asset

type AnalyzeIamPolicyLongrunningRequest struct {

	// Required. The request query.
	AnalysisQuery *IamPolicyAnalysisQuery `protobuf:"bytes,1,opt,name=analysis_query,json=analysisQuery,proto3" json:"analysis_query,omitempty"`
	// Required. Output configuration indicating where the results will be output to.
	OutputConfig *IamPolicyAnalysisOutputConfig `protobuf:"bytes,2,opt,name=output_config,json=outputConfig,proto3" json:"output_config,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyLongrunningResponse struct {
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyRequest struct {

	// Required. The request query.
	AnalysisQuery *IamPolicyAnalysisQuery `protobuf:"bytes,1,opt,name=analysis_query,json=analysisQuery,proto3" json:"analysis_query,omitempty"`
	// Optional. Amount of time executable has to complete.  See JSON representation of
	// [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json).
	//
	// If this field is set with a value less than the RPC deadline, and the
	// execution of your query hasn't finished in the specified
	// execution timeout,  you will get a response with partial result.
	// Otherwise, your query's execution will continue until the RPC deadline.
	// If it's not finished until then, you will get a  DEADLINE_EXCEEDED error.
	//
	// Default is empty.
	ExecutionTimeout *durationpb.Duration `protobuf:"bytes,2,opt,name=execution_timeout,json=executionTimeout,proto3" json:"execution_timeout,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyResponse struct {

	// The main analysis that matches the original request.
	MainAnalysis *AnalyzeIamPolicyResponse_IamPolicyAnalysis `protobuf:"bytes,1,opt,name=main_analysis,json=mainAnalysis,proto3" json:"main_analysis,omitempty"`
	// The service account impersonation analysis if
	// [AnalyzeIamPolicyRequest.analyze_service_account_impersonation][] is
	// enabled.
	ServiceAccountImpersonationAnalysis []*AnalyzeIamPolicyResponse_IamPolicyAnalysis `` /* 170-byte string literal not displayed */
	// Represents whether all entries in the [main_analysis][google.cloud.asset.v1.AnalyzeIamPolicyResponse.main_analysis] and
	// [service_account_impersonation_analysis][google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis] have been fully explored to
	// answer the query in the request.
	FullyExplored bool `protobuf:"varint,3,opt,name=fully_explored,json=fullyExplored,proto3" json:"fully_explored,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyResponse_IamPolicyAnalysis struct {

	// The analysis query.
	AnalysisQuery *IamPolicyAnalysisQuery `protobuf:"bytes,1,opt,name=analysis_query,json=analysisQuery,proto3" json:"analysis_query,omitempty"`
	// A list of [IamPolicyAnalysisResult][google.cloud.asset.v1.IamPolicyAnalysisResult] that matches the analysis query, or
	// empty if no result is found.
	AnalysisResults []*IamPolicyAnalysisResult `protobuf:"bytes,2,rep,name=analysis_results,json=analysisResults,proto3" json:"analysis_results,omitempty"`
	// Represents whether all entries in the [analysis_results][google.cloud.asset.v1.AnalyzeIamPolicyResponse.IamPolicyAnalysis.analysis_results] have been
	// fully explored to answer the query.
	FullyExplored bool `protobuf:"varint,3,opt,name=fully_explored,json=fullyExplored,proto3" json:"fully_explored,omitempty"`
	// A list of non-critical errors happened during the query handling.
	NonCriticalErrors []*IamPolicyAnalysisState `protobuf:"bytes,5,rep,name=non_critical_errors,json=nonCriticalErrors,proto3" json:"non_critical_errors,omitempty"`
	// contains filtered or unexported fields
}

type Asset struct {

	// The last update timestamp of an asset. update_time is updated when
	// create/update/delete operation is performed.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// The full name of the asset. Example:
	// `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`
	//
	// See [Resource
	// names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
	// for more information.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The type of the asset. Example: `compute.googleapis.com/Disk`
	//
	// See [Supported asset
	// types](https://cloud.google.com/asset-inventory/docs/supported-asset-types)
	// for more information.
	AssetType string `protobuf:"bytes,2,opt,name=asset_type,json=assetType,proto3" json:"asset_type,omitempty"`
	// A representation of the resource.
	Resource *Resource `protobuf:"bytes,3,opt,name=resource,proto3" json:"resource,omitempty"`
	// A representation of the Cloud IAM policy set on a Google Cloud resource.
	// There can be a maximum of one Cloud IAM policy set on any given resource.
	// In addition, Cloud IAM policies inherit their granted access scope from any
	// policies set on parent resources in the resource hierarchy. Therefore, the
	// effectively policy is the union of both the policy set on this resource
	// and each policy set on all of the resource's ancestry resource levels in
	// the hierarchy. See
	// [this topic](https://cloud.google.com/iam/docs/policies#inheritance) for
	// more information.
	IamPolicy *v1.Policy `protobuf:"bytes,4,opt,name=iam_policy,json=iamPolicy,proto3" json:"iam_policy,omitempty"`
	// A representation of an [organization
	// policy](https://cloud.google.com/resource-manager/docs/organization-policy/overview#organization_policy).
	// There can be more than one organization policy with different constraints
	// set on a given resource.
	OrgPolicy []*v11.Policy `protobuf:"bytes,6,rep,name=org_policy,json=orgPolicy,proto3" json:"org_policy,omitempty"`
	// A representation of an [access
	// policy](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
	//
	// Types that are assignable to AccessContextPolicy:
	//	*Asset_AccessPolicy
	//	*Asset_AccessLevel
	//	*Asset_ServicePerimeter
	AccessContextPolicy isAsset_AccessContextPolicy `protobuf_oneof:"access_context_policy"`
	// A representation of runtime OS Inventory information. See [this
	// topic](https://cloud.google.com/compute/docs/instances/os-inventory-management)
	// for more information.
	OsInventory *v12.Inventory `protobuf:"bytes,12,opt,name=os_inventory,json=osInventory,proto3" json:"os_inventory,omitempty"`
	// The ancestry path of an asset in Google Cloud [resource
	// hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy),
	// represented as a list of relative resource names. An ancestry path starts
	// with the closest ancestor in the hierarchy and ends at root. If the asset
	// is a project, folder, or organization, the ancestry path starts from the
	// asset itself.
	//
	// Example: `["projects/123456789", "folders/5432", "organizations/1234"]`
	Ancestors []string `protobuf:"bytes,10,rep,name=ancestors,proto3" json:"ancestors,omitempty"`
	// contains filtered or unexported fields
}

