asset

type AnalyzeIamPolicyRequest struct {

	// Required. The request query.
	AnalysisQuery *IamPolicyAnalysisQuery `protobuf:"bytes,1,opt,name=analysis_query,json=analysisQuery,proto3" json:"analysis_query,omitempty"`
	// Optional. The request options.
	Options *AnalyzeIamPolicyRequest_Options `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyRequest_Options struct {

	// Optional. If true, the identities section of the result will expand any
	// Google groups appearing in an IAM policy binding.
	//
	// If [identity_selector][] is specified, the identity in the result will
	// be determined by the selector, and this flag will have no effect.
	//
	// Default is false.
	ExpandGroups bool `protobuf:"varint,1,opt,name=expand_groups,json=expandGroups,proto3" json:"expand_groups,omitempty"`
	// Optional. If true, the access section of result will expand any roles
	// appearing in IAM policy bindings to include their permissions.
	//
	// If [access_selector][] is specified, the access section of the result
	// will be determined by the selector, and this flag will have no effect.
	//
	// Default is false.
	ExpandRoles bool `protobuf:"varint,2,opt,name=expand_roles,json=expandRoles,proto3" json:"expand_roles,omitempty"`
	// Optional. If true, the resource section of the result will expand any
	// resource attached to an IAM policy to include resources lower in the
	// resource hierarchy.
	//
	// For example, if the request analyzes for which resources user A has
	// permission P, and the results include an IAM policy with P on a GCP
	// folder, the results will also include resources in that folder with
	// permission P.
	//
	// If [resource_selector][] is specified, the resource section of the result
	// will be determined by the selector, and this flag will have no effect.
	// Default is false.
	ExpandResources bool `protobuf:"varint,3,opt,name=expand_resources,json=expandResources,proto3" json:"expand_resources,omitempty"`
	// Optional. If true, the result will output resource edges, starting
	// from the policy attached resource, to any expanded resources.
	// Default is false.
	OutputResourceEdges bool `protobuf:"varint,4,opt,name=output_resource_edges,json=outputResourceEdges,proto3" json:"output_resource_edges,omitempty"`
	// Optional. If true, the result will output group identity edges, starting
	// from the binding's group members, to any expanded identities.
	// Default is false.
	OutputGroupEdges bool `protobuf:"varint,5,opt,name=output_group_edges,json=outputGroupEdges,proto3" json:"output_group_edges,omitempty"`
	// Optional. If true, the response will include access analysis from identities to
	// resources via service account impersonation. This is a very expensive
	// operation, because many derived queries will be executed. We highly
	// recommend you use ExportIamPolicyAnalysis rpc instead.
	//
	// For example, if the request analyzes for which resources user A has
	// permission P, and there's an IAM policy states user A has
	// iam.serviceAccounts.getAccessToken permission to a service account SA,
	// and there's another IAM policy states service account SA has permission P
	// to a GCP folder F, then user A potentially has access to the GCP folder
	// F. And those advanced analysis results will be included in
	// [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
	//
	// Another example, if the request analyzes for who has
	// permission P to a GCP folder F, and there's an IAM policy states user A
	// has iam.serviceAccounts.actAs permission to a service account SA, and
	// there's another IAM policy states service account SA has permission P to
	// the GCP folder F, then user A potentially has access to the GCP folder
	// F. And those advanced analysis results will be included in
	// [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
	//
	// Default is false.
	AnalyzeServiceAccountImpersonation bool `` /* 168-byte string literal not displayed */
	// Optional. Amount of time executable has to complete.  See JSON representation of
	// [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json).
	//
	// If this field is set with a value less than the RPC deadline, and the
	// execution of your query hasn't finished in the specified
	// execution timeout,  you will get a response with partial result.
	// Otherwise, your query's execution will continue until the RPC deadline.
	// If it's not finished until then, you will get a  DEADLINE_EXCEEDED error.
	//
	// Default is empty.
	ExecutionTimeout *durationpb.Duration `protobuf:"bytes,7,opt,name=execution_timeout,json=executionTimeout,proto3" json:"execution_timeout,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyResponse struct {

