diff --git a/google/cloud/securityposture/v1/BUILD.bazel b/google/cloud/securityposture/v1/BUILD.bazel new file mode 100644 index 0000000000..ca12eebd67 --- /dev/null +++ b/google/cloud/securityposture/v1/BUILD.bazel @@ -0,0 +1,388 @@ +# This file was automatically generated by BuildFileGenerator +# https://github.com/googleapis/rules_gapic/tree/master/bazel + +# Most of the manual changes to this file will be overwritten. +# It's **only** allowed to change the following rule attribute values: +# - names of *_gapic_assembly_* rules +# - certain parameters of *_gapic_library rules, including but not limited to: +# * extra_protoc_parameters +# * extra_protoc_file_parameters +# The complete list of preserved parameters can be found in the source code. + +# This is an API workspace, having public visibility by default makes perfect sense. +package(default_visibility = ["//visibility:public"]) + +############################################################################## +# Common +############################################################################## +load("@rules_proto//proto:defs.bzl", "proto_library") +load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info") + +proto_library( + name = "securityposture_proto", + srcs = [ + "org_policy_config.proto", + "org_policy_constraints.proto", + "securityposture.proto", + "sha_constraints.proto", + "sha_custom_config.proto", + ], + deps = [ + "//google/api:annotations_proto", + "//google/api:client_proto", + "//google/api:field_behavior_proto", + "//google/api:resource_proto", + "//google/longrunning:operations_proto", + "//google/type:expr_proto", + "@com_google_protobuf//:empty_proto", + "@com_google_protobuf//:field_mask_proto", + "@com_google_protobuf//:timestamp_proto", + ], +) + +proto_library_with_info( + name = "securityposture_proto_with_info", + deps = [ + ":securityposture_proto", + "//google/cloud/location:location_proto", + "//google/cloud:common_resources_proto", + ], +) + +############################################################################## +# Java +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "java_gapic_assembly_gradle_pkg", + "java_gapic_library", + "java_gapic_test", + "java_grpc_library", + "java_proto_library", +) + +java_proto_library( + name = "securityposture_java_proto", + deps = [":securityposture_proto"], +) + +java_grpc_library( + name = "securityposture_java_grpc", + srcs = [":securityposture_proto"], + deps = [":securityposture_java_proto"], +) + +java_gapic_library( + name = "securityposture_java_gapic", + srcs = [":securityposture_proto_with_info"], + gapic_yaml = None, + grpc_service_config = "securityposture_v1_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "securityposture_v1.yaml", + test_deps = [ + "//google/cloud/location:location_java_grpc", + ":securityposture_java_grpc", + ], + transport = "grpc+rest", + deps = [ + ":securityposture_java_proto", + "//google/api:api_java_proto", + "//google/cloud/location:location_java_proto", + ], +) + +java_gapic_test( + name = "securityposture_java_gapic_test_suite", + test_classes = [ + "com.google.cloud.securityposture.v1.SecurityPostureClientHttpJsonTest", + "com.google.cloud.securityposture.v1.SecurityPostureClientTest", + ], + runtime_deps = [":securityposture_java_gapic_test"], +) + +# Open Source Packages +java_gapic_assembly_gradle_pkg( + name = "google-cloud-securityposture-v1-java", + transport = "grpc+rest", + deps = [ + ":securityposture_java_gapic", + ":securityposture_java_grpc", + ":securityposture_java_proto", + ":securityposture_proto", + ], + include_samples = True, +) + +############################################################################## +# Go +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "go_gapic_assembly_pkg", + "go_gapic_library", + "go_proto_library", +) + +go_proto_library( + name = "securityposture_go_proto", + compilers = ["@io_bazel_rules_go//proto:go_grpc"], + importpath = "cloud.google.com/go/securityposture/apiv1/securityposturepb", + protos = [":securityposture_proto"], + deps = [ + "//google/api:annotations_go_proto", + "//google/longrunning:longrunning_go_proto", + "//google/type:expr_go_proto", + ], +) + +go_gapic_library( + name = "securityposture_go_gapic", + srcs = [":securityposture_proto_with_info"], + grpc_service_config = "securityposture_v1_grpc_service_config.json", + importpath = "cloud.google.com/go/securityposture/apiv1;securityposture", + metadata = True, + release_level = "beta", + rest_numeric_enums = True, + service_yaml = "securityposture_v1.yaml", + transport = "grpc+rest", + deps = [ + ":securityposture_go_proto", + "//google/cloud/location:location_go_proto", + "//google/longrunning:longrunning_go_proto", + "@com_google_cloud_go_longrunning//:go_default_library", + "@com_google_cloud_go_longrunning//autogen:go_default_library", + ], +) + +# Open Source Packages +go_gapic_assembly_pkg( + name = "gapi-cloud-securityposture-v1-go", + deps = [ + ":securityposture_go_gapic", + ":securityposture_go_gapic_srcjar-test.srcjar", + ":securityposture_go_gapic_srcjar-metadata.srcjar", + ":securityposture_go_gapic_srcjar-snippets.srcjar", + ":securityposture_go_proto", + ], +) + +############################################################################## +# Python +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "py_gapic_assembly_pkg", + "py_gapic_library", + "py_test", +) + +py_gapic_library( + name = "securityposture_py_gapic", + srcs = [":securityposture_proto"], + grpc_service_config = "securityposture_v1_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "securityposture_v1.yaml", + transport = "grpc+rest", + deps = [], +) + +py_test( + name = "securityposture_py_gapic_test", + srcs = [ + "securityposture_py_gapic_pytest.py", + "securityposture_py_gapic_test.py", + ], + legacy_create_init = False, + deps = [":securityposture_py_gapic"], +) + +# Open Source Packages +py_gapic_assembly_pkg( + name = "securityposture-v1-py", + deps = [ + ":securityposture_py_gapic", + ], +) + +############################################################################## +# PHP +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "php_gapic_assembly_pkg", + "php_gapic_library", + "php_proto_library", +) + +php_proto_library( + name = "securityposture_php_proto", + deps = [":securityposture_proto"], +) + +php_gapic_library( + name = "securityposture_php_gapic", + srcs = [":securityposture_proto_with_info"], + grpc_service_config = "securityposture_v1_grpc_service_config.json", + rest_numeric_enums = True, + migration_mode = "NEW_SURFACE_ONLY", + service_yaml = "securityposture_v1.yaml", + transport = "grpc+rest", + deps = [ + ":securityposture_php_proto", + ], +) + +# Open Source Packages +php_gapic_assembly_pkg( + name = "google-cloud-securityposture-v1-php", + deps = [ + ":securityposture_php_gapic", + ":securityposture_php_proto", + ], +) + +############################################################################## +# Node.js +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "nodejs_gapic_assembly_pkg", + "nodejs_gapic_library", +) + +nodejs_gapic_library( + name = "securityposture_nodejs_gapic", + package_name = "@google-cloud/securityposture", + src = ":securityposture_proto_with_info", + extra_protoc_parameters = ["metadata"], + grpc_service_config = "securityposture_v1_grpc_service_config.json", + package = "google.cloud.securityposture.v1", + rest_numeric_enums = True, + service_yaml = "securityposture_v1.yaml", + transport = "grpc+rest", + deps = [], +) + +nodejs_gapic_assembly_pkg( + name = "securityposture-v1-nodejs", + deps = [ + ":securityposture_nodejs_gapic", + ":securityposture_proto", + ], +) + +############################################################################## +# Ruby +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "ruby_gapic_assembly_pkg", + "ruby_cloud_gapic_library", + "ruby_grpc_library", + "ruby_proto_library", +) + +ruby_proto_library( + name = "securityposture_ruby_proto", + deps = [":securityposture_proto"], +) + +ruby_grpc_library( + name = "securityposture_ruby_grpc", + srcs = [":securityposture_proto"], + deps = [":securityposture_ruby_proto"], +) + +ruby_cloud_gapic_library( + name = "securityposture_ruby_gapic", + srcs = [":securityposture_proto_with_info"], + extra_protoc_parameters = [ + "ruby-cloud-gem-name=google-cloud-securityposture-v1", + ], + grpc_service_config = "securityposture_v1_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "securityposture_v1.yaml", + transport = "grpc+rest", + deps = [ + ":securityposture_ruby_grpc", + ":securityposture_ruby_proto", + ], +) + +# Open Source Packages +ruby_gapic_assembly_pkg( + name = "google-cloud-securityposture-v1-ruby", + deps = [ + ":securityposture_ruby_gapic", + ":securityposture_ruby_grpc", + ":securityposture_ruby_proto", + ], +) + +############################################################################## +# C# +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "csharp_gapic_assembly_pkg", + "csharp_gapic_library", + "csharp_grpc_library", + "csharp_proto_library", +) + +csharp_proto_library( + name = "securityposture_csharp_proto", + extra_opts = [], + deps = [":securityposture_proto"], +) + +csharp_grpc_library( + name = "securityposture_csharp_grpc", + srcs = [":securityposture_proto"], + deps = [":securityposture_csharp_proto"], +) + +csharp_gapic_library( + name = "securityposture_csharp_gapic", + srcs = [":securityposture_proto_with_info"], + common_resources_config = "@gax_dotnet//:Google.Api.Gax/ResourceNames/CommonResourcesConfig.json", + grpc_service_config = "securityposture_v1_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "securityposture_v1.yaml", + transport = "grpc+rest", + deps = [ + ":securityposture_csharp_grpc", + ":securityposture_csharp_proto", + ], +) + +# Open Source Packages +csharp_gapic_assembly_pkg( + name = "google-cloud-securityposture-v1-csharp", + deps = [ + ":securityposture_csharp_gapic", + ":securityposture_csharp_grpc", + ":securityposture_csharp_proto", + ], +) + +############################################################################## +# C++ +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "cc_grpc_library", + "cc_proto_library", +) + +cc_proto_library( + name = "securityposture_cc_proto", + deps = [":securityposture_proto"], +) + +cc_grpc_library( + name = "securityposture_cc_grpc", + srcs = [":securityposture_proto"], + grpc_only = True, + deps = [":securityposture_cc_proto"], +) diff --git a/google/cloud/securityposture/v1/org_policy_config.proto b/google/cloud/securityposture/v1/org_policy_config.proto new file mode 100644 index 0000000000..ff30f600dc --- /dev/null +++ b/google/cloud/securityposture/v1/org_policy_config.proto @@ -0,0 +1,174 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.securityposture.v1; + +import "google/api/field_behavior.proto"; +import "google/protobuf/timestamp.proto"; +import "google/type/expr.proto"; + +option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb"; +option java_multiple_files = true; +option java_outer_classname = "OrgPolicyConfigProto"; +option java_package = "com.google.cloud.securityposture.v1"; + +// A rule used to express this policy. +message PolicyRule { + // A message that holds specific allowed and denied values. + // This message can define specific values and subtrees of the Resource + // Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that + // are allowed or denied. This is achieved by using the `under:` and + // optional `is:` prefixes. + // The `under:` prefix is used to denote resource subtree values. + // The `is:` prefix is used to denote specific values, and is required only + // if the value contains a ":". Values prefixed with "is:" are treated the + // same as values with no prefix. + // Ancestry subtrees must be in one of the following formats: + // + // - `projects/` (for example, `projects/tokyo-rain-123`) + // - `folders/` (for example, `folders/1234`) + // - `organizations/` (for example, `organizations/1234`) + // + // The `supports_under` field of the associated `Constraint` defines + // whether ancestry prefixes can be used. + message StringValues { + // List of values allowed at this resource. + repeated string allowed_values = 1; + + // List of values denied at this resource. + repeated string denied_values = 2; + } + + oneof kind { + // List of values to be used for this policy rule. This field can be set + // only in policies for list constraints. + StringValues values = 1; + + // Setting this to true means that all values are allowed. This field can + // be set only in policies for list constraints. + bool allow_all = 2; + + // Setting this to true means that all values are denied. This field can + // be set only in policies for list constraints. + bool deny_all = 3; + + // If `true`, then the policy is enforced. If `false`, then any + // configuration is acceptable. + // This field can be set only in policies for boolean constraints. + bool enforce = 4; + } + + // A condition which determines whether this rule is used + // in the evaluation of the policy. When set, the `expression` field in + // the `Expr' must include from 1 to 10 subexpressions, joined by the "||" + // or "&&" operators. Each subexpression must be of the form + // "resource.matchTag('/tag_key_short_name, + // 'tag_value_short_name')" or "resource.matchTagId('tagKeys/key_id', + // 'tagValues/value_id')" where key_name and value_name are the resource + // names for Label Keys and Values. These names are available from the Tag + // Manager Service. An example expression is: + // "resource.matchTag('123456789/environment, + // 'prod')" or "resource.matchTagId('tagKeys/123', + // 'tagValues/456')". + google.type.Expr condition = 5; +} + +// A custom constraint defined by customers which can *only* be applied to the +// given resource types and organization. +// +// By creating a custom constraint, customers can apply policies of this +// custom constraint. *Creating a custom constraint itself does NOT apply any +// policy enforcement*. +message CustomConstraint { + // The operation for which this constraint will be applied. To apply this + // constraint only when creating new VMs, the `method_types` should be + // `CREATE` only. To apply this constraint when creating or deleting + // VMs, the `method_types` should be `CREATE` and `DELETE`. + // + // `UPDATE` only custom constraints are not supported. Use `CREATE` or + // `CREATE, UPDATE`. + enum MethodType { + // Unspecified. Results in an error. + METHOD_TYPE_UNSPECIFIED = 0; + + // Constraint applied when creating the resource. + CREATE = 1; + + // Constraint applied when updating the resource. + UPDATE = 2; + + // Constraint applied