35 days (inclusive).

1025

# If not specified, the current time will be used. Due to delays in resource

1026

# data collection and indexing, there is a volatile window during which

1027

# running the same query may get different results.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

1028

}

1029

1030

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1037

1038

{ # This resource represents a long-running operation that is the result of a

1039

# network API call.

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

1040

"response": { # The normal response of the operation in case of success. If the original

1041

# method returns no data on success, such as `Delete`, the response is

1042

# `google.protobuf.Empty`. If the original method is standard

1043

# `Get`/`Create`/`Update`, the response should be the resource. For other

1044

# methods, the response should have the type `XxxResponse`, where `Xxx`

1045

# is the original method name. For example, if the original method name

1046

# is `TakeSnapshot()`, the inferred response type is

1047

# `TakeSnapshotResponse`.

1048

"a_key": "", # Properties of the object. Contains field @type with type URL.

1049

},

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

1050

"metadata": { # Service-specific metadata associated with the operation. It typically

1051

# contains progress information and common metadata such as create time.

1052

# Some services might not provide such metadata. Any method that returns a

1053

# long-running operation should document the metadata type, if any.

1054

"a_key": "", # Properties of the object. Contains field @type with type URL.

1055

},

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

1056

"done": True or False, # If the value is `false`, it means the operation is still in progress.

1057

# If `true`, the operation is completed, and either `error` or `response` is

1058

# available.

1059

"name": "A String", # The server-assigned name, which is only unique within the same service that

1060

# originally returns it. If you use the default HTTP mapping, the

1061

# `name` should be a resource name ending with `operations/{unique_id}`.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

1062

"error": { # The `Status` type defines a logical error model that is suitable for # The error result of the operation in case of failure or cancellation.

1063

# different programming environments, including REST APIs and RPC APIs. It is

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

1064

# used by [gRPC](https://github.com/grpc). Each `Status` message contains

1065

# three pieces of data: error code, error message, and error details.

Bu Sun Kim

715bd7f