GlcoinCore/googleapis
1
0
Fork 0
mirror of https://github.com/googleapis/googleapis.git synced 2026-08-18 13:08:24 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: added APIs for SecurityPosture service

Browse source 
Clients will now have access to SecurityPosture service APIs.

PiperOrigin-RevId: 599452309
This commit is contained in:
Google APIs 2024-01-18 03:11:03 -08:00 • committed by Copybara-Service
parent 465a103d01
commit 006b770ca0
8 changed files with 1754 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

388
google/cloud/securityposture/v1/BUILD.bazel Normal file
View file

@ -0,0 +1,388 @@
# This file was automatically generated by BuildFileGenerator
# https://github.com/googleapis/rules_gapic/tree/master/bazel
# Most of the manual changes to this file will be overwritten.
# It's **only** allowed to change the following rule attribute values:
# - names of *_gapic_assembly_* rules
# - certain parameters of *_gapic_library rules, including but not limited to:
# * extra_protoc_parameters
# * extra_protoc_file_parameters
# The complete list of preserved parameters can be found in the source code.
# This is an API workspace, having public visibility by default makes perfect sense.
package(default_visibility = ["//visibility:public"])
##############################################################################
# Common
##############################################################################
load("@rules_proto//proto:defs.bzl", "proto_library")
load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info")
proto_library(
name = "securityposture_proto",
srcs = [
"org_policy_config.proto",
"org_policy_constraints.proto",
"securityposture.proto",
"sha_constraints.proto",
"sha_custom_config.proto",
],
deps = [
"//google/api:annotations_proto",
"//google/api:client_proto",
"//google/api:field_behavior_proto",
"//google/api:resource_proto",
"//google/longrunning:operations_proto",
"//google/type:expr_proto",
"@com_google_protobuf//:empty_proto",
"@com_google_protobuf//:field_mask_proto",
"@com_google_protobuf//:timestamp_proto",
],
)
proto_library_with_info(
name = "securityposture_proto_with_info",
deps = [
":securityposture_proto",
"//google/cloud/location:location_proto",
"//google/cloud:common_resources_proto",
],
)
##############################################################################
# Java
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"java_gapic_assembly_gradle_pkg",
"java_gapic_library",
"java_gapic_test",
"java_grpc_library",
"java_proto_library",
)
java_proto_library(
name = "securityposture_java_proto",
deps = [":securityposture_proto"],
)
java_grpc_library(
name = "securityposture_java_grpc",
srcs = [":securityposture_proto"],
deps = [":securityposture_java_proto"],
)
java_gapic_library(
name = "securityposture_java_gapic",
srcs = [":securityposture_proto_with_info"],
gapic_yaml = None,
grpc_service_config = "securityposture_v1_grpc_service_config.json",
rest_numeric_enums = True,
service_yaml = "securityposture_v1.yaml",
test_deps = [
"//google/cloud/location:location_java_grpc",
":securityposture_java_grpc",
],
transport = "grpc+rest",
deps = [
":securityposture_java_proto",
"//google/api:api_java_proto",
"//google/cloud/location:location_java_proto",
],
)
java_gapic_test(
name = "securityposture_java_gapic_test_suite",
test_classes = [
"com.google.cloud.securityposture.v1.SecurityPostureClientHttpJsonTest",
"com.google.cloud.securityposture.v1.SecurityPostureClientTest",
],
runtime_deps = [":securityposture_java_gapic_test"],
)
# Open Source Packages
java_gapic_assembly_gradle_pkg(
name = "google-cloud-securityposture-v1-java",
transport = "grpc+rest",
deps = [
":securityposture_java_gapic",
":securityposture_java_grpc",
":securityposture_java_proto",
":securityposture_proto",
],
include_samples = True,
)
##############################################################################
# Go
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"go_gapic_assembly_pkg",
"go_gapic_library",
"go_proto_library",
)
go_proto_library(
name = "securityposture_go_proto",
compilers = ["@io_bazel_rules_go//proto:go_grpc"],
importpath = "cloud.google.com/go/securityposture/apiv1/securityposturepb",
protos = [":securityposture_proto"],
deps = [
"//google/api:annotations_go_proto",
"//google/longrunning:longrunning_go_proto",
"//google/type:expr_go_proto",
],
)
go_gapic_library(
name = "securityposture_go_gapic",
srcs = [":securityposture_proto_with_info"],
grpc_service_config = "securityposture_v1_grpc_service_config.json",
importpath = "cloud.google.com/go/securityposture/apiv1;securityposture",
metadata = True,
release_level = "beta",
rest_numeric_enums = True,
service_yaml = "securityposture_v1.yaml",
transport = "grpc+rest",
deps = [
":securityposture_go_proto",
"//google/cloud/location:location_go_proto",
"//google/longrunning:longrunning_go_proto",
"@com_google_cloud_go_longrunning//:go_default_library",
"@com_google_cloud_go_longrunning//autogen:go_default_library",
],
)
# Open Source Packages
go_gapic_assembly_pkg(
name = "gapi-cloud-securityposture-v1-go",
deps = [
":securityposture_go_gapic",
":securityposture_go_gapic_srcjar-test.srcjar",
":securityposture_go_gapic_srcjar-metadata.srcjar",
":securityposture_go_gapic_srcjar-snippets.srcjar",
":securityposture_go_proto",
],
)
##############################################################################
# Python
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"py_gapic_assembly_pkg",
"py_gapic_library",
"py_test",
)
py_gapic_library(
name = "securityposture_py_gapic",
srcs = [":securityposture_proto"],
grpc_service_config = "securityposture_v1_grpc_service_config.json",
rest_numeric_enums = True,
service_yaml = "securityposture_v1.yaml",
transport = "grpc+rest",
deps = [],
)
py_test(
name = "securityposture_py_gapic_test",
srcs = [
"securityposture_py_gapic_pytest.py",
"securityposture_py_gapic_test.py",
],
legacy_create_init = False,
deps = [":securityposture_py_gapic"],
)
# Open Source Packages
py_gapic_assembly_pkg(
name = "securityposture-v1-py",
deps = [
":securityposture_py_gapic",
],
)
##############################################################################
# PHP
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"php_gapic_assembly_pkg",
"php_gapic_library",
"php_proto_library",
)
php_proto_library(
name = "securityposture_php_proto",
deps = [":securityposture_proto"],
)
php_gapic_library(
name = "securityposture_php_gapic",
srcs = [":securityposture_proto_with_info"],
grpc_service_config = "securityposture_v1_grpc_service_config.json",
rest_numeric_enums = True,
migration_mode = "NEW_SURFACE_ONLY",
service_yaml = "securityposture_v1.yaml",
transport = "grpc+rest",
deps = [
":securityposture_php_proto",
],
)
# Open Source Packages
php_gapic_assembly_pkg(
name = "google-cloud-securityposture-v1-php",
deps = [
":securityposture_php_gapic",
":securityposture_php_proto",
],
)
##############################################################################
# Node.js
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"nodejs_gapic_assembly_pkg",
"nodejs_gapic_library",
)
nodejs_gapic_library(
name = "securityposture_nodejs_gapic",
package_name = "@google-cloud/securityposture",
src = ":securityposture_proto_with_info",
extra_protoc_parameters = ["metadata"],
grpc_service_config = "securityposture_v1_grpc_service_config.json",
package = "google.cloud.securityposture.v1",
rest_numeric_enums = True,
service_yaml = "securityposture_v1.yaml",
transport = "grpc+rest",
deps = [],
)
nodejs_gapic_assembly_pkg(
name = "securityposture-v1-nodejs",
deps = [
":securityposture_nodejs_gapic",
":securityposture_proto",
],
)
##############################################################################
# Ruby
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"ruby_gapic_assembly_pkg",
"ruby_cloud_gapic_library",
"ruby_grpc_library",
"ruby_proto_library",
)
ruby_proto_library(
name = "securityposture_ruby_proto",
deps = [":securityposture_proto"],
)
ruby_grpc_library(
name = "securityposture_ruby_grpc",
srcs = [":securityposture_proto"],
deps = [":securityposture_ruby_proto"],
)
ruby_cloud_gapic_library(
name = "securityposture_ruby_gapic",
srcs = [":securityposture_proto_with_info"],
extra_protoc_parameters = [
"ruby-cloud-gem-name=google-cloud-securityposture-v1",
],
grpc_service_config = "securityposture_v1_grpc_service_config.json",
rest_numeric_enums = True,
service_yaml = "securityposture_v1.yaml",
transport = "grpc+rest",
deps = [
":securityposture_ruby_grpc",
":securityposture_ruby_proto",
],
)
# Open Source Packages
ruby_gapic_assembly_pkg(
name = "google-cloud-securityposture-v1-ruby",
deps = [
":securityposture_ruby_gapic",
":securityposture_ruby_grpc",
":securityposture_ruby_proto",
],
)
##############################################################################
# C#
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"csharp_gapic_assembly_pkg",
"csharp_gapic_library",
"csharp_grpc_library",
"csharp_proto_library",
)
csharp_proto_library(
name = "securityposture_csharp_proto",
extra_opts = [],
deps = [":securityposture_proto"],
)
csharp_grpc_library(
name = "securityposture_csharp_grpc",
srcs = [":securityposture_proto"],
deps = [":securityposture_csharp_proto"],
)
csharp_gapic_library(
name = "securityposture_csharp_gapic",
srcs = [":securityposture_proto_with_info"],
common_resources_config = "@gax_dotnet//:Google.Api.Gax/ResourceNames/CommonResourcesConfig.json",
grpc_service_config = "securityposture_v1_grpc_service_config.json",
rest_numeric_enums = True,
service_yaml = "securityposture_v1.yaml",
transport = "grpc+rest",
deps = [
":securityposture_csharp_grpc",
":securityposture_csharp_proto",
],
)
# Open Source Packages
csharp_gapic_assembly_pkg(
name = "google-cloud-securityposture-v1-csharp",
deps = [
":securityposture_csharp_gapic",
":securityposture_csharp_grpc",
":securityposture_csharp_proto",
],
)
##############################################################################
# C++
##############################################################################
load(
"@com_google_googleapis_imports//:imports.bzl",
"cc_grpc_library",
"cc_proto_library",
)
cc_proto_library(
name = "securityposture_cc_proto",
deps = [":securityposture_proto"],
)
cc_grpc_library(
name = "securityposture_cc_grpc",
srcs = [":securityposture_proto"],
grpc_only = True,
deps = [":securityposture_cc_proto"],
)