type AssetServiceClient interface {
	// Exports assets with time and resource types to a given Cloud Storage
	// location/BigQuery table. For Cloud Storage location destinations, the
	// output format is newline-delimited JSON. Each line represents a
	// [google.cloud.asset.v1.Asset][google.cloud.asset.v1.Asset] in the JSON format; for BigQuery table
	// destinations, the output table stores the fields in asset proto as columns.
	// This API implements the [google.longrunning.Operation][google.longrunning.Operation] API
	// , which allows you to keep track of the export. We recommend intervals of
	// at least 2 seconds with exponential retry to poll the export operation
	// result. For regular-size resource parent, the export operation usually
	// finishes within 5 minutes.
	ExportAssets(ctx context.Context, in *ExportAssetsRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Lists assets with time and resource types and returns paged results in
	// response.
	ListAssets(ctx context.Context, in *ListAssetsRequest, opts ...grpc.CallOption) (*ListAssetsResponse, error)
	// Batch gets the update history of assets that overlap a time window.
	// For IAM_POLICY content, this API outputs history when the asset and its
	// attached IAM POLICY both exist. This can create gaps in the output history.
	// Otherwise, this API outputs history with asset in both non-delete or
	// deleted status.
	// If a specified asset does not exist, this API returns an INVALID_ARGUMENT
	// error.
	BatchGetAssetsHistory(ctx context.Context, in *BatchGetAssetsHistoryRequest, opts ...grpc.CallOption) (*BatchGetAssetsHistoryResponse, error)
	// Creates a feed in a parent project/folder/organization to listen to its
	// asset updates.
	CreateFeed(ctx context.Context, in *CreateFeedRequest, opts ...grpc.CallOption) (*Feed, error)
	// Gets details about an asset feed.
	GetFeed(ctx context.Context, in *GetFeedRequest, opts ...grpc.CallOption) (*Feed, error)
	// Lists all asset feeds in a parent project/folder/organization.
	ListFeeds(ctx context.Context, in *ListFeedsRequest, opts ...grpc.CallOption) (*ListFeedsResponse, error)
	// Updates an asset feed configuration.
	UpdateFeed(ctx context.Context, in *UpdateFeedRequest, opts ...grpc.CallOption) (*Feed, error)
	// Deletes an asset feed.
	DeleteFeed(ctx context.Context, in *DeleteFeedRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Searches all Cloud resources within the specified scope, such as a project,
	// folder, or organization. The caller must be granted the
	// `cloudasset.assets.searchAllResources` permission on the desired scope,
	// otherwise the request will be rejected.
	SearchAllResources(ctx context.Context, in *SearchAllResourcesRequest, opts ...grpc.CallOption) (*SearchAllResourcesResponse, error)
	// Searches all IAM policies within the specified scope, such as a project,
	// folder, or organization. The caller must be granted the
	// `cloudasset.assets.searchAllIamPolicies` permission on the desired scope,
	// otherwise the request will be rejected.
	SearchAllIamPolicies(ctx context.Context, in *SearchAllIamPoliciesRequest, opts ...grpc.CallOption) (*SearchAllIamPoliciesResponse, error)
	// Analyzes IAM policies to answer which identities have what accesses on
	// which resources.
	AnalyzeIamPolicy(ctx context.Context, in *AnalyzeIamPolicyRequest, opts ...grpc.CallOption) (*AnalyzeIamPolicyResponse, error)
	// Analyzes IAM policies asynchronously to answer which identities have what
	// accesses on which resources, and writes the analysis results to a Google
	// Cloud Storage or a BigQuery destination. For Cloud Storage destination, the
	// output format is the JSON format that represents a
	// [AnalyzeIamPolicyResponse][google.cloud.asset.v1.AnalyzeIamPolicyResponse]. This method implements the
	// [google.longrunning.Operation][google.longrunning.Operation], which allows you to track the operation
	// status. We recommend intervals of at least 2 seconds with exponential
	// backoff retry to poll the operation result. The metadata contains the
	// request to help callers to map responses to requests.
	AnalyzeIamPolicyLongrunning(ctx context.Context, in *AnalyzeIamPolicyLongrunningRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
}

type AssetServiceServer interface {
	// Exports assets with time and resource types to a given Cloud Storage
	// location/BigQuery table. For Cloud Storage location destinations, the
	// output format is newline-delimited JSON. Each line represents a
	// [google.cloud.asset.v1.Asset][google.cloud.asset.v1.Asset] in the JSON format; for BigQuery table
	// destinations, the output table stores the fields in asset proto as columns.
	// This API implements the [google.longrunning.Operation][google.longrunning.Operation] API
	// , which allows you to keep track of the export. We recommend intervals of
	// at least 2 seconds with exponential retry to poll the export operation
	// result. For regular-size resource parent, the export operation usually
	// finishes within 5 minutes.
	ExportAssets(context.Context, *ExportAssetsRequest) (*longrunning.Operation, error)
	// Lists assets with time and resource types and returns paged results in
	// response.
	ListAssets(context.Context, *ListAssetsRequest) (*ListAssetsResponse, error)
	// Batch gets the update history of assets that overlap a time window.
	// For IAM_POLICY content, this API outputs history when the asset and its
	// attached IAM POLICY both exist. This can create gaps in the output history.
	// Otherwise, this API outputs history with asset in both non-delete or
	// deleted status.
	// If a specified asset does not exist, this API returns an INVALID_ARGUMENT
	// error.
	BatchGetAssetsHistory(context.Context, *BatchGetAssetsHistoryRequest) (*BatchGetAssetsHistoryResponse, error)
	// Creates a feed in a parent project/folder/organization to listen to its
	// asset updates.
	CreateFeed(context.Context, *CreateFeedRequest) (*Feed, error)
	// Gets details about an asset feed.
	GetFeed(context.Context, *GetFeedRequest) (*Feed, error)
	// Lists all asset feeds in a parent project/folder/organization.
	ListFeeds(context.Context, *ListFeedsRequest) (*ListFeedsResponse, error)
	// Updates an asset feed configuration.
	UpdateFeed(context.Context, *UpdateFeedRequest) (*Feed, error)
	// Deletes an asset feed.
	DeleteFeed(context.Context, *DeleteFeedRequest) (*emptypb.Empty, error)
	// Searches all Cloud resources within the specified scope, such as a project,
	// folder, or organization. The caller must be granted the
	// `cloudasset.assets.searchAllResources` permission on the desired scope,
	// otherwise the request will be rejected.
	SearchAllResources(context.Context, *SearchAllResourcesRequest) (*SearchAllResourcesResponse, error)
	// Searches all IAM policies within the specified scope, such as a project,
	// folder, or organization. The caller must be granted the
	// `cloudasset.assets.searchAllIamPolicies` permission on the desired scope,
	// otherwise the request will be rejected.
	SearchAllIamPolicies(context.Context, *SearchAllIamPoliciesRequest) (*SearchAllIamPoliciesResponse, error)
	// Analyzes IAM policies to answer which identities have what accesses on
	// which resources.
	AnalyzeIamPolicy(context.Context, *AnalyzeIamPolicyRequest) (*AnalyzeIamPolicyResponse, error)
	// Analyzes IAM policies asynchronously to answer which identities have what
	// accesses on which resources, and writes the analysis results to a Google
	// Cloud Storage or a BigQuery destination. For Cloud Storage destination, the
	// output format is the JSON format that represents a
	// [AnalyzeIamPolicyResponse][google.cloud.asset.v1.AnalyzeIamPolicyResponse]. This method implements the
	// [google.longrunning.Operation][google.longrunning.Operation], which allows you to track the operation
	// status. We recommend intervals of at least 2 seconds with exponential
	// backoff retry to poll the operation result. The metadata contains the
	// request to help callers to map responses to requests.
	AnalyzeIamPolicyLongrunning(context.Context, *AnalyzeIamPolicyLongrunningRequest) (*longrunning.Operation, error)
}

type Asset_AccessLevel struct {
	// Please also refer to the [access level user
	// guide](https://cloud.google.com/access-context-manager/docs/overview#access-levels).
	AccessLevel *v13.AccessLevel `protobuf:"bytes,8,opt,name=access_level,json=accessLevel,proto3,oneof"`
}

type Asset_AccessPolicy struct {
	// Please also refer to the [access policy user
	// guide](https://cloud.google.com/access-context-manager/docs/overview#access-policies).
	AccessPolicy *v13.AccessPolicy `protobuf:"bytes,7,opt,name=access_policy,json=accessPolicy,proto3,oneof"`
}

type Asset_ServicePerimeter struct {
	// Please also refer to the [service perimeter user
	// guide](https://cloud.google.com/vpc-service-controls/docs/overview).
	ServicePerimeter *v13.ServicePerimeter `protobuf:"bytes,9,opt,name=service_perimeter,json=servicePerimeter,proto3,oneof"`
}

type BatchGetAssetsHistoryRequest struct {

	// Required. The relative name of the root asset. It can only be an
	// organization number (such as "organizations/123"), a project ID (such as
	// "projects/my-project-id")", or a project number (such as "projects/12345").
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// A list of the full names of the assets.
	// See: https://cloud.google.com/asset-inventory/docs/resource-name-format
	// Example:
	//
	// `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.
	//
	// The request becomes a no-op if the asset name list is empty, and the max
	// size of the asset name list is 100 in one request.
	AssetNames []string `protobuf:"bytes,2,rep,name=asset_names,json=assetNames,proto3" json:"asset_names,omitempty"`
	// Optional. The content type.
	ContentType ContentType `` /* 134-byte string literal not displayed */
	// Optional. The time window for the asset history. Both start_time and
	// end_time are optional and if set, it must be after the current time minus
	// 35 days. If end_time is not set, it is default to current timestamp.
	// If start_time is not set, the snapshot of the assets at end_time will be
	// returned. The returned results contain all temporal assets whose time
	// window overlap with read_time_window.
	ReadTimeWindow *TimeWindow `protobuf:"bytes,4,opt,name=read_time_window,json=readTimeWindow,proto3" json:"read_time_window,omitempty"`
	// contains filtered or unexported fields
}