when deleting the resource. + // Not supported yet. + DELETE = 3; + } + + // Allow or deny type. + enum ActionType { + // Unspecified. Results in an error. + ACTION_TYPE_UNSPECIFIED = 0; + + // Allowed action type. + ALLOW = 1; + + // Deny action type. + DENY = 2; + } + + // Immutable. Name of the constraint. This is unique within the organization. + // Format of the name should be + // + // - + // `organizations/{organization_id}/customConstraints/{custom_constraint_id}` + // + // Example: `organizations/123/customConstraints/custom.createOnlyE2TypeVms` + // + // The max length is 70 characters and the minimum length is 1. Note that the + // prefix `organizations/{organization_id}/customConstraints/` is not counted. + string name = 1 [(google.api.field_behavior) = IMMUTABLE]; + + // Immutable. The resource instance type on which this policy applies. Format + // will be of the form : `/` Example: + // + // - `compute.googleapis.com/Instance`. + repeated string resource_types = 2 [(google.api.field_behavior) = IMMUTABLE]; + + // All the operations being applied for this constraint. + repeated MethodType method_types = 3; + + // Org policy condition/expression. For example: + // `resource.instanceName.matches("[production|test]_.*_(\d)+")` or, + // `resource.management.auto_upgrade == true` + // + // The max length of the condition is 1000 characters. + string condition = 4; + + // Allow or deny type. + ActionType action_type = 5; + + // One line display name for the UI. + // The max length of the display_name is 200 characters. + string display_name = 6; + + // Detailed information about this custom policy constraint. + // The max length of the description is 2000 characters. + string description = 7; + + // Output only. The last time this custom constraint was updated. This + // represents the last time that the `CreateCustomConstraint` or + // `UpdateCustomConstraint` RPC was called + google.protobuf.Timestamp update_time = 8 + [(google.api.field_behavior) = OUTPUT_ONLY]; +} diff --git a/google/cloud/securityposture/v1/org_policy_constraints.proto b/google/cloud/securityposture/v1/org_policy_constraints.proto new file mode 100644 index 0000000000..9a2ee3a9ff --- /dev/null +++ b/google/cloud/securityposture/v1/org_policy_constraints.proto @@ -0,0 +1,44 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.securityposture.v1; + +import "google/api/field_behavior.proto"; +import "google/cloud/securityposture/v1/org_policy_config.proto"; + +option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb"; +option java_multiple_files = true; +option java_outer_classname = "OrgPolicyConstraintsProto"; +option java_package = "com.google.cloud.securityposture.v1"; + +// Message for Org Policy Canned Constraint. +message OrgPolicyConstraint { + // Required. Org Policy Canned Constraint id. + string canned_constraint_id = 1 [(google.api.field_behavior) = REQUIRED]; + + // Required. Org PolicySpec rules. + repeated PolicyRule policy_rules = 2 [(google.api.field_behavior) = REQUIRED]; +} + +// Message for Org Policy Custom Constraint. +message OrgPolicyConstraintCustom { + // Required. Org Policy Custom Constraint. + CustomConstraint custom_constraint = 1 + [(google.api.field_behavior) = REQUIRED]; + + // Required. Org Policyspec rules. + repeated PolicyRule policy_rules = 2 [(google.api.field_behavior) = REQUIRED]; +} diff --git a/google/cloud/securityposture/v1/securityposture.proto b/google/cloud/securityposture/v1/securityposture.proto new file mode 100644 index 0000000000..44c7c19091 --- /dev/null +++ b/google/cloud/securityposture/v1/securityposture.proto @@ -0,0 +1,849 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.securityposture.v1; + +import "google/api/annotations.proto"; +import "google/api/client.proto"; +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/cloud/securityposture/v1/org_policy_constraints.proto"; +import "google/cloud/securityposture/v1/sha_constraints.proto"; +import "google/longrunning/operations.proto"; +import "google/protobuf/empty.proto"; +import "google/protobuf/field_mask.proto"; +import "google/protobuf/timestamp.proto"; + +option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb"; +option java_multiple_files = true; +option java_outer_classname = "V1mainProto"; +option java_package = "com.google.cloud.securityposture.v1"; +option (google.api.resource_definition) = { + type: "securitposture.googleapis.com/Organization" + pattern: "organizations/{organization}/locations/{location}" +}; + +// Service describing handlers for resources. +service SecurityPosture { + option (google.api.default_host) = "securityposture.googleapis.com"; + option (google.api.oauth_scopes) = + "https://www.googleapis.com/auth/cloud-platform"; + + // (-- This option restricts the visibility of the API to only projects that + // will + // (-- be labeled as `PREVIEW` or `GOOGLE_INTERNAL` by the service. + // (-- option (google.api.api_visibility).restriction = + // "PREVIEW,GOOGLE_INTERNAL"; Postures Lists Postures in a given organization + // and location. In case a posture has multiple revisions, the latest revision + // as per UpdateTime will be returned. + rpc ListPostures(ListPosturesRequest) returns (ListPosturesResponse) { + option (google.api.http) = { + get: "/v1/{parent=organizations/*/locations/*}/postures" + }; + option (google.api.method_signature) = "parent"; + } + + // Lists revisions of a Posture in a given organization and location. + rpc ListPostureRevisions(ListPostureRevisionsRequest) + returns (ListPostureRevisionsResponse) { + option (google.api.http) = { + get: "/v1/{name=organizations/*/locations/*/postures/*}:listRevisions" + }; + } + + // Gets a posture in a given organization and location. + // User must provide revision_id to retrieve a specific revision of the + // resource. + // NOT_FOUND error is returned if the revision_id or the Posture name does not + // exist. In case revision_id is not provided then the latest Posture revision + // by UpdateTime is returned. + rpc GetPosture(GetPostureRequest) returns (Posture) { + option (google.api.http) = { + get: "/v1/{name=organizations/*/locations/*/postures/*}" + }; + option (google.api.method_signature) = "name"; + } + + // Creates a new Posture resource. + // If a Posture with the specified name already exists in the specified + // organization and location, the long running operation returns a + // [ALREADY_EXISTS][google.rpc.Code.ALREADY_EXISTS] error. + rpc CreatePosture(CreatePostureRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + post: "/v1/{parent=organizations/*/locations/*}/postures" + body: "posture" + }; + option (google.api.method_signature) = "parent,posture,posture_id"; + option (google.longrunning.operation_info) = { + response_type: "Posture" + metadata_type: "OperationMetadata" + }; + } + + // Updates an existing Posture. + // A new revision of the posture will be created if the revision to be + // updated is currently deployed on a workload. + // Returns a `google.rpc.Status` with `google.rpc.Code.NOT_FOUND` if the + // Posture does not exist. + // Returns a `google.rpc.Status` with `google.rpc.Code.ABORTED` if the etag + // supplied in the request does not match the persisted etag of the Posture. + // Updatable fields are state, description and policy_sets. + // State update operation cannot be clubbed with update