174
google/cloud/securityposture/v1/org_policy_config.proto Normal file
View file

@ -0,0 +1,174 @@
// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securityposture.v1;
import "google/api/field_behavior.proto";
import "google/protobuf/timestamp.proto";
import "google/type/expr.proto";
option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb";
option java_multiple_files = true;
option java_outer_classname = "OrgPolicyConfigProto";
option java_package = "com.google.cloud.securityposture.v1";
// A rule used to express this policy.
message PolicyRule {
// A message that holds specific allowed and denied values.
// This message can define specific values and subtrees of the Resource
// Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that
// are allowed or denied. This is achieved by using the `under:` and
// optional `is:` prefixes.
// The `under:` prefix is used to denote resource subtree values.
// The `is:` prefix is used to denote specific values, and is required only
// if the value contains a ":". Values prefixed with "is:" are treated the
// same as values with no prefix.
// Ancestry subtrees must be in one of the following formats:
//
// - `projects/<project-id>` (for example, `projects/tokyo-rain-123`)
// - `folders/<folder-id>` (for example, `folders/1234`)
// - `organizations/<organization-id>` (for example, `organizations/1234`)
//
// The `supports_under` field of the associated `Constraint` defines
// whether ancestry prefixes can be used.
message StringValues {
// List of values allowed at this resource.
repeated string allowed_values = 1;
// List of values denied at this resource.
repeated string denied_values = 2;
}
oneof kind {
// List of values to be used for this policy rule. This field can be set
// only in policies for list constraints.
StringValues values = 1;
// Setting this to true means that all values are allowed. This field can
// be set only in policies for list constraints.
bool allow_all = 2;
// Setting this to true means that all values are denied. This field can
// be set only in policies for list constraints.
bool deny_all = 3;
// If `true`, then the policy is enforced. If `false`, then any
// configuration is acceptable.
// This field can be set only in policies for boolean constraints.
bool enforce = 4;
}
// A condition which determines whether this rule is used
// in the evaluation of the policy. When set, the `expression` field in
// the `Expr' must include from 1 to 10 subexpressions, joined by the "||"
// or "&&" operators. Each subexpression must be of the form
// "resource.matchTag('<ORG_ID>/tag_key_short_name,
// 'tag_value_short_name')" or "resource.matchTagId('tagKeys/key_id',
// 'tagValues/value_id')" where key_name and value_name are the resource
// names for Label Keys and Values. These names are available from the Tag
// Manager Service. An example expression is:
// "resource.matchTag('123456789/environment,
// 'prod')" or "resource.matchTagId('tagKeys/123',
// 'tagValues/456')".
google.type.Expr condition = 5;
}
// A custom constraint defined by customers which can *only* be applied to the
// given resource types and organization.
//
// By creating a custom constraint, customers can apply policies of this
// custom constraint. *Creating a custom constraint itself does NOT apply any
// policy enforcement*.
message CustomConstraint {
// The operation for which this constraint will be applied. To apply this
// constraint only when creating new VMs, the `method_types` should be
// `CREATE` only. To apply this constraint when creating or deleting
// VMs, the `method_types` should be `CREATE` and `DELETE`.
//
// `UPDATE` only custom constraints are not supported. Use `CREATE` or
// `CREATE, UPDATE`.
enum MethodType {
// Unspecified. Results in an error.
METHOD_TYPE_UNSPECIFIED = 0;
// Constraint applied when creating the resource.
CREATE = 1;
// Constraint applied when updating the resource.
UPDATE = 2;
// Constraint applied when deleting the resource.
// Not supported yet.
DELETE = 3;
}
// Allow or deny type.
enum ActionType {
// Unspecified. Results in an error.
ACTION_TYPE_UNSPECIFIED = 0;
// Allowed action type.
ALLOW = 1;
// Deny action type.
DENY = 2;
}
// Immutable. Name of the constraint. This is unique within the organization.
// Format of the name should be
//
// -
// `organizations/{organization_id}/customConstraints/{custom_constraint_id}`
//
// Example: `organizations/123/customConstraints/custom.createOnlyE2TypeVms`
//
// The max length is 70 characters and the minimum length is 1. Note that the
// prefix `organizations/{organization_id}/customConstraints/` is not counted.
string name = 1 [(google.api.field_behavior) = IMMUTABLE];
// Immutable. The resource instance type on which this policy applies. Format
// will be of the form : `<canonical service name>/<type>` Example:
//
// - `compute.googleapis.com/Instance`.
repeated string resource_types = 2 [(google.api.field_behavior) = IMMUTABLE];
// All the operations being applied for this constraint.
repeated MethodType method_types = 3;
// Org policy condition/expression. For example:
// `resource.instanceName.matches("[production|test]_.*_(\d)+")` or,
// `resource.management.auto_upgrade == true`
//
// The max length of the condition is 1000 characters.
string condition = 4;
// Allow or deny type.
ActionType action_type = 5;
// One line display name for the UI.
// The max length of the display_name is 200 characters.
string display_name = 6;
// Detailed information about this custom policy constraint.
// The max length of the description is 2000 characters.
string description = 7;
// Output only. The last time this custom constraint was updated. This
// represents the last time that the `CreateCustomConstraint` or
// `UpdateCustomConstraint` RPC was called
google.protobuf.Timestamp update_time = 8
[(google.api.field_behavior) = OUTPUT_ONLY];
}

44
google/cloud/securityposture/v1/org_policy_constraints.proto Normal file
View file

@ -0,0 +1,44 @@
// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securityposture.v1;
import "google/api/field_behavior.proto";
import "google/cloud/securityposture/v1/org_policy_config.proto";
option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb";
option java_multiple_files = true;
option java_outer_classname = "OrgPolicyConstraintsProto";
option java_package = "com.google.cloud.securityposture.v1";
// Message for Org Policy Canned Constraint.
message OrgPolicyConstraint {
// Required. Org Policy Canned Constraint id.
string canned_constraint_id = 1 [(google.api.field_behavior) = REQUIRED];
// Required. Org PolicySpec rules.
repeated PolicyRule policy_rules = 2 [(google.api.field_behavior) = REQUIRED];
}
// Message for Org Policy Custom Constraint.
message OrgPolicyConstraintCustom {
// Required. Org Policy Custom Constraint.
CustomConstraint custom_constraint = 1
[(google.api.field_behavior) = REQUIRED];
// Required. Org Policyspec rules.
repeated PolicyRule policy_rules = 2 [(google.api.field_behavior) = REQUIRED];
}