type BatchGetAssetsHistoryResponse struct {

	// A list of assets with valid time windows.
	Assets []*TemporalAsset `protobuf:"bytes,1,rep,name=assets,proto3" json:"assets,omitempty"`
	// contains filtered or unexported fields
}

type BigQueryDestination struct {

	// Required. The BigQuery dataset in format
	// "projects/projectId/datasets/datasetId", to which the snapshot result
	// should be exported. If this dataset does not exist, the export call returns
	// an INVALID_ARGUMENT error.
	Dataset string `protobuf:"bytes,1,opt,name=dataset,proto3" json:"dataset,omitempty"`
	// Required. The BigQuery table to which the snapshot result should be
	// written. If this table does not exist, a new table with the given name
	// will be created.
	Table string `protobuf:"bytes,2,opt,name=table,proto3" json:"table,omitempty"`
	// If the destination table already exists and this flag is `TRUE`, the
	// table will be overwritten by the contents of assets snapshot. If the flag
	// is `FALSE` or unset and the destination table already exists, the export
	// call returns an INVALID_ARGUMEMT error.
	Force bool `protobuf:"varint,3,opt,name=force,proto3" json:"force,omitempty"`
	// [partition_spec] determines whether to export to partitioned table(s) and
	// how to partition the data.
	//
	// If [partition_spec] is unset or [partition_spec.partition_key] is unset or
	// `PARTITION_KEY_UNSPECIFIED`, the snapshot results will be exported to
	// non-partitioned table(s). [force] will decide whether to overwrite existing
	// table(s).
	//
	// If [partition_spec] is specified. First, the snapshot results will be
	// written to partitioned table(s) with two additional timestamp columns,
	// readTime and requestTime, one of which will be the partition key. Secondly,
	// in the case when any destination table already exists, it will first try to
	// update existing table's schema as necessary by appending additional
	// columns. Then, if [force] is `TRUE`, the corresponding partition will be
	// overwritten by the snapshot results (data in different partitions will
	// remain intact); if [force] is unset or `FALSE`, it will append the data. An
	// error will be returned if the schema update or data appension fails.
	PartitionSpec *PartitionSpec `protobuf:"bytes,4,opt,name=partition_spec,json=partitionSpec,proto3" json:"partition_spec,omitempty"`
	// If this flag is `TRUE`, the snapshot results will be written to one or
	// multiple tables, each of which contains results of one asset type. The
	// [force] and [partition_spec] fields will apply to each of them.
	//
	// Field [table] will be concatenated with "_" and the asset type names (see
	// https://cloud.google.com/asset-inventory/docs/supported-asset-types for
	// supported asset types) to construct per-asset-type table names, in which
	// all non-alphanumeric characters like "." and "/" will be substituted by
	// "_". Example: if field [table] is "mytable" and snapshot results
	// contain "storage.googleapis.com/Bucket" assets, the corresponding table
	// name will be "mytable_storage_googleapis_com_Bucket". If any of these
	// tables does not exist, a new table with the concatenated name will be
	// created.
	//
	// When [content_type] in the ExportAssetsRequest is `RESOURCE`, the schema of
	// each table will include RECORD-type columns mapped to the nested fields in
	// the Asset.resource.data field of that asset type (up to the 15 nested level
	// BigQuery supports
	// (https://cloud.google.com/bigquery/docs/nested-repeated#limitations)). The
	// fields in >15 nested levels will be stored in JSON format string as a child
	// column of its parent RECORD column.
	//
	// If error occurs when exporting to any table, the whole export call will
	// return an error but the export results that already succeed will persist.
	// Example: if exporting to table_type_A succeeds when exporting to
	// table_type_B fails during one export call, the results in table_type_A will
	// persist and there will not be partial results persisting in a table.
	SeparateTablesPerAssetType bool `` /* 146-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ConditionEvaluation struct {

	// The evaluation result.
	EvaluationValue ConditionEvaluation_EvaluationValue `` /* 170-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ConditionEvaluation_EvaluationValue int32

type ContentType int32

type CreateFeedRequest struct {

	// Required. The name of the project/folder/organization where this feed
	// should be created in. It can only be an organization number (such as
	// "organizations/123"), a folder number (such as "folders/123"), a project ID
	// (such as "projects/my-project-id")", or a project number (such as
	// "projects/12345").
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. This is the client-assigned asset feed identifier and it needs to
	// be unique under a specific parent project/folder/organization.
	FeedId string `protobuf:"bytes,2,opt,name=feed_id,json=feedId,proto3" json:"feed_id,omitempty"`
	// Required. The feed details. The field `name` must be empty and it will be generated
	// in the format of:
	// projects/project_number/feeds/feed_id
	// folders/folder_number/feeds/feed_id
	// organizations/organization_number/feeds/feed_id
	Feed *Feed `protobuf:"bytes,3,opt,name=feed,proto3" json:"feed,omitempty"`
	// contains filtered or unexported fields
}

type DeleteFeedRequest struct {

	// Required. The name of the feed and it must be in the format of:
	// projects/project_number/feeds/feed_id
	// folders/folder_number/feeds/feed_id
	// organizations/organization_number/feeds/feed_id
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ExportAssetsRequest struct {

	// Required. The relative name of the root asset. This can only be an
	// organization number (such as "organizations/123"), a project ID (such as
	// "projects/my-project-id"), or a project number (such as "projects/12345"),
	// or a folder number (such as "folders/123").
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Timestamp to take an asset snapshot. This can only be set to a timestamp
	// between the current time and the current time minus 35 days (inclusive).
	// If not specified, the current time will be used. Due to delays in resource
	// data collection and indexing, there is a volatile window during which
	// running the same query may get different results.
	ReadTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=read_time,json=readTime,proto3" json:"read_time,omitempty"`
	// A list of asset types to take a snapshot for. For example:
	// "compute.googleapis.com/Disk".
	//
	// Regular expressions are also supported. For example:
	//
	// * "compute.googleapis.com.*" snapshots resources whose asset type starts
	// with "compute.googleapis.com".
	// * ".*Instance" snapshots resources whose asset type ends with "Instance".
	// * ".*Instance.*" snapshots resources whose asset type contains "Instance".
	//
	// See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported
	// regular expression syntax. If the regular expression does not match any
	// supported asset type, an INVALID_ARGUMENT error will be returned.
	//
	// If specified, only matching assets will be returned, otherwise, it will
	// snapshot all asset types. See [Introduction to Cloud Asset
	// Inventory](https://cloud.google.com/asset-inventory/docs/overview)
	// for all supported asset types.
	AssetTypes []string `protobuf:"bytes,3,rep,name=asset_types,json=assetTypes,proto3" json:"asset_types,omitempty"`
	// Asset content type. If not specified, no content but the asset name will be
	// returned.
	ContentType ContentType `` /* 134-byte string literal not displayed */
	// Required. Output configuration indicating where the results will be output to.
	OutputConfig *OutputConfig `protobuf:"bytes,5,opt,name=output_config,json=outputConfig,proto3" json:"output_config,omitempty"`
	// contains filtered or unexported fields
}

type ExportAssetsResponse struct {

	// Time the snapshot was taken.
	ReadTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=read_time,json=readTime,proto3" json:"read_time,omitempty"`
	// Output configuration indicating where the results were output to.
	OutputConfig *OutputConfig `protobuf:"bytes,2,opt,name=output_config,json=outputConfig,proto3" json:"output_config,omitempty"`
	// Output result indicating where the assets were exported to. For example, a
	// set of actual Google Cloud Storage object uris where the assets are
	// exported to. The uris can be different from what [output_config] has
	// specified, as the service will split the output object into multiple ones
	// once it exceeds a single Google Cloud Storage object limit.
	OutputResult *OutputResult `protobuf:"bytes,3,opt,name=output_result,json=outputResult,proto3" json:"output_result,omitempty"`
	// contains filtered or unexported fields
}