	// The main analysis that matches the original request.
	MainAnalysis *AnalyzeIamPolicyResponse_IamPolicyAnalysis `protobuf:"bytes,1,opt,name=main_analysis,json=mainAnalysis,proto3" json:"main_analysis,omitempty"`
	// The service account impersonation analysis if
	// [AnalyzeIamPolicyRequest.analyze_service_account_impersonation][] is
	// enabled.
	ServiceAccountImpersonationAnalysis []*AnalyzeIamPolicyResponse_IamPolicyAnalysis `` /* 170-byte string literal not displayed */
	// Represents whether all entries in the [main_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.main_analysis] and
	// [service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis] have been fully explored to
	// answer the query in the request.
	FullyExplored bool `protobuf:"varint,3,opt,name=fully_explored,json=fullyExplored,proto3" json:"fully_explored,omitempty"`
	// A list of non-critical errors happened during the request handling to
	// explain why `fully_explored` is false, or empty if no error happened.
	NonCriticalErrors []*IamPolicyAnalysisResult_AnalysisState `protobuf:"bytes,4,rep,name=non_critical_errors,json=nonCriticalErrors,proto3" json:"non_critical_errors,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeIamPolicyResponse_IamPolicyAnalysis struct {

	// The analysis query.
	AnalysisQuery *IamPolicyAnalysisQuery `protobuf:"bytes,1,opt,name=analysis_query,json=analysisQuery,proto3" json:"analysis_query,omitempty"`
	// A list of [IamPolicyAnalysisResult][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult] that matches the analysis query, or
	// empty if no result is found.
	AnalysisResults []*IamPolicyAnalysisResult `protobuf:"bytes,2,rep,name=analysis_results,json=analysisResults,proto3" json:"analysis_results,omitempty"`
	// Represents whether all entries in the [analysis_results][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.IamPolicyAnalysis.analysis_results] have been
	// fully explored to answer the query.
	FullyExplored bool `protobuf:"varint,3,opt,name=fully_explored,json=fullyExplored,proto3" json:"fully_explored,omitempty"`
	// contains filtered or unexported fields
}

type AssetServiceClient interface {
	// Analyzes IAM policies based on the specified request. Returns
	// a list of [IamPolicyAnalysisResult][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult] matching the request.
	AnalyzeIamPolicy(ctx context.Context, in *AnalyzeIamPolicyRequest, opts ...grpc.CallOption) (*AnalyzeIamPolicyResponse, error)
	// Exports IAM policy analysis based on the specified request. This API
	// implements the [google.longrunning.Operation][google.longrunning.Operation] API allowing you to keep
	// track of the export. The metadata contains the request to help callers to
	// map responses to requests.
	ExportIamPolicyAnalysis(ctx context.Context, in *ExportIamPolicyAnalysisRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
}

type AssetServiceServer interface {
	// Analyzes IAM policies based on the specified request. Returns
	// a list of [IamPolicyAnalysisResult][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult] matching the request.
	AnalyzeIamPolicy(context.Context, *AnalyzeIamPolicyRequest) (*AnalyzeIamPolicyResponse, error)
	// Exports IAM policy analysis based on the specified request. This API
	// implements the [google.longrunning.Operation][google.longrunning.Operation] API allowing you to keep
	// track of the export. The metadata contains the request to help callers to
	// map responses to requests.
	ExportIamPolicyAnalysis(context.Context, *ExportIamPolicyAnalysisRequest) (*longrunning.Operation, error)
}

type ExportIamPolicyAnalysisRequest struct {

	// Required. The request query.
	AnalysisQuery *IamPolicyAnalysisQuery `protobuf:"bytes,1,opt,name=analysis_query,json=analysisQuery,proto3" json:"analysis_query,omitempty"`
	// Optional. The request options.
	Options *ExportIamPolicyAnalysisRequest_Options `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// Required. Output configuration indicating where the results will be output to.
	OutputConfig *IamPolicyAnalysisOutputConfig `protobuf:"bytes,3,opt,name=output_config,json=outputConfig,proto3" json:"output_config,omitempty"`
	// contains filtered or unexported fields
}