of description and + // policy_sets. + // An ACTIVE posture can be updated to both DRAFT or DEPRECATED states. + // Postures in DRAFT or DEPRECATED states can only be updated to ACTIVE state. + rpc UpdatePosture(UpdatePostureRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + patch: "/v1/{posture.name=organizations/*/locations/*/postures/*}" + body: "posture" + }; + option (google.api.method_signature) = "posture,update_mask"; + option (google.longrunning.operation_info) = { + response_type: "Posture" + metadata_type: "OperationMetadata" + }; + } + + // Deletes all the revisions of a resource. + // A posture can only be deleted when none of the revisions are deployed to + // any workload. + rpc DeletePosture(DeletePostureRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + delete: "/v1/{name=organizations/*/locations/*/postures/*}" + }; + option (google.api.method_signature) = "name"; + option (google.longrunning.operation_info) = { + response_type: "google.protobuf.Empty" + metadata_type: "OperationMetadata" + }; + } + + // Extracts existing policies on a workload as a posture. + // If a Posture on the given workload already exists, the long running + // operation returns a [ALREADY_EXISTS][google.rpc.Code.ALREADY_EXISTS] error. + rpc ExtractPosture(ExtractPostureRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + post: "/v1/{parent=organizations/*/locations/*}/postures:extract" + body: "*" + }; + option (google.api.method_signature) = "parent,posture_id,workload"; + option (google.longrunning.operation_info) = { + response_type: "Posture" + metadata_type: "OperationMetadata" + }; + } + + // PostureDeployments + // Lists PostureDeployments in a given project and location. + rpc ListPostureDeployments(ListPostureDeploymentsRequest) + returns (ListPostureDeploymentsResponse) { + option (google.api.http) = { + get: "/v1/{parent=organizations/*/locations/*}/postureDeployments" + }; + option (google.api.method_signature) = "parent"; + } + + // Gets details of a single PostureDeployment. + rpc GetPostureDeployment(GetPostureDeploymentRequest) + returns (PostureDeployment) { + option (google.api.http) = { + get: "/v1/{name=organizations/*/locations/*/postureDeployments/*}" + }; + option (google.api.method_signature) = "name"; + } + + // Creates a new PostureDeployment in a given project and location. + rpc CreatePostureDeployment(CreatePostureDeploymentRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + post: "/v1/{parent=organizations/*/locations/*}/postureDeployments" + body: "posture_deployment" + }; + option (google.api.method_signature) = + "parent,posture_deployment,posture_deployment_id"; + option (google.longrunning.operation_info) = { + response_type: "PostureDeployment" + metadata_type: "OperationMetadata" + }; + } + + // Updates the parameters of a single PostureDeployment. + rpc UpdatePostureDeployment(UpdatePostureDeploymentRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + patch: "/v1/{posture_deployment.name=organizations/*/locations/*/postureDeployments/*}" + body: "posture_deployment" + }; + option (google.api.method_signature) = "posture_deployment,update_mask"; + option (google.longrunning.operation_info) = { + response_type: "PostureDeployment" + metadata_type: "OperationMetadata" + }; + } + + // Deletes a single PostureDeployment. + rpc DeletePostureDeployment(DeletePostureDeploymentRequest) + returns (google.longrunning.Operation) { + option (google.api.http) = { + delete: "/v1/{name=organizations/*/locations/*/postureDeployments/*}" + }; + option (google.api.method_signature) = "name"; + option (google.longrunning.operation_info) = { + response_type: "google.protobuf.Empty" + metadata_type: "OperationMetadata" + }; + } + + // PostureTemplates + // Lists all the PostureTemplates available to the user. + rpc ListPostureTemplates(ListPostureTemplatesRequest) + returns (ListPostureTemplatesResponse) { + option (google.api.http) = { + get: "/v1/{parent=organizations/*/locations/*}/postureTemplates" + }; + option (google.api.method_signature) = "parent"; + } + + // Gets a PostureTemplate. + // User must provide revision_id to retrieve a specific revision of the + // resource. + // NOT_FOUND error is returned if the revision_id or the PostureTemplate name + // does not exist. In case revision_id is not provided then the + // PostureTemplate with latest revision_id is returned. + rpc GetPostureTemplate(GetPostureTemplateRequest) returns (PostureTemplate) { + option (google.api.http) = { + get: "/v1/{name=organizations/*/locations/*/postureTemplates/*}" + }; + option (google.api.method_signature) = "name"; + } +} + +// Represents the metadata of the long-running operation. +message OperationMetadata { + // Output only. The time the operation was created. + google.protobuf.Timestamp create_time = 1 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The time the operation finished running. + google.protobuf.Timestamp end_time = 2 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Server-defined resource path for the target of the operation. + string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Name of the verb executed by the operation. + string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Human-readable status of the operation, if any. + string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Identifies whether the user has requested cancellation + // of the operation. Operations that have been cancelled successfully + // have [Operation.error][] value with a + // [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to + // `Code.CANCELLED`. + bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. API version used to start the operation. + string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. This is a output only optional field which will be filled only + // in cases where PostureDeployments enter failure states like UPDATE_FAILED + // or CREATE_FAILED or DELETE_FAILED. + string error_message = 8 [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// Postures +// Definition of a Posture. +message Posture { + option (google.api.resource) = { + type: "securityposture.googleapis.com/Posture" + pattern: "organizations/{organization}/locations/{location}/postures/{posture}" + plural: "postures" + singular: "posture" + style: DECLARATIVE_FRIENDLY + }; + + // State of a Posture. + enum State { + // Unspecified operation state. + STATE_UNSPECIFIED = 0; + + // The Posture is marked deprecated when it is not in use by the user. + DEPRECATED = 1; + + // The Posture is created successfully but is not yet ready for usage. + DRAFT = 2; + + // The Posture state is active. Ready for use/deployments. + ACTIVE = 3; + } + + // Required. Identifier. The name of this Posture resource, in the format of + // organizations/{org_id}/locations/{location_id}/postures/{posture}. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.field_behavior) = IDENTIFIER + ]; + + // Required. State of Posture resource. + State state = 2 [(google.api.field_behavior) = REQUIRED]; + + // Output only. Immutable. The revision ID of the posture. + // The format is an 8-character hexadecimal string. + // https://google.aip.dev/162 + string revision_id = 3 [ + (google.api.field_behavior) = IMMUTABLE, + (google.api.field_behavior) = OUTPUT_ONLY + ]; + + // Output only. The timestamp that the posture was created. + google.protobuf.Timestamp create_time = 4 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The timestamp that the posture was updated. + google.protobuf.Timestamp update_time = 5 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Optional. User provided description of the posture. + string description = 6 [(google.api.field_behavior) = OPTIONAL]; + + // Required. List of Policy sets. + repeated PolicySet policy_sets = 7 [(google.api.field_behavior) = REQUIRED]; + + // Optional. An opaque tag indicating the current version of the Posture, used + // for concurrency control. When the `Posture` is returned from either a + // `GetPosture` or a `ListPostures` request, this `etag` indicates the version + // of the current `Posture` to use when executing a read-modify-write loop. + // + // When the `Posture` is used in a `UpdatePosture` method, use the `etag` + // value that was returned from a `GetPosture` request as part of a + // read-modify-write loop for concurrency control. Not setting the `etag` in a + // `UpdatePosture` request will result in an unconditional write of the + // `Posture`. + string etag = 8 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. User annotations. These attributes can only be set and used by + // the user, and not by Google Security Postures. + // . + map annotations = 9 [(google.api.field_behavior) = OPTIONAL]; + + // Output only. Whether or not this Posture is in the process of being + // updated. + bool reconciling = 10 [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// PolicySet representation. +message PolicySet { + // Required. ID of the Policy set. + string policy_set_id = 1 [(google.api.field_behavior) = REQUIRED]; + + // Optional. Description of the Policy set. + string description = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Required. List of policies. + repeated Policy policies = 3 [(google.api.field_behavior) = REQUIRED]; +} + +// Policy representation. +message Policy { + // Mapping for a Policy to standard and control. + message ComplianceStandard { + // Optional. The compliance standard that the Policy maps to, e.g.: CIS-2.0. + string standard = 1 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Control mapping provided by user for this Policy. e.g.: 1.5. + string control = 2 [(google.api.field_behavior) = OPTIONAL]; + } + + // Required. ID of the Policy that is user generated, immutable and unique + // within the scope of a policy set. + string policy_id = 1 [(google.api.field_behavior) = REQUIRED]; + + // Optional. Contains list of mapping for a Policy to a standard and control. + repeated ComplianceStandard compliance_standards = 2 + [(google.api.field_behavior) = OPTIONAL]; + + // Required. Constraint details. + Constraint constraint = 3 [(google.api.field_behavior) = REQUIRED]; + + // Optional. Description of the Policy. + string description = 4 [(google.api.field_behavior) = OPTIONAL]; +} + +// Representation of a Constraint. +message Constraint { + oneof implementation { + // Optional. SHA built-in detector. + SecurityHealthAnalyticsModule security_health_analytics_module = 3 + [(google.api.field_behavior) = OPTIONAL]; + + // Optional. SHA custom detector. + SecurityHealthAnalyticsCustomModule + security_health_analytics_custom_module = 4 + [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Org Policy builtin constraint. + OrgPolicyConstraint org_policy_constraint = 5 + [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Org Policy custom constraint. + OrgPolicyConstraintCustom org_policy_constraint_custom = 6 + [(google.api.field_behavior) = OPTIONAL]; + } +} + +// Message for requesting list of Postures. +message ListPosturesRequest { + // Required. Parent value for ListPosturesRequest. + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "securityposture.googleapis.com/Posture" + } + ]; + + // Requested page size. Server may return fewer items than requested. + // If unspecified, server will pick an appropriate default. + int32 page_size = 2; + + // A token identifying a page of results the server should return. + string page_token = 3; +} + +// Message for response to listing Postures. +message ListPosturesResponse { + // The list of Posture. + repeated Posture postures = 1; + + // A token identifying a page of results the server should return. + string next_page_token = 2; + + // Unreachable resources. + repeated string unreachable = 3; +} + +// Message for requesting list of Posture revisions. +message ListPostureRevisionsRequest { + // Required. Name value for ListPostureRevisionsRequest. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "securityposture.googleapis.com/Posture" + } + ]; + + // Optional. Requested page size. Server may return fewer items than + // requested. If unspecified, server will pick 100 as default. + int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. A token identifying a page of results the server should return. + string page_token = 3 [(google.api.field_behavior) = OPTIONAL]; +} + +// Message for response to listing PostureRevisions. +message ListPostureRevisionsResponse { + // The list of Posture revisions. + repeated Posture revisions = 1; + + // A token identifying a page of results the server should return. + string next_page_token = 2; +} + +// Message for getting a Posture. +message GetPostureRequest { + // Required. Name of the resource. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "securityposture.googleapis.com/Posture" + } + ]; + + // Optional. Posture revision which needs to be retrieved. + string revision_id = 3 [(google.api.field_behavior) = OPTIONAL]; +} + +// Message for creating a Posture. +message CreatePostureRequest { + // Required. Value for parent. + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "securityposture.googleapis.com/Posture" + } + ]; + + // Required. User provided identifier. It should be unique in scope of an + // Organization and location. + string posture_id = 2 [(google.api.field_behavior) = REQUIRED]; + + // Required. The resource being created. + Posture posture = 3 [(google.api.field_behavior) = REQUIRED]; +} + +// Message for updating a Posture. +message UpdatePostureRequest { + // Required. Field mask is used to specify the fields to be overwritten in the + // Posture resource by the update. + // The fields specified in the update_mask are relative to the resource, not + // the full request. A field will be overwritten if it is in the mask. If the + // user does not provide a mask then all fields will be overwritten. + google.protobuf.FieldMask update_mask = 1 + [(google.api.field_behavior) = REQUIRED]; + + // Required. The resource being updated. + Posture posture = 2 [(google.api.field_behavior) = REQUIRED]; + + // Required. Posture revision which needs to be updated. + string revision_id = 3 [(google.api.field_behavior) = REQUIRED]; +} + +// Message for deleting a Posture. +message DeletePostureRequest { + // Required. Name of the resource. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "securityposture.googleapis.com/Posture" + } + ]; + + // Optional. Etag value of the Posture to be deleted. + string etag = 2 [(google.api.field_behavior) = OPTIONAL]; +} + +// Message for extracting existing policies on a workload as a Posture. +message ExtractPostureRequest { + // Required. The parent resource name. The format of this value is as follows: + // `organizations/{organization}/locations/{location}` + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "securityposture.googleapis.com/Posture" + } + ]; + + // Required. User provided identifier. It should be unique in scope of an + // Organization and location. + string posture_id = 2 [(google.api.field_behavior) = REQUIRED]; + + // Required. Workload from which the policies are to be extracted, it should + // belong to the same organization defined in parent. The format of this value + // varies depending on the scope of the request: + // - `folder/folderNumber` + // - `project/projectNumber` + // - `organization/organizationNumber` + string workload = 3 [(google.api.field_behavior) = REQUIRED]; +} + +// ========================== PostureDeployments ========================== +// Message describing PostureDeployment resource. +message PostureDeployment { + option (google.api.resource) = { + type: "securityposture.googleapis.com/PostureDeployment" + pattern: "organizations/{organization}/locations/{location}/postureDeployments/{posture_deployment}" + plural: "postureDeployments" + singular: "postureDeployment" + style: DECLARATIVE_FRIENDLY + }; + + // State of a PostureDeployment. + enum State { + // Unspecified operation state. + STATE_UNSPECIFIED = 0; + + // The PostureDeployment is being created. + CREATING = 1; + + // The PostureDeployment is being deleted. + DELETING = 2; + + // The PostureDeployment state is being updated. + UPDATING = 3; + + // The PostureDeployment state is active and in use. + ACTIVE = 4; + + // The PostureDeployment creation failed. + CREATE_FAILED = 5; + + // The PostureDeployment update failed. + UPDATE_FAILED = 6; + + // The PostureDeployment deletion failed. + DELETE_FAILED = 7; + } + + // Required. The name of this PostureDeployment resource, in the format of + // organizations/{organization}/locations/{location_id}/postureDeployments/{postureDeployment}. + string name = 1 [(google.api.field_behavior) = REQUIRED]; + + // Required. Target resource where the Posture will be deployed. Currently + // supported resources are of types: projects/projectNumber, + // folders/folderNumber, organizations/organizationNumber. + string target_resource = 13 [(google.api.field_behavior) = REQUIRED]; + + // Output only. State of PostureDeployment resource. + State state = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Required. Posture that needs to be deployed. + // Format: + // organizations/{org_id}/locations/{location_id}/postures/ + // Example: + // organizations/99/locations/global/postures/les-miserables. + string posture_id = 3 [(google.api.field_behavior) = REQUIRED]; + + // Required. Revision_id of the Posture that is to be deployed. + string posture_revision_id = 4 [(google.api.field_behavior) = REQUIRED]; + + // Output only. The timestamp that the PostureDeployment was created. + google.protobuf.Timestamp create_time = 5 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The timestamp that the PostureDeployment was updated. + google.protobuf.Timestamp update_time = 6 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Optional. User provided description of the PostureDeployment. + string description = 7 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. An opaque tag indicating the current version of the + // PostureDeployment, used for concurrency control. When the + // `PostureDeployment` is returned from either a `GetPostureDeployment` or a + // `ListPostureDeployments` request, this `etag` indicates the version of the + // current `PostureDeployment` to use when executing a read-modify-write loop. + // + // When the `PostureDeployment` is used in a `UpdatePostureDeployment` method, + // use the `etag` value that was returned from a `GetPostureDeployment` + // request as part of a read-modify-write loop for concurrency control. Not + // setting the `etag` in a `UpdatePostureDeployment` request will result in an + // unconditional write of the `PostureDeployment`. + string etag = 8 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. User annotations. These attributes can only be set and used by + // the user, and not by Google Security Postures. + // . + map annotations = 9 [(google.api.field_behavior) = OPTIONAL]; + + // Output only. Whether or not this Posture is in the process of being + // updated. + bool reconciling = 10 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. This is a output only optional field which will be filled in + // case where PostureDeployment state is UPDATE_FAILED or CREATE_FAILED or + // DELETE_FAILED. It denotes the desired Posture. + string desired_posture_id = 11 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Output only optional field which provides revision_id of the + // desired_posture_id. + string desired_posture_revision_id = 12 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. This is a output only optional field which will be filled in + // case where PostureDeployment enters a failure state like UPDATE_FAILED or + // CREATE_FAILED or DELETE_FAILED. + string failure_message = 14 [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// Message for requesting list of PostureDeployments. +message ListPostureDeploymentsRequest { + // Required. Parent value for ListPostureDeploymentsRequest. + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "securityposture.googleapis.com/PostureDeployment" + } + ]; + + // Optional. Requested page size. Server may return fewer items than + // requested. If unspecified, server will pick an appropriate default. + int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. A token identifying a page of results the server should return. + string page_token = 3 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Filter to be applied on the resource, defined by EBNF grammar + // https://google.aip.dev/assets/misc/ebnf-filtering.txt. + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; +} + +// Message for response to listing PostureDeployments. +message ListPostureDeploymentsResponse { + // The list of PostureDeployment. + repeated PostureDeployment posture_deployments = 1; + + // A token identifying a page of results the server should return. + string next_page_token = 2; + + // Locations that could not be reached. + repeated string unreachable = 3; +} + +// Message for getting a PostureDeployment. +message GetPostureDeploymentRequest { + // Required. Name of the resource. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "securityposture.googleapis.com/PostureDeployment" + } + ]; +} + +// Message for creating a PostureDeployment. +message CreatePostureDeploymentRequest { + // Required. Value for parent. + // Format: organizations/{org_id}/locations/{location} + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "securityposture.googleapis.com/PostureDeployment" + } + ]; + + // Required. User provided identifier. It should be unique in scope of an + // Organization and location. + string posture_deployment_id = 2 [(google.api.field_behavior) = REQUIRED]; + + // Required. The resource being created. + PostureDeployment posture_deployment = 3 + [(google.api.field_behavior) = REQUIRED]; +} + +// Message for updating a PostureDeployment. +message UpdatePostureDeploymentRequest { + // Required. Field mask is used to specify the fields to be overwritten in the + // PostureDeployment resource by the update. + // The fields specified in the update_mask are relative to the resource, not + // the full request. A field will be overwritten if it is in the mask. If the + // user does not provide a mask then all fields will be overwritten. + google.protobuf.FieldMask update_mask = 1 + [(google.api.field_behavior) = REQUIRED]; + + // Required. The resource being updated. + PostureDeployment posture_deployment = 2 + [(google.api.field_behavior) = REQUIRED]; +} + +// Message for deleting a PostureDeployment. +message DeletePostureDeploymentRequest { + // Required. Name of the resource. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "securityposture.googleapis.com/PostureDeployment" + } + ]; + + // Optional. Etag value of the PostureDeployment to be deleted. + string etag = 2 [(google.api.field_behavior) = OPTIONAL]; +} + +// PostureTemplates +// Message describing PostureTemplate object. +message PostureTemplate { + option (google.api.resource) = { + type: "securityposture.googleapis.com/PostureTemplate" + pattern: "organizations/{organization}/locations/{location}/postureTemplates/{posture_template}" + plural: "postureTemplates" + singular: "postureTemplate" + }; + + // State of a PostureTemplate + enum State { + // Unspecified state + STATE_UNSPECIFIED = 0; + + // If the Posture template is adhering to the latest controls and standards. + ACTIVE = 1; + + // If the Posture template controls and standards are outdated and not + // recommended for use. + DEPRECATED = 2; + } + + // Output only. Identifier. The name of the Posture template will be of the + // format + // organizations/{organization}/locations/{location}/postureTemplates/{postureTemplate} + string name = 1 [ + (google.api.field_behavior) = OUTPUT_ONLY, + (google.api.field_behavior) = IDENTIFIER + ]; + + // Output only. The revision_id of a PostureTemplate. + string revision_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Description of the Posture template. + string description = 3 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. State of PostureTemplate resource. + State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Policy_sets to be used by the user. + repeated PolicySet policy_sets = 5 + [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// Message for requesting list of Posture Templates. +message ListPostureTemplatesRequest { + // Required. Parent value for ListPostureTemplatesRequest. + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "securityposture.googleapis.com/PostureTemplate" + } + ]; + + // Optional. Requested page size. Server may return fewer items than + // requested. If unspecified, server will pick an appropriate default. + int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. A token identifying a page of results the server should return. + string page_token = 3 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Filter to be applied on the resource, defined by EBNF grammar + // https://google.aip.dev/assets/misc/ebnf-filtering.txt. + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; +} + +// Message for response to listing PostureTemplates. +message ListPostureTemplatesResponse { + // The list of PostureTemplate. + repeated PostureTemplate posture_templates = 1; + + // A token identifying a page of results the server should return. + string next_page_token = 2; +} + +// Message for getting a Posture Template. +message GetPostureTemplateRequest { + // Required. Name of the resource. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "securityposture.googleapis.com/PostureTemplate" + } + ]; + + // Optional. Specific revision_id of a Posture Template. + // PostureTemplate revision_id which needs to be retrieved. + string revision_id = 2 [(google.api.field_behavior) = OPTIONAL]; +} diff --git a/google/cloud/securityposture/v1/securityposture_v1.yaml b/google/cloud/securityposture/v1/securityposture_v1.yaml new file mode 100644 index 0000000000..4d9089995f --- /dev/null +++ b/google/cloud/securityposture/v1/securityposture_v1.yaml @@ -0,0 +1,96 @@ +type: google.api.Service +config_version: 3 +name: securityposture.googleapis.com +title: Security Posture API + +apis: +- name: google.cloud.location.Locations +- name: google.cloud.securityposture.v1.SecurityPosture +- name: google.longrunning.Operations + +documentation: + summary: Security Posture is a comprehensive framework of policy sets that empowers organizations to define, assess early, deploy, and monitor their security measures in a unified way and helps simplify governance and reduces administrative toil. + rules: + - selector: google.cloud.location.Locations.GetLocation + description: Gets information about a location. + + - selector: google.cloud.location.Locations.ListLocations + description: Lists information about the supported locations for this service. + +http: + rules: + - selector: google.cloud.location.Locations.GetLocation + get: '/v1/{name=organizations/*/locations/*}' + - selector: google.cloud.location.Locations.ListLocations + get: '/v1/{name=organizations/*}/locations' + - selector: google.longrunning.Operations.CancelOperation + post: '/v1/{name=organizations/*/locations/*/operations/*}:cancel' + body: '*' + - selector: google.longrunning.Operations.DeleteOperation + delete: '/v1/{name=organizations/*/locations/*/operations/*}' + - selector: google.longrunning.Operations.GetOperation + get: '/v1/{name=organizations/*/locations/*/operations/*}' + - selector: google.longrunning.Operations.ListOperations + get: '/v1/{name=organizations/*/locations/*}/operations' + +authentication: + rules: + - selector: google.cloud.location.Locations.GetLocation + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + - selector: google.cloud.location.Locations.ListLocations + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + - selector: 'google.cloud.securityposture.v1.SecurityPosture.*' + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + - selector: 'google.longrunning.Operations.*' + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + +publishing: + new_issue_uri: https://issuetracker.google.com/issues/new?component=190865&template=1161103 + api_short_name: securityposture + github_label: 'api: securityposture' + doc_tag_prefix: securityposture + organization: CLOUD + library_settings: + - version: google.cloud.securityposture.v1 + launch_stage: GA + java_settings: + common: + destinations: + - PACKAGE_MANAGER + cpp_settings: + common: + destinations: + - PACKAGE_MANAGER + php_settings: + common: + destinations: + - PACKAGE_MANAGER + python_settings: + common: + destinations: + - PACKAGE_MANAGER + node_settings: + common: + destinations: + - PACKAGE_MANAGER + dotnet_settings: + common: + destinations: + - PACKAGE_MANAGER + ruby_settings: + common: + destinations: + - PACKAGE_MANAGER + go_settings: + common: + destinations: + - PACKAGE_MANAGER + proto_reference_documentation_uri: https://cloud.google.com/securityposture/docs/reference/rpc diff --git a/google/cloud/securityposture/v1/securityposture_v1_grpc_service_config.json b/google/cloud/securityposture/v1/securityposture_v1_grpc_service_config.json new file mode 100644 index 0000000000..2839993b9a --- /dev/null +++ b/google/cloud/securityposture/v1/securityposture_v1_grpc_service_config.json @@ -0,0 +1,29 @@ +{ + "methodConfig": [{ + "name": [ + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostures" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostureRevisions" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "GetPosture" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "CreatePosture" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "UpdatePosture" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "DeletePosture" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ExtractPosture" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostureDeployments" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "GetPostureDeployment" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "CreatePostureDeployment" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "UpdatePostureDeployment" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "DeletePostureDeployment" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "ListPostureTemplates" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "GetPostureTemplate" }, + { "service": "google.cloud.securityposture.v1.SecurityPosture", "method": "CreateIaCValidationReport" } + ], + "timeout": "60s", + "retryPolicy": { + "maxAttempts": 5, + "initialBackoff": "1s", + "maxBackoff": "10s", + "backoffMultiplier": 1.3, + "retryableStatusCodes": ["UNAVAILABLE"] + } + }] +} diff --git a/google/cloud/securityposture/v1/sha_constraints.proto b/google/cloud/securityposture/v1/sha_constraints.proto new file mode 100644 index 0000000000..513c19905b --- /dev/null +++ b/google/cloud/securityposture/v1/sha_constraints.proto @@ -0,0 +1,72 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.securityposture.v1; + +import "google/api/field_behavior.proto"; +import "google/cloud/securityposture/v1/sha_custom_config.proto"; + +option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb"; +option java_multiple_files = true; +option java_outer_classname = "ShaConstraintsProto"; +option java_package = "com.google.cloud.securityposture.v1"; + +// Possible enablement states of a service or module. +enum EnablementState { + // Default value. This value is unused. + ENABLEMENT_STATE_UNSPECIFIED = 0; + + // State is enabled. + ENABLED = 1; + + // State is disabled. + DISABLED = 2; +} + +// Message for Security Health Analytics built-in detector. +message SecurityHealthAnalyticsModule { + // Required. The name of the module eg: BIGQUERY_TABLE_CMEK_DISABLED. + string module_name = 1 [(google.api.field_behavior) = REQUIRED]; + + // The state of enablement for the module at its level of the resource + // hierarchy. + EnablementState module_enablement_state = 2; +} + +// Message for SHA Custom Module +message SecurityHealthAnalyticsCustomModule { + // Output only. Immutable. The id of the custom module. + // The id is server-generated and is not user settable. + // It will be a numeric id containing 1-20 digits. + string id = 1 [ + (google.api.field_behavior) = IMMUTABLE, + (google.api.field_behavior) = OUTPUT_ONLY + ]; + + // Optional. The display name of the Security Health Analytics custom module. + // This display name becomes the finding category for all findings that are + // returned by this custom module. The display name must be between 1 and + // 128 characters, start with a lowercase letter, and contain alphanumeric + // characters or underscores only. + string display_name = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Required. custom module details + CustomConfig config = 3 [(google.api.field_behavior) = REQUIRED]; + + // The state of enablement for the module at its level of the resource + // hierarchy. + EnablementState module_enablement_state = 4; +} diff --git a/google/cloud/securityposture/v1/sha_custom_config.proto b/google/cloud/securityposture/v1/sha_custom_config.proto new file mode 100644 index 0000000000..1685dc61b2 --- /dev/null +++ b/google/cloud/securityposture/v1/sha_custom_config.proto @@ -0,0 +1,102 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.securityposture.v1; + +import "google/api/field_behavior.proto"; +import "google/type/expr.proto"; + +option go_package = "cloud.google.com/go/securityposture/apiv1/securityposturepb;securityposturepb"; +option java_multiple_files = true; +option java_outer_classname = "ShaCustomConfigProto"; +option java_package = "com.google.cloud.securityposture.v1"; + +// Defines the properties in a custom module configuration for Security +// Health Analytics. Use the custom module configuration to create custom +// detectors that generate custom findings for resources that you specify. +message CustomConfig { + // A set of optional name-value pairs that define custom source properties to + // return with each finding that is generated by the custom module. The custom + // source properties that are defined here are included in the finding JSON + // under `sourceProperties`. + message CustomOutputSpec { + // An individual name-value pair that defines a custom source property. + message Property { + // Required. Name of the property for the custom output. + string name = 1 [(google.api.field_behavior) = REQUIRED]; + + // Optional. The CEL expression for the custom output. A resource property + // can be specified to return the value of the property or a text string + // enclosed in quotation marks. + google.type.Expr value_expression = 2 + [(google.api.field_behavior) = OPTIONAL]; + } + + // Optional. A list of custom output properties to add to the finding. + repeated Property properties = 1 [(google.api.field_behavior) = OPTIONAL]; + } + + // Resource for selecting resource type. + message ResourceSelector { + // Required. The resource types to run the detector on. + repeated string resource_types = 1 [(google.api.field_behavior) = REQUIRED]; + } + + // Defines the valid value options for the severity of a finding. + enum Severity { + // Unspecified severity. + SEVERITY_UNSPECIFIED = 0; + + // Critical severity. + CRITICAL = 1; + + // High severity. + HIGH = 2; + + // Medium severity. + MEDIUM = 3; + + // Low severity. + LOW = 4; + } + + // Required. The CEL expression to evaluate to produce findings. When the + // expression evaluates to true against a resource, a finding is generated. + google.type.Expr predicate = 1 [(google.api.field_behavior) = REQUIRED]; + + // Optional. Custom output properties. + CustomOutputSpec custom_output = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Required. The resource types that the custom module operates on. Each + // custom module can specify up to 5 resource types. + ResourceSelector resource_selector = 3 + [(google.api.field_behavior) = REQUIRED]; + + // Required. The severity to assign to findings generated by the module. + Severity severity = 4 [(google.api.field_behavior) = REQUIRED]; + + // Optional. Text that describes the vulnerability or misconfiguration that + // the custom module detects. This explanation is returned with each finding + // instance to help investigators understand the detected issue. The text must + // be enclosed in quotation marks. + string description = 5 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. An explanation of the recommended steps that security teams can + // take to resolve the detected issue. This explanation is returned with each + // finding generated by this module in the `nextSteps` property of the finding + // JSON. + string recommendation = 6 [(google.api.field_behavior) = OPTIONAL]; +}