type Feed struct {

	// Required. The format will be
	// projects/{project_number}/feeds/{client-assigned_feed_identifier} or
	// folders/{folder_number}/feeds/{client-assigned_feed_identifier} or
	// organizations/{organization_number}/feeds/{client-assigned_feed_identifier}
	//
	// The client-assigned feed identifier must be unique within the parent
	// project/folder/organization.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// A list of the full names of the assets to receive updates. You must specify
	// either or both of asset_names and asset_types. Only asset updates matching
	// specified asset_names or asset_types are exported to the feed.
	// Example:
	// `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.
	// See [Resource
	// Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
	// for more info.
	AssetNames []string `protobuf:"bytes,2,rep,name=asset_names,json=assetNames,proto3" json:"asset_names,omitempty"`
	// A list of types of the assets to receive updates. You must specify either
	// or both of asset_names and asset_types. Only asset updates matching
	// specified asset_names or asset_types are exported to the feed.
	// Example: `"compute.googleapis.com/Disk"`
	//
	// See [this
	// topic](https://cloud.google.com/asset-inventory/docs/supported-asset-types)
	// for a list of all supported asset types.
	AssetTypes []string `protobuf:"bytes,3,rep,name=asset_types,json=assetTypes,proto3" json:"asset_types,omitempty"`
	// Asset content type. If not specified, no content but the asset name and
	// type will be returned.
	ContentType ContentType `` /* 134-byte string literal not displayed */
	// Required. Feed output configuration defining where the asset updates are
	// published to.
	FeedOutputConfig *FeedOutputConfig `protobuf:"bytes,5,opt,name=feed_output_config,json=feedOutputConfig,proto3" json:"feed_output_config,omitempty"`
	// A condition which determines whether an asset update should be published.
	// If specified, an asset will be returned only when the expression evaluates
	// to true.
	// When set, `expression` field in the `Expr` must be a valid [CEL expression]
	// (https://github.com/google/cel-spec) on a TemporalAsset with name
	// `temporal_asset`. Example: a Feed with expression ("temporal_asset.deleted
	// == true") will only publish Asset deletions. Other fields of `Expr` are
	// optional.
	//
	// See our [user
	// guide](https://cloud.google.com/asset-inventory/docs/monitoring-asset-changes#feed_with_condition)
	// for detailed instructions.
	Condition *expr.Expr `protobuf:"bytes,6,opt,name=condition,proto3" json:"condition,omitempty"`
	// contains filtered or unexported fields
}

type FeedOutputConfig struct {

	// Asset feed destination.
	//
	// Types that are assignable to Destination:
	//	*FeedOutputConfig_PubsubDestination
	Destination isFeedOutputConfig_Destination `protobuf_oneof:"destination"`
	// contains filtered or unexported fields
}

type FeedOutputConfig_PubsubDestination struct {
	// Destination on Pub/Sub.
	PubsubDestination *PubsubDestination `protobuf:"bytes,1,opt,name=pubsub_destination,json=pubsubDestination,proto3,oneof"`
}

type GcsDestination struct {

	// Required.
	//
	// Types that are assignable to ObjectUri:
	//	*GcsDestination_Uri
	//	*GcsDestination_UriPrefix
	ObjectUri isGcsDestination_ObjectUri `protobuf_oneof:"object_uri"`
	// contains filtered or unexported fields
}

type GcsDestination_Uri struct {
	// The uri of the Cloud Storage object. It's the same uri that is used by
	// gsutil. Example: "gs://bucket_name/object_name". See [Viewing and
	// Editing Object
	// Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata)
	// for more information.
	//
	// If the specified Cloud Storage object already exists and there is no
	// [hold](https://cloud.google.com/storage/docs/object-holds), it will be
	// overwritten with the exported result.
	Uri string `protobuf:"bytes,1,opt,name=uri,proto3,oneof"`
}

type GcsDestination_UriPrefix struct {
	// The uri prefix of all generated Cloud Storage objects. Example:
	// "gs://bucket_name/object_name_prefix". Each object uri is in format:
	// "gs://bucket_name/object_name_prefix/<asset type>/<shard number> and only
	// contains assets for that type. <shard number> starts from 0. Example:
	// "gs://bucket_name/object_name_prefix/compute.googleapis.com/Disk/0" is
	// the first shard of output objects containing all
	// compute.googleapis.com/Disk assets. An INVALID_ARGUMENT error will be
	// returned if file with the same name "gs://bucket_name/object_name_prefix"
	// already exists.
	UriPrefix string `protobuf:"bytes,2,opt,name=uri_prefix,json=uriPrefix,proto3,oneof"`
}

type GcsOutputResult struct {

	// List of uris of the Cloud Storage objects. Example:
	// "gs://bucket_name/object_name".
	Uris []string `protobuf:"bytes,1,rep,name=uris,proto3" json:"uris,omitempty"`
	// contains filtered or unexported fields
}

type GetFeedRequest struct {

	// Required. The name of the Feed and it must be in the format of:
	// projects/project_number/feeds/feed_id
	// folders/folder_number/feeds/feed_id
	// organizations/organization_number/feeds/feed_id
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig struct {

	// IAM policy analysis export destination.
	//
	// Types that are assignable to Destination:
	//	*IamPolicyAnalysisOutputConfig_GcsDestination_
	//	*IamPolicyAnalysisOutputConfig_BigqueryDestination
	Destination isIamPolicyAnalysisOutputConfig_Destination `protobuf_oneof:"destination"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig_BigQueryDestination struct {

	// Required. The BigQuery dataset in format "projects/projectId/datasets/datasetId",
	// to which the analysis results should be exported. If this dataset does
	// not exist, the export call will return an INVALID_ARGUMENT error.
	Dataset string `protobuf:"bytes,1,opt,name=dataset,proto3" json:"dataset,omitempty"`
	// Required. The prefix of the BigQuery tables to which the analysis results will be
	// written. Tables will be created based on this table_prefix if not exist:
	// * <table_prefix>_analysis table will contain export operation's metadata.
	// * <table_prefix>_analysis_result will contain all the
	//   [IamPolicyAnalysisResult][google.cloud.asset.v1.IamPolicyAnalysisResult].
	// When [partition_key] is specified, both tables will be partitioned based
	// on the [partition_key].
	TablePrefix string `protobuf:"bytes,2,opt,name=table_prefix,json=tablePrefix,proto3" json:"table_prefix,omitempty"`
	// The partition key for BigQuery partitioned table.
	PartitionKey IamPolicyAnalysisOutputConfig_BigQueryDestination_PartitionKey `` /* 188-byte string literal not displayed */
	// Optional. Specifies the action that occurs if the destination table or partition
	// already exists. The following values are supported:
	//
	// * WRITE_TRUNCATE: If the table or partition already exists, BigQuery
	// overwrites the entire table or all the partitions data.
	// * WRITE_APPEND: If the table or partition already exists, BigQuery
	// appends the data to the table or the latest partition.
	// * WRITE_EMPTY: If the table already exists and contains data, an error is
	// returned.
	//
	// The default value is WRITE_APPEND. Each action is atomic and only occurs
	// if BigQuery is able to complete the job successfully. Details are at
	// https://cloud.google.com/bigquery/docs/loading-data-local#appending_to_or_overwriting_a_table_using_a_local_file.
	WriteDisposition string `protobuf:"bytes,4,opt,name=write_disposition,json=writeDisposition,proto3" json:"write_disposition,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig_BigQueryDestination_PartitionKey int32

type IamPolicyAnalysisOutputConfig_BigqueryDestination struct {
	// Destination on BigQuery.
	BigqueryDestination *IamPolicyAnalysisOutputConfig_BigQueryDestination `protobuf:"bytes,2,opt,name=bigquery_destination,json=bigqueryDestination,proto3,oneof"`
}