type ExportIamPolicyAnalysisRequest_Options struct {

	// Optional. If true, the identities section of the result will expand any
	// Google groups appearing in an IAM policy binding.
	//
	// If [identity_selector][] is specified, the identity in the result will
	// be determined by the selector, and this flag will have no effect.
	//
	// Default is false.
	ExpandGroups bool `protobuf:"varint,1,opt,name=expand_groups,json=expandGroups,proto3" json:"expand_groups,omitempty"`
	// Optional. If true, the access section of result will expand any roles
	// appearing in IAM policy bindings to include their permissions.
	//
	// If [access_selector][] is specified, the access section of the result
	// will be determined by the selector, and this flag will have no effect.
	//
	// Default is false.
	ExpandRoles bool `protobuf:"varint,2,opt,name=expand_roles,json=expandRoles,proto3" json:"expand_roles,omitempty"`
	// Optional. If true, the resource section of the result will expand any
	// resource attached to an IAM policy to include resources lower in the
	// resource hierarchy.
	//
	// For example, if the request analyzes for which resources user A has
	// permission P, and the results include an IAM policy with P on a GCP
	// folder, the results will also include resources in that folder with
	// permission P.
	//
	// If [resource_selector][] is specified, the resource section of the result
	// will be determined by the selector, and this flag will have no effect.
	// Default is false.
	ExpandResources bool `protobuf:"varint,3,opt,name=expand_resources,json=expandResources,proto3" json:"expand_resources,omitempty"`
	// Optional. If true, the result will output resource edges, starting
	// from the policy attached resource, to any expanded resources.
	// Default is false.
	OutputResourceEdges bool `protobuf:"varint,4,opt,name=output_resource_edges,json=outputResourceEdges,proto3" json:"output_resource_edges,omitempty"`
	// Optional. If true, the result will output group identity edges, starting
	// from the binding's group members, to any expanded identities.
	// Default is false.
	OutputGroupEdges bool `protobuf:"varint,5,opt,name=output_group_edges,json=outputGroupEdges,proto3" json:"output_group_edges,omitempty"`
	// Optional. If true, the response will include access analysis from identities to
	// resources via service account impersonation. This is a very expensive
	// operation, because many derived queries will be executed.
	//
	// For example, if the request analyzes for which resources user A has
	// permission P, and there's an IAM policy states user A has
	// iam.serviceAccounts.getAccessToken permission to a service account SA,
	// and there's another IAM policy states service account SA has permission P
	// to a GCP folder F, then user A potentially has access to the GCP folder
	// F. And those advanced analysis results will be included in
	// [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
	//
	// Another example, if the request analyzes for who has
	// permission P to a GCP folder F, and there's an IAM policy states user A
	// has iam.serviceAccounts.actAs permission to a service account SA, and
	// there's another IAM policy states service account SA has permission P to
	// the GCP folder F, then user A potentially has access to the GCP folder
	// F. And those advanced analysis results will be included in
	// [AnalyzeIamPolicyResponse.service_account_impersonation_analysis][google.cloud.asset.v1p4beta1.AnalyzeIamPolicyResponse.service_account_impersonation_analysis].
	//
	// Default is false.
	AnalyzeServiceAccountImpersonation bool `` /* 168-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ExportIamPolicyAnalysisResponse struct {

	// Output configuration indicating where the results were output to.
	OutputConfig *IamPolicyAnalysisOutputConfig `protobuf:"bytes,1,opt,name=output_config,json=outputConfig,proto3" json:"output_config,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig struct {

	// IAM policy analysis export destination.
	//
	// Types that are assignable to Destination:
	//	*IamPolicyAnalysisOutputConfig_GcsDestination_
	Destination isIamPolicyAnalysisOutputConfig_Destination `protobuf_oneof:"destination"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig_GcsDestination struct {