849
google/cloud/securityposture/v1/securityposture.proto Normal file
View file

@ -0,0 +1,849 @@
// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securityposture.v1;
import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/securityposture/v1/org_policy_constraints.proto";
import "google/cloud/securityposture/v1/sha_constraints.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb";
option java_multiple_files = true;
option java_outer_classname = "V1mainProto";
option java_package = "com.google.cloud.securityposture.v1";
option (google.api.resource_definition) = {
type: "securitposture.googleapis.com/Organization"
pattern: "organizations/{organization}/locations/{location}"
};
// Service describing handlers for resources.
service SecurityPosture {
option (google.api.default_host) = "securityposture.googleapis.com";
option (google.api.oauth_scopes) =
"https://www.googleapis.com/auth/cloud-platform";
// (-- This option restricts the visibility of the API to only projects that
// will
// (-- be labeled as `PREVIEW` or `GOOGLE_INTERNAL` by the service.
// (-- option (google.api.api_visibility).restriction =
// "PREVIEW,GOOGLE_INTERNAL"; Postures Lists Postures in a given organization
// and location. In case a posture has multiple revisions, the latest revision
// as per UpdateTime will be returned.
rpc ListPostures(ListPosturesRequest) returns (ListPosturesResponse) {
option (google.api.http) = {
get: "/v1/{parent=organizations/*/locations/*}/postures"
};
option (google.api.method_signature) = "parent";
}
// Lists revisions of a Posture in a given organization and location.
rpc ListPostureRevisions(ListPostureRevisionsRequest)
returns (ListPostureRevisionsResponse) {
option (google.api.http) = {
get: "/v1/{name=organizations/*/locations/*/postures/*}:listRevisions"
};
}
// Gets a posture in a given organization and location.
// User must provide revision_id to retrieve a specific revision of the
// resource.
// NOT_FOUND error is returned if the revision_id or the Posture name does not
// exist. In case revision_id is not provided then the latest Posture revision
// by UpdateTime is returned.
rpc GetPosture(GetPostureRequest) returns (Posture) {
option (google.api.http) = {
get: "/v1/{name=organizations/*/locations/*/postures/*}"
};
option (google.api.method_signature) = "name";
}
// Creates a new Posture resource.
// If a Posture with the specified name already exists in the specified
// organization and location, the long running operation returns a
// [ALREADY_EXISTS][google.rpc.Code.ALREADY_EXISTS] error.
rpc CreatePosture(CreatePostureRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
post: "/v1/{parent=organizations/*/locations/*}/postures"
body: "posture"
};
option (google.api.method_signature) = "parent,posture,posture_id";
option (google.longrunning.operation_info) = {
response_type: "Posture"
metadata_type: "OperationMetadata"
};
}
// Updates an existing Posture.
// A new revision of the posture will be created if the revision to be
// updated is currently deployed on a workload.
// Returns a `google.rpc.Status` with `google.rpc.Code.NOT_FOUND` if the
// Posture does not exist.
// Returns a `google.rpc.Status` with `google.rpc.Code.ABORTED` if the etag
// supplied in the request does not match the persisted etag of the Posture.
// Updatable fields are state, description and policy_sets.
// State update operation cannot be clubbed with update of description and
// policy_sets.
// An ACTIVE posture can be updated to both DRAFT or DEPRECATED states.
// Postures in DRAFT or DEPRECATED states can only be updated to ACTIVE state.
rpc UpdatePosture(UpdatePostureRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
patch: "/v1/{posture.name=organizations/*/locations/*/postures/*}"
body: "posture"
};
option (google.api.method_signature) = "posture,update_mask";
option (google.longrunning.operation_info) = {
response_type: "Posture"
metadata_type: "OperationMetadata"
};
}
// Deletes all the revisions of a resource.
// A posture can only be deleted when none of the revisions are deployed to
// any workload.
rpc DeletePosture(DeletePostureRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
delete: "/v1/{name=organizations/*/locations/*/postures/*}"
};
option (google.api.method_signature) = "name";
option (google.longrunning.operation_info) = {
response_type: "google.protobuf.Empty"
metadata_type: "OperationMetadata"
};
}
// Extracts existing policies on a workload as a posture.
// If a Posture on the given workload already exists, the long running
// operation returns a [ALREADY_EXISTS][google.rpc.Code.ALREADY_EXISTS] error.
rpc ExtractPosture(ExtractPostureRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
post: "/v1/{parent=organizations/*/locations/*}/postures:extract"
body: "*"
};
option (google.api.method_signature) = "parent,posture_id,workload";
option (google.longrunning.operation_info) = {
response_type: "Posture"
metadata_type: "OperationMetadata"
};
}
// PostureDeployments
// Lists PostureDeployments in a given project and location.
rpc ListPostureDeployments(ListPostureDeploymentsRequest)
returns (ListPostureDeploymentsResponse) {
option (google.api.http) = {
get: "/v1/{parent=organizations/*/locations/*}/postureDeployments"
};
option (google.api.method_signature) = "parent";
}
// Gets details of a single PostureDeployment.
rpc GetPostureDeployment(GetPostureDeploymentRequest)
returns (PostureDeployment) {
option (google.api.http) = {
get: "/v1/{name=organizations/*/locations/*/postureDeployments/*}"
};
option (google.api.method_signature) = "name";
}
// Creates a new PostureDeployment in a given project and location.
rpc CreatePostureDeployment(CreatePostureDeploymentRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
post: "/v1/{parent=organizations/*/locations/*}/postureDeployments"
body: "posture_deployment"
};
option (google.api.method_signature) =
"parent,posture_deployment,posture_deployment_id";
option (google.longrunning.operation_info) = {
response_type: "PostureDeployment"
metadata_type: "OperationMetadata"
};
}
// Updates the parameters of a single PostureDeployment.
rpc UpdatePostureDeployment(UpdatePostureDeploymentRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
patch: "/v1/{posture_deployment.name=organizations/*/locations/*/postureDeployments/*}"
body: "posture_deployment"
};
option (google.api.method_signature) = "posture_deployment,update_mask";
option (google.longrunning.operation_info) = {
response_type: "PostureDeployment"
metadata_type: "OperationMetadata"
};
}
// Deletes a single PostureDeployment.
rpc DeletePostureDeployment(DeletePostureDeploymentRequest)
returns (google.longrunning.Operation) {
option (google.api.http) = {
delete: "/v1/{name=organizations/*/locations/*/postureDeployments/*}"
};
option (google.api.method_signature) = "name";
option (google.longrunning.operation_info) = {
response_type: "google.protobuf.Empty"
metadata_type: "OperationMetadata"
};
}
// PostureTemplates
// Lists all the PostureTemplates available to the user.
rpc ListPostureTemplates(ListPostureTemplatesRequest)
returns (ListPostureTemplatesResponse) {