type IamPolicyAnalysisOutputConfig_GcsDestination struct {

	// Required. The uri of the Cloud Storage object. It's the same uri that is used by
	// gsutil. Example: "gs://bucket_name/object_name". See [Viewing and
	// Editing Object
	// Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata)
	// for more information.
	//
	// If the specified Cloud Storage object already exists and there is no
	// [hold](https://cloud.google.com/storage/docs/object-holds), it will be
	// overwritten with the analysis result.
	Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig_GcsDestination_ struct {
	// Destination on Cloud Storage.
	GcsDestination *IamPolicyAnalysisOutputConfig_GcsDestination `protobuf:"bytes,1,opt,name=gcs_destination,json=gcsDestination,proto3,oneof"`
}

type IamPolicyAnalysisQuery struct {

	// Required. The relative name of the root asset. Only resources and IAM policies within
	// the scope will be analyzed.
	//
	// This can only be an organization number (such as "organizations/123"), a
	// folder number (such as "folders/123"), a project ID (such as
	// "projects/my-project-id"), or a project number (such as "projects/12345").
	//
	// To know how to get organization id, visit [here
	// ](https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).
	//
	// To know how to get folder or project id, visit [here
	// ](https://cloud.google.com/resource-manager/docs/creating-managing-folders#viewing_or_listing_folders_and_projects).
	Scope string `protobuf:"bytes,1,opt,name=scope,proto3" json:"scope,omitempty"`
	// Optional. Specifies a resource for analysis.
	ResourceSelector *IamPolicyAnalysisQuery_ResourceSelector `protobuf:"bytes,2,opt,name=resource_selector,json=resourceSelector,proto3" json:"resource_selector,omitempty"`
	// Optional. Specifies an identity for analysis.
	IdentitySelector *IamPolicyAnalysisQuery_IdentitySelector `protobuf:"bytes,3,opt,name=identity_selector,json=identitySelector,proto3" json:"identity_selector,omitempty"`
	// Optional. Specifies roles or permissions for analysis. This is optional.
	AccessSelector *IamPolicyAnalysisQuery_AccessSelector `protobuf:"bytes,4,opt,name=access_selector,json=accessSelector,proto3" json:"access_selector,omitempty"`
	// Optional. The query options.
	Options *IamPolicyAnalysisQuery_Options `protobuf:"bytes,5,opt,name=options,proto3" json:"options,omitempty"`
	// Optional. The hypothetical context for IAM conditions evaluation.
	ConditionContext *IamPolicyAnalysisQuery_ConditionContext `protobuf:"bytes,6,opt,name=condition_context,json=conditionContext,proto3" json:"condition_context,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_AccessSelector struct {

	// Optional. The roles to appear in result.
	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	// Optional. The permissions to appear in result.
	Permissions []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_ConditionContext struct {

	// The IAM conditions time context.
	//
	// Types that are assignable to TimeContext:
	//	*IamPolicyAnalysisQuery_ConditionContext_AccessTime
	TimeContext isIamPolicyAnalysisQuery_ConditionContext_TimeContext `protobuf_oneof:"TimeContext"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_ConditionContext_AccessTime struct {
	// The hypothetical access timestamp to evaluate IAM conditions. Note that
	// this value must not be earlier than the current time; otherwise, an
	// INVALID_ARGUMENT error will be returned.
	AccessTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=access_time,json=accessTime,proto3,oneof"`
}

type IamPolicyAnalysisQuery_IdentitySelector struct {

	// Required. The identity appear in the form of members in
	// [IAM policy
	// binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
	//
	// The examples of supported forms are:
	// "user:mike@example.com",
	// "group:admins@example.com",
	// "domain:google.com",
	// "serviceAccount:my-project-id@appspot.gserviceaccount.com".
	//
	// Notice that wildcard characters (such as * and ?) are not supported.
	// You must give a specific identity.
	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_Options struct {

	// Optional. If true, the identities section of the result will expand any
	// Google groups appearing in an IAM policy binding.
	//
	// If [IamPolicyAnalysisQuery.identity_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.identity_selector] is specified, the
	// identity in the result will be determined by the selector, and this flag
	// is not allowed to set.
	//
	// Default is false.
	ExpandGroups bool `protobuf:"varint,1,opt,name=expand_groups,json=expandGroups,proto3" json:"expand_groups,omitempty"`
	// Optional. If true, the access section of result will expand any roles
	// appearing in IAM policy bindings to include their permissions.
	//
	// If [IamPolicyAnalysisQuery.access_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.access_selector] is specified, the access
	// section of the result will be determined by the selector, and this flag
	// is not allowed to set.
	//
	// Default is false.
	ExpandRoles bool `protobuf:"varint,2,opt,name=expand_roles,json=expandRoles,proto3" json:"expand_roles,omitempty"`
	// Optional. If true and [IamPolicyAnalysisQuery.resource_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.resource_selector] is not
	// specified, the resource section of the result will expand any resource
	// attached to an IAM policy to include resources lower in the resource
	// hierarchy.
	//
	// For example, if the request analyzes for which resources user A has
	// permission P, and the results include an IAM policy with P on a GCP
	// folder, the results will also include resources in that folder with
	// permission P.
	//
	// If true and [IamPolicyAnalysisQuery.resource_selector][google.cloud.asset.v1.IamPolicyAnalysisQuery.resource_selector] is specified,
	// the resource section of the result will expand the specified resource to
	// include resources lower in the resource hierarchy. Only project or
	// lower resources are supported. Folder and organization resource cannot be
	// used together with this option.
	//
	// For example, if the request analyzes for which users have permission P on
	// a GCP project with this option enabled, the results will include all
	// users who have permission P on that project or any lower resource.
	//
	// Default is false.
	ExpandResources bool `protobuf:"varint,3,opt,name=expand_resources,json=expandResources,proto3" json:"expand_resources,omitempty"`
	// Optional. If true, the result will output resource edges, starting
	// from the policy attached resource, to any expanded resources.
	// Default is false.
	OutputResourceEdges bool `protobuf:"varint,4,opt,name=output_resource_edges,json=outputResourceEdges,proto3" json:"output_resource_edges,omitempty"`
	// Optional. If true, the result will output group identity edges, starting
	// from the binding's group members, to any expanded identities.
	// Default is false.
	OutputGroupEdges bool `protobuf:"varint,5,opt,name=output_group_edges,json=outputGroupEdges,proto3" json:"output_group_edges,omitempty"`
	// Optional. If true, the response will include access analysis from identities to
	// resources via service account impersonation. This is a very expensive
	// operation, because many derived queries will be executed. We highly
	// recommend you use [AssetService.AnalyzeIamPolicyLongrunning][google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning] rpc
	// instead.
	//
	// For example, if the request analyzes for which resources user A has
	// permission P, and there's an IAM policy states user A has
	// iam.serviceAccounts.getAccessToken permission to a service account SA,
	// and there's another IAM policy states service account SA has permission P
	// to a GCP folder F, then user A potentially has access to the GCP folder
	// F. And those advanced analysis results will be included in
	// [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
	//
	// Another example, if the request analyzes for who has
	// permission P to a GCP folder F, and there's an IAM policy states user A
	// has iam.serviceAccounts.actAs permission to a service account SA, and
	// there's another IAM policy states service account SA has permission P to
	// the GCP folder F, then user A potentially has access to the GCP folder
	// F. And those advanced analysis results will be included in
	// [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
	//
	// Default is false.
	AnalyzeServiceAccountImpersonation bool `` /* 168-byte string literal not displayed */
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_ResourceSelector struct {

	// Required. The [full resource name]
	// (https://cloud.google.com/asset-inventory/docs/resource-name-format)
	// of a resource of [supported resource
	// types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#analyzable_asset_types).
	FullResourceName string `protobuf:"bytes,1,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult struct {