	// Required. The uri of the Cloud Storage object. It's the same uri that is used by
	// gsutil. For example: "gs://bucket_name/object_name". See [Viewing and
	// Editing Object
	// Metadata](https://cloud.google.com/storage/docs/viewing-editing-metadata)
	// for more information.
	Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisOutputConfig_GcsDestination_ struct {
	// Destination on Cloud Storage.
	GcsDestination *IamPolicyAnalysisOutputConfig_GcsDestination `protobuf:"bytes,1,opt,name=gcs_destination,json=gcsDestination,proto3,oneof"`
}

type IamPolicyAnalysisQuery struct {

	// Required. The relative name of the root asset. Only resources and IAM policies within
	// the parent will be analyzed. This can only be an organization number (such
	// as "organizations/123") or a folder number (such as "folders/123").
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Optional. Specifies a resource for analysis. Leaving it empty means ANY.
	ResourceSelector *IamPolicyAnalysisQuery_ResourceSelector `protobuf:"bytes,2,opt,name=resource_selector,json=resourceSelector,proto3" json:"resource_selector,omitempty"`
	// Optional. Specifies an identity for analysis. Leaving it empty means ANY.
	IdentitySelector *IamPolicyAnalysisQuery_IdentitySelector `protobuf:"bytes,3,opt,name=identity_selector,json=identitySelector,proto3" json:"identity_selector,omitempty"`
	// Optional. Specifies roles or permissions for analysis. Leaving it empty
	// means ANY.
	AccessSelector *IamPolicyAnalysisQuery_AccessSelector `protobuf:"bytes,4,opt,name=access_selector,json=accessSelector,proto3" json:"access_selector,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_AccessSelector struct {

	// Optional. The roles to appear in result.
	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	// Optional. The permissions to appear in result.
	Permissions []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_IdentitySelector struct {

	// Required. The identity appear in the form of members in
	// [IAM policy
	// binding](https://cloud.google.com/iam/reference/rest/v1/Binding).
	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisQuery_ResourceSelector struct {

	// Required. The [full resource
	// name](https://cloud.google.com/apis/design/resource_names#full_resource_name)
	// .
	FullResourceName string `protobuf:"bytes,1,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult struct {

	// The full name of the resource to which the [iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding] policy attaches.
	AttachedResourceFullName string `` /* 137-byte string literal not displayed */
	// The Cloud IAM policy binding under analysis.
	IamBinding *v1.Binding `protobuf:"bytes,2,opt,name=iam_binding,json=iamBinding,proto3" json:"iam_binding,omitempty"`
	// The access control lists derived from the [iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding] that match or
	// potentially match resource and access selectors specified in the request.
	AccessControlLists []*IamPolicyAnalysisResult_AccessControlList `protobuf:"bytes,3,rep,name=access_control_lists,json=accessControlLists,proto3" json:"access_control_lists,omitempty"`
	// The identity list derived from members of the [iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding] that match or
	// potentially match identity selector specified in the request.
	IdentityList *IamPolicyAnalysisResult_IdentityList `protobuf:"bytes,4,opt,name=identity_list,json=identityList,proto3" json:"identity_list,omitempty"`
	// Represents whether all nodes in the transitive closure of the
	// [iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding] node have been explored.
	FullyExplored bool `protobuf:"varint,5,opt,name=fully_explored,json=fullyExplored,proto3" json:"fully_explored,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Access struct {

	// Types that are assignable to OneofAccess:
	//	*IamPolicyAnalysisResult_Access_Role
	//	*IamPolicyAnalysisResult_Access_Permission
	OneofAccess isIamPolicyAnalysisResult_Access_OneofAccess `protobuf_oneof:"oneof_access"`
	// The analysis state of this access node.
	AnalysisState *IamPolicyAnalysisResult_AnalysisState `protobuf:"bytes,3,opt,name=analysis_state,json=analysisState,proto3" json:"analysis_state,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_AccessControlList struct {