option (google.api.http) = {
get: "/v1/{parent=organizations/*/locations/*}/postureTemplates"
};
option (google.api.method_signature) = "parent";
}
// Gets a PostureTemplate.
// User must provide revision_id to retrieve a specific revision of the
// resource.
// NOT_FOUND error is returned if the revision_id or the PostureTemplate name
// does not exist. In case revision_id is not provided then the
// PostureTemplate with latest revision_id is returned.
rpc GetPostureTemplate(GetPostureTemplateRequest) returns (PostureTemplate) {
option (google.api.http) = {
get: "/v1/{name=organizations/*/locations/*/postureTemplates/*}"
};
option (google.api.method_signature) = "name";
}
}
// Represents the metadata of the long-running operation.
message OperationMetadata {
// Output only. The time the operation was created.
google.protobuf.Timestamp create_time = 1
[(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. The time the operation finished running.
google.protobuf.Timestamp end_time = 2
[(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Server-defined resource path for the target of the operation.
string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Name of the verb executed by the operation.
string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Human-readable status of the operation, if any.
string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Identifies whether the user has requested cancellation
// of the operation. Operations that have been cancelled successfully
// have [Operation.error][] value with a
// [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to
// `Code.CANCELLED`.
bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. API version used to start the operation.
string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. This is a output only optional field which will be filled only
// in cases where PostureDeployments enter failure states like UPDATE_FAILED
// or CREATE_FAILED or DELETE_FAILED.
string error_message = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
}
// Postures
// Definition of a Posture.
message Posture {
option (google.api.resource) = {
type: "securityposture.googleapis.com/Posture"
pattern: "organizations/{organization}/locations/{location}/postures/{posture}"
plural: "postures"
singular: "posture"
style: DECLARATIVE_FRIENDLY
};
// State of a Posture.
enum State {
// Unspecified operation state.
STATE_UNSPECIFIED = 0;
// The Posture is marked deprecated when it is not in use by the user.
DEPRECATED = 1;
// The Posture is created successfully but is not yet ready for usage.
DRAFT = 2;
// The Posture state is active. Ready for use/deployments.
ACTIVE = 3;
}
// Required. Identifier. The name of this Posture resource, in the format of
// organizations/{org_id}/locations/{location_id}/postures/{posture}.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.field_behavior) = IDENTIFIER
];
// Required. State of Posture resource.
State state = 2 [(google.api.field_behavior) = REQUIRED];
// Output only. Immutable. The revision ID of the posture.
// The format is an 8-character hexadecimal string.
// https://google.aip.dev/162
string revision_id = 3 [
(google.api.field_behavior) = IMMUTABLE,
(google.api.field_behavior) = OUTPUT_ONLY
];
// Output only. The timestamp that the posture was created.
google.protobuf.Timestamp create_time = 4
[(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. The timestamp that the posture was updated.
google.protobuf.Timestamp update_time = 5
[(google.api.field_behavior) = OUTPUT_ONLY];
// Optional. User provided description of the posture.
string description = 6 [(google.api.field_behavior) = OPTIONAL];
// Required. List of Policy sets.
repeated PolicySet policy_sets = 7 [(google.api.field_behavior) = REQUIRED];
// Optional. An opaque tag indicating the current version of the Posture, used
// for concurrency control. When the `Posture` is returned from either a
// `GetPosture` or a `ListPostures` request, this `etag` indicates the version
// of the current `Posture` to use when executing a read-modify-write loop.
//
// When the `Posture` is used in a `UpdatePosture` method, use the `etag`
// value that was returned from a `GetPosture` request as part of a
// read-modify-write loop for concurrency control. Not setting the `etag` in a
// `UpdatePosture` request will result in an unconditional write of the
// `Posture`.
string etag = 8 [(google.api.field_behavior) = OPTIONAL];
// Optional. User annotations. These attributes can only be set and used by
// the user, and not by Google Security Postures.
// .
map<string, string> annotations = 9 [(google.api.field_behavior) = OPTIONAL];
// Output only. Whether or not this Posture is in the process of being
// updated.
bool reconciling = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
}
// PolicySet representation.
message PolicySet {
// Required. ID of the Policy set.
string policy_set_id = 1 [(google.api.field_behavior) = REQUIRED];
// Optional. Description of the Policy set.
string description = 2 [(google.api.field_behavior) = OPTIONAL];
// Required. List of policies.
repeated Policy policies = 3 [(google.api.field_behavior) = REQUIRED];
}
// Policy representation.
message Policy {
// Mapping for a Policy to standard and control.
message ComplianceStandard {
// Optional. The compliance standard that the Policy maps to, e.g.: CIS-2.0.
string standard = 1 [(google.api.field_behavior) = OPTIONAL];
// Optional. Control mapping provided by user for this Policy. e.g.: 1.5.
string control = 2 [(google.api.field_behavior) = OPTIONAL];
}
// Required. ID of the Policy that is user generated, immutable and unique
// within the scope of a policy set.
string policy_id = 1 [(google.api.field_behavior) = REQUIRED];
// Optional. Contains list of mapping for a Policy to a standard and control.
repeated ComplianceStandard compliance_standards = 2
[(google.api.field_behavior) = OPTIONAL];
// Required. Constraint details.
Constraint constraint = 3 [(google.api.field_behavior) = REQUIRED];
// Optional. Description of the Policy.
string description = 4 [(google.api.field_behavior) = OPTIONAL];
}
// Representation of a Constraint.
message Constraint {
oneof implementation {
// Optional. SHA built-in detector.
SecurityHealthAnalyticsModule security_health_analytics_module = 3
[(google.api.field_behavior) = OPTIONAL];
// Optional. SHA custom detector.
SecurityHealthAnalyticsCustomModule
security_health_analytics_custom_module = 4
[(google.api.field_behavior) = OPTIONAL];
// Optional. Org Policy builtin constraint.
OrgPolicyConstraint org_policy_constraint = 5
[(google.api.field_behavior) = OPTIONAL];
// Optional. Org Policy custom constraint.
OrgPolicyConstraintCustom org_policy_constraint_custom = 6
[(google.api.field_behavior) = OPTIONAL];
}
}
// Message for requesting list of Postures.
message ListPosturesRequest {
// Required. Parent value for ListPosturesRequest.
string parent = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
child_type: "securityposture.googleapis.com/Posture"
}
];
// Requested page size. Server may return fewer items than requested.