	// The [full resource
	// name](https://cloud.google.com/asset-inventory/docs/resource-name-format)
	// of the resource to which the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] policy attaches.
	AttachedResourceFullName string `` /* 137-byte string literal not displayed */
	// The Cloud IAM policy binding under analysis.
	IamBinding *v1.Binding `protobuf:"bytes,2,opt,name=iam_binding,json=iamBinding,proto3" json:"iam_binding,omitempty"`
	// The access control lists derived from the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] that match or
	// potentially match resource and access selectors specified in the request.
	AccessControlLists []*IamPolicyAnalysisResult_AccessControlList `protobuf:"bytes,3,rep,name=access_control_lists,json=accessControlLists,proto3" json:"access_control_lists,omitempty"`
	// The identity list derived from members of the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] that match or
	// potentially match identity selector specified in the request.
	IdentityList *IamPolicyAnalysisResult_IdentityList `protobuf:"bytes,4,opt,name=identity_list,json=identityList,proto3" json:"identity_list,omitempty"`
	// Represents whether all analyses on the [iam_binding][google.cloud.asset.v1.IamPolicyAnalysisResult.iam_binding] have successfully
	// finished.
	FullyExplored bool `protobuf:"varint,5,opt,name=fully_explored,json=fullyExplored,proto3" json:"fully_explored,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Access struct {

	// Types that are assignable to OneofAccess:
	//	*IamPolicyAnalysisResult_Access_Role
	//	*IamPolicyAnalysisResult_Access_Permission
	OneofAccess isIamPolicyAnalysisResult_Access_OneofAccess `protobuf_oneof:"oneof_access"`
	// The analysis state of this access.
	AnalysisState *IamPolicyAnalysisState `protobuf:"bytes,3,opt,name=analysis_state,json=analysisState,proto3" json:"analysis_state,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_AccessControlList struct {

	// The resources that match one of the following conditions:
	// - The resource_selector, if it is specified in request;
	// - Otherwise, resources reachable from the policy attached resource.
	Resources []*IamPolicyAnalysisResult_Resource `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
	// The accesses that match one of the following conditions:
	// - The access_selector, if it is specified in request;
	// - Otherwise, access specifiers reachable from the policy binding's role.
	Accesses []*IamPolicyAnalysisResult_Access `protobuf:"bytes,2,rep,name=accesses,proto3" json:"accesses,omitempty"`
	// Resource edges of the graph starting from the policy attached
	// resource to any descendant resources. The [Edge.source_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.source_node] contains
	// the full resource name of a parent resource and [Edge.target_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.target_node]
	// contains the full resource name of a child resource. This field is
	// present only if the output_resource_edges option is enabled in request.
	ResourceEdges []*IamPolicyAnalysisResult_Edge `protobuf:"bytes,3,rep,name=resource_edges,json=resourceEdges,proto3" json:"resource_edges,omitempty"`
	// Condition evaluation for this AccessControlList, if there is a condition
	// defined in the above IAM policy binding.
	ConditionEvaluation *ConditionEvaluation `protobuf:"bytes,4,opt,name=condition_evaluation,json=conditionEvaluation,proto3" json:"condition_evaluation,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Access_Permission struct {
	// The permission.
	Permission string `protobuf:"bytes,2,opt,name=permission,proto3,oneof"`
}

type IamPolicyAnalysisResult_Access_Role struct {
	// The role.
	Role string `protobuf:"bytes,1,opt,name=role,proto3,oneof"`
}

type IamPolicyAnalysisResult_Edge struct {

	// The source node of the edge. For example, it could be a full resource
	// name for a resource node or an email of an identity.
	SourceNode string `protobuf:"bytes,1,opt,name=source_node,json=sourceNode,proto3" json:"source_node,omitempty"`
	// The target node of the edge. For example, it could be a full resource
	// name for a resource node or an email of an identity.
	TargetNode string `protobuf:"bytes,2,opt,name=target_node,json=targetNode,proto3" json:"target_node,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Identity struct {

	// The identity name in any form of members appear in
	// [IAM policy
	// binding](https://cloud.google.com/iam/reference/rest/v1/Binding), such
	// as:
	// - user:foo@google.com
	// - group:group1@google.com
	// - serviceAccount:s1@prj1.iam.gserviceaccount.com
	// - projectOwner:some_project_id
	// - domain:google.com
	// - allUsers
	// - etc.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The analysis state of this identity.
	AnalysisState *IamPolicyAnalysisState `protobuf:"bytes,2,opt,name=analysis_state,json=analysisState,proto3" json:"analysis_state,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_IdentityList struct {

	// Only the identities that match one of the following conditions will be
	// presented:
	// - The identity_selector, if it is specified in request;
	// - Otherwise, identities reachable from the policy binding's members.
	Identities []*IamPolicyAnalysisResult_Identity `protobuf:"bytes,1,rep,name=identities,proto3" json:"identities,omitempty"`
	// Group identity edges of the graph starting from the binding's
	// group members to any node of the [identities][google.cloud.asset.v1.IamPolicyAnalysisResult.IdentityList.identities]. The [Edge.source_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.source_node]
	// contains a group, such as `group:parent@google.com`. The
	// [Edge.target_node][google.cloud.asset.v1.IamPolicyAnalysisResult.Edge.target_node] contains a member of the group,
	// such as `group:child@google.com` or `user:foo@google.com`.
	// This field is present only if the output_group_edges option is enabled in
	// request.
	GroupEdges []*IamPolicyAnalysisResult_Edge `protobuf:"bytes,2,rep,name=group_edges,json=groupEdges,proto3" json:"group_edges,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Resource struct {

	// The [full resource
	// name](https://cloud.google.com/asset-inventory/docs/resource-name-format)
	FullResourceName string `protobuf:"bytes,1,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// The analysis state of this resource.
	AnalysisState *IamPolicyAnalysisState `protobuf:"bytes,2,opt,name=analysis_state,json=analysisState,proto3" json:"analysis_state,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisState struct {

	// The Google standard error code that best describes the state.
	// For example:
	// - OK means the analysis on this entity has been successfully finished;
	// - PERMISSION_DENIED means an access denied error is encountered;
	// - DEADLINE_EXCEEDED means the analysis on this entity hasn't been started
	// in time;
	Code code.Code `protobuf:"varint,1,opt,name=code,proto3,enum=google.rpc.Code" json:"code,omitempty"`
	// The human-readable description of the cause of failure.
	Cause string `protobuf:"bytes,2,opt,name=cause,proto3" json:"cause,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicySearchResult struct {

	// The full resource name of the resource associated with this IAM policy.
	// Example:
	// `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.
	// See [Cloud Asset Inventory Resource Name
	// Format](https://cloud.google.com/asset-inventory/docs/resource-name-format)
	// for more information.
	//
	// To search against the `resource`:
	//
	// * use a field query. Example: `resource:organizations/123`
	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// The project that the associated GCP resource belongs to, in the form of
	// projects/{PROJECT_NUMBER}. If an IAM policy is set on a resource (like VM
	// instance, Cloud Storage bucket), the project field will indicate the
	// project that contains the resource. If an IAM policy is set on a folder or
	// orgnization, this field will be empty.
	//
	// To search against the `project`:
	//
	// * specify the `scope` field as this project in your search request.
	Project string `protobuf:"bytes,2,opt,name=project,proto3" json:"project,omitempty"`
	// The IAM policy directly set on the given resource. Note that the original
	// IAM policy can contain multiple bindings. This only contains the bindings
	// that match the given query. For queries that don't contain a constrain on
	// policies (e.g., an empty query), this contains all the bindings.
	//
	// To search against the `policy` bindings:
	//
	// * use a field query:
	//     - query by the policy contained members. Example:
	//       `policy:amy@gmail.com`
	//     - query by the policy contained roles. Example:
	//       `policy:roles/compute.admin`
	//     - query by the policy contained roles' included permissions. Example:
	//       `policy.role.permissions:compute.instances.create`
	Policy *v1.Policy `protobuf:"bytes,3,opt,name=policy,proto3" json:"policy,omitempty"`
	// Explanation about the IAM policy search result. It contains additional
	// information to explain why the search result matches the query.
	Explanation *IamPolicySearchResult_Explanation `protobuf:"bytes,4,opt,name=explanation,proto3" json:"explanation,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicySearchResult_Explanation struct {