	// The resources that match one of the following conditions:
	// - The resource_selector, if it is specified in request;
	// - Otherwise, resources reachable from the policy attached resource.
	Resources []*IamPolicyAnalysisResult_Resource `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
	// The accesses that match one of the following conditions:
	// - The access_selector, if it is specified in request;
	// - Otherwise, access specifiers reachable from the policy binding's role.
	Accesses []*IamPolicyAnalysisResult_Access `protobuf:"bytes,2,rep,name=accesses,proto3" json:"accesses,omitempty"`
	// Resource edges of the graph starting from the policy attached
	// resource to any descendant resources. The [Edge.source_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.source_node] contains
	// the full resource name of a parent resource and [Edge.target_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.target_node]
	// contains the full resource name of a child resource. This field is
	// present only if the output_resource_edges option is enabled in request.
	ResourceEdges []*IamPolicyAnalysisResult_Edge `protobuf:"bytes,3,rep,name=resource_edges,json=resourceEdges,proto3" json:"resource_edges,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Access_Permission struct {
	// The permission.
	Permission string `protobuf:"bytes,2,opt,name=permission,proto3,oneof"`
}

type IamPolicyAnalysisResult_Access_Role struct {
	// The role.
	Role string `protobuf:"bytes,1,opt,name=role,proto3,oneof"`
}

type IamPolicyAnalysisResult_AnalysisState struct {

	// The Google standard error code that best describes the state.
	// For example:
	// - OK means the node has been successfully explored;
	// - PERMISSION_DENIED means an access denied error is encountered;
	// - DEADLINE_EXCEEDED means the node hasn't been explored in time;
	Code code.Code `protobuf:"varint,1,opt,name=code,proto3,enum=google.rpc.Code" json:"code,omitempty"`
	// The human-readable description of the cause of failure.
	Cause string `protobuf:"bytes,2,opt,name=cause,proto3" json:"cause,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Edge struct {

	// The source node of the edge.
	SourceNode string `protobuf:"bytes,1,opt,name=source_node,json=sourceNode,proto3" json:"source_node,omitempty"`
	// The target node of the edge.
	TargetNode string `protobuf:"bytes,2,opt,name=target_node,json=targetNode,proto3" json:"target_node,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Identity struct {

	// The identity name in any form of members appear in
	// [IAM policy
	// binding](https://cloud.google.com/iam/reference/rest/v1/Binding), such
	// as:
	// - user:foo@google.com
	// - group:group1@google.com
	// - serviceAccount:s1@prj1.iam.gserviceaccount.com
	// - projectOwner:some_project_id
	// - domain:google.com
	// - allUsers
	// - etc.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The analysis state of this identity node.
	AnalysisState *IamPolicyAnalysisResult_AnalysisState `protobuf:"bytes,2,opt,name=analysis_state,json=analysisState,proto3" json:"analysis_state,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_IdentityList struct {

	// Only the identities that match one of the following conditions will be
	// presented:
	// - The identity_selector, if it is specified in request;
	// - Otherwise, identities reachable from the policy binding's members.
	Identities []*IamPolicyAnalysisResult_Identity `protobuf:"bytes,1,rep,name=identities,proto3" json:"identities,omitempty"`
	// Group identity edges of the graph starting from the binding's
	// group members to any node of the [identities][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.IdentityList.identities]. The [Edge.source_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.source_node]
	// contains a group, such as "group:parent@google.com". The
	// [Edge.target_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.target_node] contains a member of the group,
	// such as "group:child@google.com" or "user:foo@google.com".
	// This field is present only if the output_group_edges option is enabled in
	// request.
	GroupEdges []*IamPolicyAnalysisResult_Edge `protobuf:"bytes,2,rep,name=group_edges,json=groupEdges,proto3" json:"group_edges,omitempty"`
	// contains filtered or unexported fields
}

type IamPolicyAnalysisResult_Resource struct {

	// The [full resource name](https://aip.dev/122#full-resource-names).
	FullResourceName string `protobuf:"bytes,1,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// The analysis state of this resource node.
	AnalysisState *IamPolicyAnalysisResult_AnalysisState `protobuf:"bytes,2,opt,name=analysis_state,json=analysisState,proto3" json:"analysis_state,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAssetServiceServer struct {
}