// If unspecified, server will pick an appropriate default.
int32 page_size = 2;
// A token identifying a page of results the server should return.
string page_token = 3;
}
// Message for response to listing Postures.
message ListPosturesResponse {
// The list of Posture.
repeated Posture postures = 1;
// A token identifying a page of results the server should return.
string next_page_token = 2;
// Unreachable resources.
repeated string unreachable = 3;
}
// Message for requesting list of Posture revisions.
message ListPostureRevisionsRequest {
// Required. Name value for ListPostureRevisionsRequest.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
type: "securityposture.googleapis.com/Posture"
}
];
// Optional. Requested page size. Server may return fewer items than
// requested. If unspecified, server will pick 100 as default.
int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
// Optional. A token identifying a page of results the server should return.
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}
// Message for response to listing PostureRevisions.
message ListPostureRevisionsResponse {
// The list of Posture revisions.
repeated Posture revisions = 1;
// A token identifying a page of results the server should return.
string next_page_token = 2;
}
// Message for getting a Posture.
message GetPostureRequest {
// Required. Name of the resource.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
type: "securityposture.googleapis.com/Posture"
}
];
// Optional. Posture revision which needs to be retrieved.
string revision_id = 3 [(google.api.field_behavior) = OPTIONAL];
}
// Message for creating a Posture.
message CreatePostureRequest {
// Required. Value for parent.
string parent = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
child_type: "securityposture.googleapis.com/Posture"
}
];
// Required. User provided identifier. It should be unique in scope of an
// Organization and location.
string posture_id = 2 [(google.api.field_behavior) = REQUIRED];
// Required. The resource being created.
Posture posture = 3 [(google.api.field_behavior) = REQUIRED];
}
// Message for updating a Posture.
message UpdatePostureRequest {
// Required. Field mask is used to specify the fields to be overwritten in the
// Posture resource by the update.
// The fields specified in the update_mask are relative to the resource, not
// the full request. A field will be overwritten if it is in the mask. If the
// user does not provide a mask then all fields will be overwritten.
google.protobuf.FieldMask update_mask = 1
[(google.api.field_behavior) = REQUIRED];
// Required. The resource being updated.
Posture posture = 2 [(google.api.field_behavior) = REQUIRED];
// Required. Posture revision which needs to be updated.
string revision_id = 3 [(google.api.field_behavior) = REQUIRED];
}
// Message for deleting a Posture.
message DeletePostureRequest {
// Required. Name of the resource.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
type: "securityposture.googleapis.com/Posture"
}
];
// Optional. Etag value of the Posture to be deleted.
string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}
// Message for extracting existing policies on a workload as a Posture.
message ExtractPostureRequest {
// Required. The parent resource name. The format of this value is as follows:
// `organizations/{organization}/locations/{location}`
string parent = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
child_type: "securityposture.googleapis.com/Posture"
}
];
// Required. User provided identifier. It should be unique in scope of an
// Organization and location.
string posture_id = 2 [(google.api.field_behavior) = REQUIRED];
// Required. Workload from which the policies are to be extracted, it should
// belong to the same organization defined in parent. The format of this value
// varies depending on the scope of the request:
// - `folder/folderNumber`
// - `project/projectNumber`
// - `organization/organizationNumber`
string workload = 3 [(google.api.field_behavior) = REQUIRED];
}
// ========================== PostureDeployments ==========================
// Message describing PostureDeployment resource.
message PostureDeployment {
option (google.api.resource) = {
type: "securityposture.googleapis.com/PostureDeployment"
pattern: "organizations/{organization}/locations/{location}/postureDeployments/{posture_deployment}"
plural: "postureDeployments"
singular: "postureDeployment"
style: DECLARATIVE_FRIENDLY
};
// State of a PostureDeployment.
enum State {
// Unspecified operation state.
STATE_UNSPECIFIED = 0;
// The PostureDeployment is being created.
CREATING = 1;
// The PostureDeployment is being deleted.
DELETING = 2;
// The PostureDeployment state is being updated.
UPDATING = 3;
// The PostureDeployment state is active and in use.
ACTIVE = 4;
// The PostureDeployment creation failed.
CREATE_FAILED = 5;
// The PostureDeployment update failed.
UPDATE_FAILED = 6;
// The PostureDeployment deletion failed.
DELETE_FAILED = 7;
}
// Required. The name of this PostureDeployment resource, in the format of
// organizations/{organization}/locations/{location_id}/postureDeployments/{postureDeployment}.
string name = 1 [(google.api.field_behavior) = REQUIRED];
// Required. Target resource where the Posture will be deployed. Currently
// supported resources are of types: projects/projectNumber,
// folders/folderNumber, organizations/organizationNumber.
string target_resource = 13 [(google.api.field_behavior) = REQUIRED];
// Output only. State of PostureDeployment resource.
State state = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
// Required. Posture that needs to be deployed.
// Format:
// organizations/{org_id}/locations/{location_id}/postures/<posture>
// Example:
// organizations/99/locations/global/postures/les-miserables.
string posture_id = 3 [(google.api.field_behavior) = REQUIRED];
// Required. Revision_id of the Posture that is to be deployed.
string posture_revision_id = 4 [(google.api.field_behavior) = REQUIRED];
// Output only. The timestamp that the PostureDeployment was created.
google.protobuf.Timestamp create_time = 5
[(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. The timestamp that the PostureDeployment was updated.
google.protobuf.Timestamp update_time = 6
[(google.api.field_behavior) = OUTPUT_ONLY];
// Optional. User provided description of the PostureDeployment.
string description = 7 [(google.api.field_behavior) = OPTIONAL];
// Optional. An opaque tag indicating the current version of the
// PostureDeployment, used for concurrency control. When the
// `PostureDeployment` is returned from either a `GetPostureDeployment` or a
// `ListPostureDeployments` request, this `etag` indicates the version of the
// current `PostureDeployment` to use when executing a read-modify-write loop.
//
// When the `PostureDeployment` is used in a `UpdatePostureDeployment` method,
// use the `etag` value that was returned from a `GetPostureDeployment`
// request as part of a read-modify-write loop for concurrency control. Not
// setting the `etag` in a `UpdatePostureDeployment` request will result in an