	// The map from roles to their included permissions that match the
	// permission query (i.e., a query containing `policy.role.permissions:`).
	// Example: if query `policy.role.permissions:compute.disk.get`
	// matches a policy binding that contains owner role, the
	// matched_permissions will be `{"roles/owner": ["compute.disk.get"]}`. The
	// roles can also be found in the returned `policy` bindings. Note that the
	// map is populated only for requests with permission queries.
	MatchedPermissions map[string]*IamPolicySearchResult_Explanation_Permissions `` /* 203-byte string literal not displayed */
	// contains filtered or unexported fields
}

type IamPolicySearchResult_Explanation_Permissions struct {

	// A list of permissions. A sample permission string: `compute.disk.get`.
	Permissions []string `protobuf:"bytes,1,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

type ListAssetsRequest struct {

	// Required. Name of the organization or project the assets belong to. Format:
	// "organizations/[organization-number]" (such as "organizations/123"),
	// "projects/[project-id]" (such as "projects/my-project-id"), or
	// "projects/[project-number]" (such as "projects/12345").
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Timestamp to take an asset snapshot. This can only be set to a timestamp
	// between the current time and the current time minus 35 days (inclusive).
	// If not specified, the current time will be used. Due to delays in resource
	// data collection and indexing, there is a volatile window during which
	// running the same query may get different results.
	ReadTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=read_time,json=readTime,proto3" json:"read_time,omitempty"`
	// A list of asset types to take a snapshot for. For example:
	// "compute.googleapis.com/Disk".
	//
	// Regular expression is also supported. For example:
	//
	// * "compute.googleapis.com.*" snapshots resources whose asset type starts
	// with "compute.googleapis.com".
	// * ".*Instance" snapshots resources whose asset type ends with "Instance".
	// * ".*Instance.*" snapshots resources whose asset type contains "Instance".
	//
	// See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported
	// regular expression syntax. If the regular expression does not match any
	// supported asset type, an INVALID_ARGUMENT error will be returned.
	//
	// If specified, only matching assets will be returned, otherwise, it will
	// snapshot all asset types. See [Introduction to Cloud Asset
	// Inventory](https://cloud.google.com/asset-inventory/docs/overview)
	// for all supported asset types.
	AssetTypes []string `protobuf:"bytes,3,rep,name=asset_types,json=assetTypes,proto3" json:"asset_types,omitempty"`
	// Asset content type. If not specified, no content but the asset name will
	// be returned.
	ContentType ContentType `` /* 134-byte string literal not displayed */
	// The maximum number of assets to be returned in a single response. Default
	// is 100, minimum is 1, and maximum is 1000.
	PageSize int32 `protobuf:"varint,5,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// The `next_page_token` returned from the previous `ListAssetsResponse`, or
	// unspecified for the first `ListAssetsRequest`. It is a continuation of a
	// prior `ListAssets` call, and the API should return the next page of assets.
	PageToken string `protobuf:"bytes,6,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListAssetsResponse struct {

	// Time the snapshot was taken.
	ReadTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=read_time,json=readTime,proto3" json:"read_time,omitempty"`
	// Assets.
	Assets []*Asset `protobuf:"bytes,2,rep,name=assets,proto3" json:"assets,omitempty"`
	// Token to retrieve the next page of results. It expires 72 hours after the
	// page token for the first page is generated. Set to empty if there are no
	// remaining results.
	NextPageToken string `protobuf:"bytes,3,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListFeedsRequest struct {

	// Required. The parent project/folder/organization whose feeds are to be
	// listed. It can only be using project/folder/organization number (such as
	// "folders/12345")", or a project ID (such as "projects/my-project-id").
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// contains filtered or unexported fields
}

type ListFeedsResponse struct {

	// A list of feeds.
	Feeds []*Feed `protobuf:"bytes,1,rep,name=feeds,proto3" json:"feeds,omitempty"`
	// contains filtered or unexported fields
}

type OutputConfig struct {

	// Asset export destination.
	//
	// Types that are assignable to Destination:
	//	*OutputConfig_GcsDestination
	//	*OutputConfig_BigqueryDestination
	Destination isOutputConfig_Destination `protobuf_oneof:"destination"`
	// contains filtered or unexported fields
}

type OutputConfig_BigqueryDestination struct {
	// Destination on BigQuery. The output table stores the fields in asset
	// proto as columns in BigQuery.
	BigqueryDestination *BigQueryDestination `protobuf:"bytes,2,opt,name=bigquery_destination,json=bigqueryDestination,proto3,oneof"`
}

type OutputConfig_GcsDestination struct {
	// Destination on Cloud Storage.
	GcsDestination *GcsDestination `protobuf:"bytes,1,opt,name=gcs_destination,json=gcsDestination,proto3,oneof"`
}

type OutputResult struct {

	// Asset export result.
	//
	// Types that are assignable to Result:
	//	*OutputResult_GcsResult
	Result isOutputResult_Result `protobuf_oneof:"result"`
	// contains filtered or unexported fields
}

type OutputResult_GcsResult struct {
	// Export result on Cloud Storage.
	GcsResult *GcsOutputResult `protobuf:"bytes,1,opt,name=gcs_result,json=gcsResult,proto3,oneof"`
}

type PartitionSpec struct {

	// The partition key for BigQuery partitioned table.
	PartitionKey PartitionSpec_PartitionKey `` /* 152-byte string literal not displayed */
	// contains filtered or unexported fields
}

type PartitionSpec_PartitionKey int32

type PubsubDestination struct {

	// The name of the Pub/Sub topic to publish to.
	// Example: `projects/PROJECT_ID/topics/TOPIC_ID`.
	Topic string `protobuf:"bytes,1,opt,name=topic,proto3" json:"topic,omitempty"`
	// contains filtered or unexported fields
}

type Resource struct {

	// The API version. Example: `v1`
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// The URL of the discovery document containing the resource's JSON schema.
	// Example:
	// `https://www.googleapis.com/discovery/v1/apis/compute/v1/rest`
	//
	// This value is unspecified for resources that do not have an API based on a
	// discovery document, such as Cloud Bigtable.
	DiscoveryDocumentUri string `protobuf:"bytes,2,opt,name=discovery_document_uri,json=discoveryDocumentUri,proto3" json:"discovery_document_uri,omitempty"`
	// The JSON schema name listed in the discovery document. Example:
	// `Project`
	//
	// This value is unspecified for resources that do not have an API based on a
	// discovery document, such as Cloud Bigtable.
	DiscoveryName string `protobuf:"bytes,3,opt,name=discovery_name,json=discoveryName,proto3" json:"discovery_name,omitempty"`
	// The REST URL for accessing the resource. An HTTP `GET` request using this
	// URL returns the resource itself. Example:
	// `https://cloudresourcemanager.googleapis.com/v1/projects/my-project-123`
	//
	// This value is unspecified for resources without a REST API.
	ResourceUrl string `protobuf:"bytes,4,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// The full name of the immediate parent of this resource. See
	// [Resource
	// Names](https://cloud.google.com/apis/design/resource_names#full_resource_name)
	// for more information.
	//
	// For Google Cloud assets, this value is the parent resource defined in the
	// [Cloud IAM policy
	// hierarchy](https://cloud.google.com/iam/docs/overview#policy_hierarchy).
	// Example:
	// `//cloudresourcemanager.googleapis.com/projects/my_project_123`
	//
	// For third-party assets, this field may be set differently.
	Parent string `protobuf:"bytes,5,opt,name=parent,proto3" json:"parent,omitempty"`
	// The content of the resource, in which some sensitive fields are removed
	// and may not be present.
	Data *structpb.Struct `protobuf:"bytes,6,opt,name=data,proto3" json:"data,omitempty"`
	// The location of the resource in Google Cloud, such as its zone and region.
	// For more information, see https://cloud.google.com/about/locations/.
	Location string `protobuf:"bytes,8,opt,name=location,proto3" json:"location,omitempty"`
	// contains filtered or unexported fields
}

