As of January 1, 2020 this library no longer supports Python 2 on the latest released version.
Library versions released prior to that date will continue to be available. For more information please
visit Python 2 support on Google Cloud.
Source code for google.cloud.asset_v1p4beta1.types.assets
# -*- coding: utf-8 -*-
# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
import proto # type: ignore
from google.iam.v1 import policy_pb2 # type: ignore
from google.rpc import code_pb2 # type: ignore
__protobuf__ = proto.module(
package="google.cloud.asset.v1p4beta1", manifest={"IamPolicyAnalysisResult",},
)
[docs]class IamPolicyAnalysisResult(proto.Message):
r"""IAM Policy analysis result, consisting of one IAM policy
binding and derived access control lists.
Attributes:
attached_resource_full_name (str):
The full name of the resource to which the
[iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding]
policy attaches.
iam_binding (google.iam.v1.policy_pb2.Binding):
The Cloud IAM policy binding under analysis.
access_control_lists (Sequence[google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.AccessControlList]):
The access control lists derived from the
[iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding]
that match or potentially match resource and access
selectors specified in the request.
identity_list (google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.IdentityList):
The identity list derived from members of the
[iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding]
that match or potentially match identity selector specified
in the request.
fully_explored (bool):
Represents whether all nodes in the transitive closure of
the
[iam_binding][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.iam_binding]
node have been explored.
"""
[docs] class AnalysisState(proto.Message):
r"""Represents analysis state of each node in the result graph or
non-critical errors in the response.
Attributes:
code (google.rpc.code_pb2.Code):
The Google standard error code that best describes the
state. For example:
- OK means the node has been successfully explored;
- PERMISSION_DENIED means an access denied error is
encountered;
- DEADLINE_EXCEEDED means the node hasn't been explored in
time;
cause (str):
The human-readable description of the cause
of failure.
"""
code = proto.Field(proto.ENUM, number=1, enum=code_pb2.Code,)
cause = proto.Field(proto.STRING, number=2,)
[docs] class Resource(proto.Message):
r"""A GCP resource that appears in an access control list.
Attributes:
full_resource_name (str):
The `full resource
name <https://aip.dev/122#full-resource-names>`__.
analysis_state (google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.AnalysisState):
The analysis state of this resource node.
"""
full_resource_name = proto.Field(proto.STRING, number=1,)
analysis_state = proto.Field(
proto.MESSAGE, number=2, message="IamPolicyAnalysisResult.AnalysisState",
)
[docs] class Access(proto.Message):
r"""A role or permission that appears in an access control list.
Attributes:
role (str):
The role.
permission (str):
The permission.
analysis_state (google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.AnalysisState):
The analysis state of this access node.
"""
role = proto.Field(proto.STRING, number=1, oneof="oneof_access",)
permission = proto.Field(proto.STRING, number=2, oneof="oneof_access",)
analysis_state = proto.Field(
proto.MESSAGE, number=3, message="IamPolicyAnalysisResult.AnalysisState",
)
[docs] class Edge(proto.Message):
r"""A directional edge.
Attributes:
source_node (str):
The source node of the edge.
target_node (str):
The target node of the edge.
"""
source_node = proto.Field(proto.STRING, number=1,)
target_node = proto.Field(proto.STRING, number=2,)
[docs] class Identity(proto.Message):
r"""An identity that appears in an access control list.
Attributes:
name (str):
The identity name in any form of members appear in `IAM
policy
binding <https://cloud.google.com/iam/reference/rest/v1/Binding>`__,
such as:
- user:foo@google.com
- group:group1@google.com
- serviceAccount:s1@prj1.iam.gserviceaccount.com
- projectOwner:some_project_id
- domain:google.com
- allUsers
- etc.
analysis_state (google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.AnalysisState):
The analysis state of this identity node.
"""
name = proto.Field(proto.STRING, number=1,)
analysis_state = proto.Field(
proto.MESSAGE, number=2, message="IamPolicyAnalysisResult.AnalysisState",
)
[docs] class AccessControlList(proto.Message):
r"""An access control list, derived from the above IAM policy binding,
which contains a set of resources and accesses. May include one item
from each set to compose an access control entry.
NOTICE that there could be multiple access control lists for one IAM
policy binding. The access control lists are created based on
resource and access combinations.
For example, assume we have the following cases in one IAM policy
binding:
- Permission P1 and P2 apply to resource R1 and R2;
- Permission P3 applies to resource R2 and R3;
This will result in the following access control lists:
- AccessControlList 1: [R1, R2], [P1, P2]
- AccessControlList 2: [R2, R3], [P3]
Attributes:
resources (Sequence[google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.Resource]):
The resources that match one of the following conditions:
- The resource_selector, if it is specified in request;
- Otherwise, resources reachable from the policy attached
resource.
accesses (Sequence[google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.Access]):
The accesses that match one of the following conditions:
- The access_selector, if it is specified in request;
- Otherwise, access specifiers reachable from the policy
binding's role.
resource_edges (Sequence[google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.Edge]):
Resource edges of the graph starting from the policy
attached resource to any descendant resources. The
[Edge.source_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.source_node]
contains the full resource name of a parent resource and
[Edge.target_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.target_node]
contains the full resource name of a child resource. This
field is present only if the output_resource_edges option is
enabled in request.
"""
resources = proto.RepeatedField(
proto.MESSAGE, number=1, message="IamPolicyAnalysisResult.Resource",
)
accesses = proto.RepeatedField(
proto.MESSAGE, number=2, message="IamPolicyAnalysisResult.Access",
)
resource_edges = proto.RepeatedField(
proto.MESSAGE, number=3, message="IamPolicyAnalysisResult.Edge",
)
[docs] class IdentityList(proto.Message):
r"""
Attributes:
identities (Sequence[google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.Identity]):
Only the identities that match one of the following
conditions will be presented:
- The identity_selector, if it is specified in request;
- Otherwise, identities reachable from the policy binding's
members.
group_edges (Sequence[google.cloud.asset_v1p4beta1.types.IamPolicyAnalysisResult.Edge]):
Group identity edges of the graph starting from the
binding's group members to any node of the
[identities][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.IdentityList.identities].
The
[Edge.source_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.source_node]
contains a group, such as "group:parent@google.com". The
[Edge.target_node][google.cloud.asset.v1p4beta1.IamPolicyAnalysisResult.Edge.target_node]
contains a member of the group, such as
"group:child@google.com" or "user:foo@google.com". This
field is present only if the output_group_edges option is
enabled in request.
"""
identities = proto.RepeatedField(
proto.MESSAGE, number=1, message="IamPolicyAnalysisResult.Identity",
)
group_edges = proto.RepeatedField(
proto.MESSAGE, number=2, message="IamPolicyAnalysisResult.Edge",
)
attached_resource_full_name = proto.Field(proto.STRING, number=1,)
iam_binding = proto.Field(proto.MESSAGE, number=2, message=policy_pb2.Binding,)
access_control_lists = proto.RepeatedField(
proto.MESSAGE, number=3, message=AccessControlList,
)
identity_list = proto.Field(proto.MESSAGE, number=4, message=IdentityList,)
fully_explored = proto.Field(proto.BOOL, number=5,)
__all__ = tuple(sorted(__protobuf__.manifest))