// unconditional write of the `PostureDeployment`.
string etag = 8 [(google.api.field_behavior) = OPTIONAL];
// Optional. User annotations. These attributes can only be set and used by
// the user, and not by Google Security Postures.
// .
map<string, string> annotations = 9 [(google.api.field_behavior) = OPTIONAL];
// Output only. Whether or not this Posture is in the process of being
// updated.
bool reconciling = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. This is a output only optional field which will be filled in
// case where PostureDeployment state is UPDATE_FAILED or CREATE_FAILED or
// DELETE_FAILED. It denotes the desired Posture.
string desired_posture_id = 11 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Output only optional field which provides revision_id of the
// desired_posture_id.
string desired_posture_revision_id = 12
[(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. This is a output only optional field which will be filled in
// case where PostureDeployment enters a failure state like UPDATE_FAILED or
// CREATE_FAILED or DELETE_FAILED.
string failure_message = 14 [(google.api.field_behavior) = OUTPUT_ONLY];
}
// Message for requesting list of PostureDeployments.
message ListPostureDeploymentsRequest {
// Required. Parent value for ListPostureDeploymentsRequest.
string parent = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
child_type: "securityposture.googleapis.com/PostureDeployment"
}
];
// Optional. Requested page size. Server may return fewer items than
// requested. If unspecified, server will pick an appropriate default.
int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
// Optional. A token identifying a page of results the server should return.
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
// Optional. Filter to be applied on the resource, defined by EBNF grammar
// https://google.aip.dev/assets/misc/ebnf-filtering.txt.
string filter = 4 [(google.api.field_behavior) = OPTIONAL];
}
// Message for response to listing PostureDeployments.
message ListPostureDeploymentsResponse {
// The list of PostureDeployment.
repeated PostureDeployment posture_deployments = 1;
// A token identifying a page of results the server should return.
string next_page_token = 2;
// Locations that could not be reached.
repeated string unreachable = 3;
}
// Message for getting a PostureDeployment.
message GetPostureDeploymentRequest {
// Required. Name of the resource.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
type: "securityposture.googleapis.com/PostureDeployment"
}
];
}
// Message for creating a PostureDeployment.
message CreatePostureDeploymentRequest {
// Required. Value for parent.
// Format: organizations/{org_id}/locations/{location}
string parent = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
child_type: "securityposture.googleapis.com/PostureDeployment"
}
];
// Required. User provided identifier. It should be unique in scope of an
// Organization and location.
string posture_deployment_id = 2 [(google.api.field_behavior) = REQUIRED];
// Required. The resource being created.
PostureDeployment posture_deployment = 3
[(google.api.field_behavior) = REQUIRED];
}
// Message for updating a PostureDeployment.
message UpdatePostureDeploymentRequest {
// Required. Field mask is used to specify the fields to be overwritten in the
// PostureDeployment resource by the update.
// The fields specified in the update_mask are relative to the resource, not
// the full request. A field will be overwritten if it is in the mask. If the
// user does not provide a mask then all fields will be overwritten.
google.protobuf.FieldMask update_mask = 1
[(google.api.field_behavior) = REQUIRED];
// Required. The resource being updated.
PostureDeployment posture_deployment = 2
[(google.api.field_behavior) = REQUIRED];
}
// Message for deleting a PostureDeployment.
message DeletePostureDeploymentRequest {
// Required. Name of the resource.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
type: "securityposture.googleapis.com/PostureDeployment"
}
];
// Optional. Etag value of the PostureDeployment to be deleted.
string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}
// PostureTemplates
// Message describing PostureTemplate object.
message PostureTemplate {
option (google.api.resource) = {
type: "securityposture.googleapis.com/PostureTemplate"
pattern: "organizations/{organization}/locations/{location}/postureTemplates/{posture_template}"
plural: "postureTemplates"
singular: "postureTemplate"
};
// State of a PostureTemplate
enum State {
// Unspecified state
STATE_UNSPECIFIED = 0;
// If the Posture template is adhering to the latest controls and standards.
ACTIVE = 1;
// If the Posture template controls and standards are outdated and not
// recommended for use.
DEPRECATED = 2;
}
// Output only. Identifier. The name of the Posture template will be of the
// format
// organizations/{organization}/locations/{location}/postureTemplates/{postureTemplate}
string name = 1 [
(google.api.field_behavior) = OUTPUT_ONLY,
(google.api.field_behavior) = IDENTIFIER
];
// Output only. The revision_id of a PostureTemplate.
string revision_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Description of the Posture template.
string description = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. State of PostureTemplate resource.
State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. Policy_sets to be used by the user.
repeated PolicySet policy_sets = 5
[(google.api.field_behavior) = OUTPUT_ONLY];
}
// Message for requesting list of Posture Templates.
message ListPostureTemplatesRequest {
// Required. Parent value for ListPostureTemplatesRequest.
string parent = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
child_type: "securityposture.googleapis.com/PostureTemplate"
}
];
// Optional. Requested page size. Server may return fewer items than
// requested. If unspecified, server will pick an appropriate default.
int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
// Optional. A token identifying a page of results the server should return.
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
// Optional. Filter to be applied on the resource, defined by EBNF grammar
// https://google.aip.dev/assets/misc/ebnf-filtering.txt.
string filter = 4 [(google.api.field_behavior) = OPTIONAL];
}
// Message for response to listing PostureTemplates.
message ListPostureTemplatesResponse {
// The list of PostureTemplate.
repeated PostureTemplate posture_templates = 1;
// A token identifying a page of results the server should return.
string next_page_token = 2;
}
// Message for getting a Posture Template.
message GetPostureTemplateRequest {
// Required. Name of the resource.
string name = 1 [
(google.api.field_behavior) = REQUIRED,
(google.api.resource_reference) = {
type: "securityposture.googleapis.com/PostureTemplate"
}
];
// Optional. Specific revision_id of a Posture Template.
// PostureTemplate revision_id which needs to be retrieved.
string revision_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