type ResourceSearchResult struct {

	// The full resource name of this resource. Example:
	// `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.
	// See [Cloud Asset Inventory Resource Name
	// Format](https://cloud.google.com/asset-inventory/docs/resource-name-format)
	// for more information.
	//
	// To search against the `name`:
	//
	// * use a field query. Example: `name:instance1`
	// * use a free text query. Example: `instance1`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The type of this resource. Example: `compute.googleapis.com/Disk`.
	//
	// To search against the `asset_type`:
	//
	// * specify the `asset_type` field in your search request.
	AssetType string `protobuf:"bytes,2,opt,name=asset_type,json=assetType,proto3" json:"asset_type,omitempty"`
	// The project that this resource belongs to, in the form of
	// projects/{PROJECT_NUMBER}. This field is available when the resource
	// belongs to a project.
	//
	// To search against `project`:
	//
	// * use a field query. Example: `project:12345`
	// * use a free text query. Example: `12345`
	// * specify the `scope` field as this project in your search request.
	Project string `protobuf:"bytes,3,opt,name=project,proto3" json:"project,omitempty"`
	// The folder(s) that this resource belongs to, in the form of
	// folders/{FOLDER_NUMBER}. This field is available when the resource
	// belongs to one or more folders.
	//
	// To search against `folders`:
	//
	// * use a field query. Example: `folders:(123 OR 456)`
	// * use a free text query. Example: `123`
	// * specify the `scope` field as this folder in your search request.
	Folders []string `protobuf:"bytes,17,rep,name=folders,proto3" json:"folders,omitempty"`
	// The organization that this resource belongs to, in the form of
	// organizations/{ORGANIZATION_NUMBER}. This field is available when the
	// resource belongs to an organization.
	//
	// To search against `organization`:
	//
	// * use a field query. Example: `organization:123`
	// * use a free text query. Example: `123`
	// * specify the `scope` field as this organization in your search request.
	Organization string `protobuf:"bytes,18,opt,name=organization,proto3" json:"organization,omitempty"`
	// The display name of this resource. This field is available only when the
	// resource's proto contains it.
	//
	// To search against the `display_name`:
	//
	// * use a field query. Example: `displayName:"My Instance"`
	// * use a free text query. Example: `"My Instance"`
	DisplayName string `protobuf:"bytes,4,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// One or more paragraphs of text description of this resource. Maximum length
	// could be up to 1M bytes. This field is available only when the resource's
	// proto contains it.
	//
	// To search against the `description`:
	//
	// * use a field query. Example: `description:"important instance"`
	// * use a free text query. Example: `"important instance"`
	Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
	// Location can be `global`, regional like `us-east1`, or zonal like
	// `us-west1-b`. This field is available only when the resource's proto
	// contains it.
	//
	// To search against the `location`:
	//
	// * use a field query. Example: `location:us-west*`
	// * use a free text query. Example: `us-west*`
	Location string `protobuf:"bytes,6,opt,name=location,proto3" json:"location,omitempty"`
	// Labels associated with this resource. See [Labelling and grouping GCP
	// resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources)
	// for more information. This field is available only when the resource's
	// proto contains it.
	//
	// To search against the `labels`:
	//
	// * use a field query:
	//     - query on any label's key or value. Example: `labels:prod`
	//     - query by a given label. Example: `labels.env:prod`
	//     - query by a given label's existence. Example: `labels.env:*`
	// * use a free text query. Example: `prod`
	Labels map[string]string `` /* 153-byte string literal not displayed */
	// Network tags associated with this resource. Like labels, network tags are a
	// type of annotations used to group GCP resources. See [Labelling GCP
	// resources](https://cloud.google.com/blog/products/gcp/labelling-and-grouping-your-google-cloud-platform-resources)
	// for more information. This field is available only when the resource's
	// proto contains it.
	//
	// To search against the `network_tags`:
	//
	// * use a field query. Example: `networkTags:internal`
	// * use a free text query. Example: `internal`
	NetworkTags []string `protobuf:"bytes,8,rep,name=network_tags,json=networkTags,proto3" json:"network_tags,omitempty"`
	// The Cloud KMS
	// [CryptoKey](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys?hl=en)
	// name or
	// [CryptoKeyVersion](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys.cryptoKeyVersions?hl=en)
	// name. This field is available only when the resource's proto contains it.
	//
	// To search against the `kms_key`:
	//
	// * use a field query. Example: `kmsKey:key`
	// * use a free text query. Example: `key`
	KmsKey string `protobuf:"bytes,10,opt,name=kms_key,json=kmsKey,proto3" json:"kms_key,omitempty"`
	// The create timestamp of this resource, at which the resource was created.
	// The granularity is in seconds. Timestamp.nanos will always be 0. This field
	// is available only when the resource's proto contains it.
	//
	// To search against `create_time`:
	//
	// * use a field query.
	//     - value in seconds since unix epoch. Example: `createTime > 1609459200`
	//     - value in date string. Example: `createTime > 2021-01-01`
	//     - value in date-time string (must be quoted). Example: `createTime >
	//     "2021-01-01T00:00:00"`
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// The last update timestamp of this resource, at which the resource was last
	// modified or deleted. The granularity is in seconds. Timestamp.nanos will
	// always be 0. This field is available only when the resource's proto
	// contains it.
	//
	// To search against `update_time`:
	//
	// * use a field query.
	//     - value in seconds since unix epoch. Example: `updateTime < 1609459200`
	//     - value in date string. Example: `updateTime < 2021-01-01`
	//     - value in date-time string (must be quoted). Example: `updateTime <
	//     "2021-01-01T00:00:00"`
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// The state of this resource. Different resources types have different state
	// definitions that are mapped from various fields of different resource
	// types. This field is available only when the resource's proto contains it.
	//
	// Example:
	// If the resource is an instance provided by Compute Engine,
	// its state will include PROVISIONING, STAGING, RUNNING, STOPPING,
	// SUSPENDING, SUSPENDED, REPAIRING, and TERMINATED. See `status` definition
	// in [API
	// Reference](https://cloud.google.com/compute/docs/reference/rest/v1/instances).
	// If the resource is a project provided by Cloud Resource Manager, its state
	// will include LIFECYCLE_STATE_UNSPECIFIED, ACTIVE, DELETE_REQUESTED and
	// DELETE_IN_PROGRESS. See `lifecycleState` definition in [API
	// Reference](https://cloud.google.com/resource-manager/reference/rest/v1/projects).
	//
	// To search against the `state`:
	//
	// * use a field query. Example: `state:RUNNING`
	// * use a free text query. Example: `RUNNING`
	State string `protobuf:"bytes,13,opt,name=state,proto3" json:"state,omitempty"`
	// The additional searchable attributes of this resource. The attributes may
	// vary from one resource type to another. Examples: `projectId` for Project,
	// `dnsName` for DNS ManagedZone. This field contains a subset of the resource
	// metadata fields that are returned by the List or Get APIs provided by the
	// corresponding GCP service (e.g., Compute Engine). see [API references and
	// supported searchable
	// attributes](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types)
	// to see which fields are included.
	//
	// You can search values of these fields through free text search. However,
	// you should not consume the field programically as the field names and
	// values may change as the GCP service updates to a new incompatible API
	// version.
	//
	// To search against the `additional_attributes`:
	//
	// * use a free text query to match the attributes values. Example: to search
	//   `additional_attributes = { dnsName: "foobar" }`, you can issue a query
	//   `foobar`.
	AdditionalAttributes *structpb.Struct `protobuf:"bytes,9,opt,name=additional_attributes,json=additionalAttributes,proto3" json:"additional_attributes,omitempty"`
	// The full resource name of this resource's parent, if it has one.
	// To search against the `parent_full_resource_name`:
	//
	// * use a field query. Example:
	// `parentFullResourceName:"project-name"`
	// * use a free text query. Example:
	// `project-name`
	ParentFullResourceName string `` /* 132-byte string literal not displayed */
	// The type of this resource's immediate parent, if there is one.
	//
	// To search against the `parent_asset_type`:
	//
	// * use a field query. Example:
	// `parentAssetType:"cloudresourcemanager.googleapis.com/Project"`
	// * use a free text query. Example:
	// `cloudresourcemanager.googleapis.com/Project`
	ParentAssetType string `protobuf:"bytes,103,opt,name=parent_asset_type,json=parentAssetType,proto3" json:"parent_asset_type,omitempty"`
	// contains filtered or unexported fields
}