96
google/cloud/securityposture/v1/securityposture_v1.yaml Normal file
View file

@ -0,0 +1,96 @@
type: google.api.Service
config_version: 3
name: securityposture.googleapis.com
title: Security Posture API
apis:
- name: google.cloud.location.Locations
- name: google.cloud.securityposture.v1.SecurityPosture
- name: google.longrunning.Operations
documentation:
summary: Security Posture is a comprehensive framework of policy sets that empowers organizations to define, assess early, deploy, and monitor their security measures in a unified way and helps simplify governance and reduces administrative toil.
rules:
- selector: google.cloud.location.Locations.GetLocation
description: Gets information about a location.
- selector: google.cloud.location.Locations.ListLocations
description: Lists information about the supported locations for this service.
http:
rules:
- selector: google.cloud.location.Locations.GetLocation
get: '/v1/{name=organizations/*/locations/*}'
- selector: google.cloud.location.Locations.ListLocations
get: '/v1/{name=organizations/*}/locations'
- selector: google.longrunning.Operations.CancelOperation
post: '/v1/{name=organizations/*/locations/*/operations/*}:cancel'
body: '*'
- selector: google.longrunning.Operations.DeleteOperation
delete: '/v1/{name=organizations/*/locations/*/operations/*}'
- selector: google.longrunning.Operations.GetOperation
get: '/v1/{name=organizations/*/locations/*/operations/*}'
- selector: google.longrunning.Operations.ListOperations
get: '/v1/{name=organizations/*/locations/*}/operations'
authentication:
rules:
- selector: google.cloud.location.Locations.GetLocation
oauth:
canonical_scopes: |-
https://www.googleapis.com/auth/cloud-platform
- selector: google.cloud.location.Locations.ListLocations
oauth:
canonical_scopes: |-
https://www.googleapis.com/auth/cloud-platform
- selector: 'google.cloud.securityposture.v1.SecurityPosture.*'
oauth:
canonical_scopes: |-
https://www.googleapis.com/auth/cloud-platform
- selector: 'google.longrunning.Operations.*'
oauth:
canonical_scopes: |-
https://www.googleapis.com/auth/cloud-platform
publishing:
new_issue_uri: https://issuetracker.google.com/issues/new?component=190865&template=1161103
api_short_name: securityposture
github_label: 'api: securityposture'
doc_tag_prefix: securityposture
organization: CLOUD
library_settings:
- version: google.cloud.securityposture.v1
launch_stage: GA
java_settings:
common:
destinations:
- PACKAGE_MANAGER
cpp_settings:
common:
destinations:
- PACKAGE_MANAGER
php_settings:
common:
destinations:
- PACKAGE_MANAGER
python_settings:
common:
destinations:
- PACKAGE_MANAGER
node_settings:
common:
destinations:
- PACKAGE_MANAGER
dotnet_settings:
common:
destinations:
- PACKAGE_MANAGER
ruby_settings:
common:
destinations:
- PACKAGE_MANAGER
go_settings:
common:
destinations:
- PACKAGE_MANAGER
proto_reference_documentation_uri: https://cloud.google.com/securityposture/docs/reference/rpc

29
google/cloud/securityposture/v1/securityposture_v1_grpc_service_config.json Normal file
View file

@ -0,0 +1,29 @@
{
"methodConfig": [{
"name": [
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostures" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostureRevisions" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "GetPosture" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "CreatePosture" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "UpdatePosture" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "DeletePosture" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ExtractPosture" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostureDeployments" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "GetPostureDeployment" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "CreatePostureDeployment" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "UpdatePostureDeployment" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "DeletePostureDeployment" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostureTemplates" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "GetPostureTemplate" },
{ "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "CreateIaCValidationReport" }
],
"timeout": "60s",
"retryPolicy": {
"maxAttempts": 5,
"initialBackoff": "1s",
"maxBackoff": "10s",
"backoffMultiplier": 1.3,
"retryableStatusCodes": ["UNAVAILABLE"]
}
}]
}

72
google/cloud/securityposture/v1/sha_constraints.proto Normal file
View file

@ -0,0 +1,72 @@
// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securityposture.v1;
import "google/api/field_behavior.proto";
import "google/cloud/securityposture/v1/sha_custom_config.proto";
option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb";
option java_multiple_files = true;
option java_outer_classname = "ShaConstraintsProto";
option java_package = "com.google.cloud.securityposture.v1";
// Possible enablement states of a service or module.
enum EnablementState {
// Default value. This value is unused.
ENABLEMENT_STATE_UNSPECIFIED = 0;
// State is enabled.
ENABLED = 1;
// State is disabled.
DISABLED = 2;
}
// Message for Security Health Analytics built-in detector.
message SecurityHealthAnalyticsModule {
// Required. The name of the module eg: BIGQUERY_TABLE_CMEK_DISABLED.
string module_name = 1 [(google.api.field_behavior) = REQUIRED];
// The state of enablement for the module at its level of the resource
// hierarchy.
EnablementState module_enablement_state = 2;
}
// Message for SHA Custom Module
message SecurityHealthAnalyticsCustomModule {
// Output only. Immutable. The id of the custom module.
// The id is server-generated and is not user settable.
// It will be a numeric id containing 1-20 digits.
string id = 1 [
(google.api.field_behavior) = IMMUTABLE,
(google.api.field_behavior) = OUTPUT_ONLY
];
// Optional. The display name of the Security Health Analytics custom module.
// This display name becomes the finding category for all findings that are
// returned by this custom module. The display name must be between 1 and
// 128 characters, start with a lowercase letter, and contain alphanumeric
// characters or underscores only.
string display_name = 2 [(google.api.field_behavior) = OPTIONAL];
// Required. custom module details
CustomConfig config = 3 [(google.api.field_behavior) = REQUIRED];
// The state of enablement for the module at its level of the resource
// hierarchy.
EnablementState module_enablement_state = 4;
}

102
google/cloud/securityposture/v1/sha_custom_config.proto Normal file
View file

@ -0,0 +1,102 @@
// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.securityposture.v1;
import "google/api/field_behavior.proto";
import "google/type/expr.proto";
option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb";
option java_multiple_files = true;
option java_outer_classname = "ShaCustomConfigProto";
option java_package = "com.google.cloud.securityposture.v1";
// Defines the properties in a custom module configuration for Security
// Health Analytics. Use the custom module configuration to create custom
// detectors that generate custom findings for resources that you specify.
message CustomConfig {
// A set of optional name-value pairs that define custom source properties to
// return with each finding that is generated by the custom module. The custom
// source properties that are defined here are included in the finding JSON
// under `sourceProperties`.
message CustomOutputSpec {
// An individual name-value pair that defines a custom source property.
message Property {
// Required. Name of the property for the custom output.
string name = 1 [(google.api.field_behavior) = REQUIRED];
// Optional. The CEL expression for the custom output. A resource property
// can be specified to return the value of the property or a text string
// enclosed in quotation marks.
google.type.Expr value_expression = 2
[(google.api.field_behavior) = OPTIONAL];
}
// Optional. A list of custom output properties to add to the finding.
repeated Property properties = 1 [(google.api.field_behavior) = OPTIONAL];
}
// Resource for selecting resource type.
message ResourceSelector {
// Required. The resource types to run the detector on.
repeated string resource_types = 1 [(google.api.field_behavior) = REQUIRED];
}
// Defines the valid value options for the severity of a finding.
enum Severity {
// Unspecified severity.
SEVERITY_UNSPECIFIED = 0;
// Critical severity.
CRITICAL = 1;
// High severity.
HIGH = 2;
// Medium severity.
MEDIUM = 3;
// Low severity.
LOW = 4;
}
// Required. The CEL expression to evaluate to produce findings. When the
// expression evaluates to true against a resource, a finding is generated.
google.type.Expr predicate = 1 [(google.api.field_behavior) = REQUIRED];
// Optional. Custom output properties.
CustomOutputSpec custom_output = 2 [(google.api.field_behavior) = OPTIONAL];
// Required. The resource types that the custom module operates on. Each
// custom module can specify up to 5 resource types.
ResourceSelector resource_selector = 3
[(google.api.field_behavior) = REQUIRED];
// Required. The severity to assign to findings generated by the module.
Severity severity = 4 [(google.api.field_behavior) = REQUIRED];
// Optional. Text that describes the vulnerability or misconfiguration that
// the custom module detects. This explanation is returned with each finding
// instance to help investigators understand the detected issue. The text must
// be enclosed in quotation marks.
string description = 5 [(google.api.field_behavior) = OPTIONAL];
// Optional. An explanation of the recommended steps that security teams can
// take to resolve the detected issue. This explanation is returned with each
// finding generated by this module in the `nextSteps` property of the finding
// JSON.
string recommendation = 6 [(google.api.field_behavior) = OPTIONAL];
}