feat: added CloudControlsPartner API

PiperOrigin-RevId: 606720708

google/cloud/cloudcontrolspartner/v1beta/BUILD.bazel

@@ -0,0 +1,385 @@
+# This file was automatically generated by BuildFileGenerator
+# https://github.com/googleapis/rules_gapic/tree/master/bazel
+
+# Most of the manual changes to this file will be overwritten.
+# It's **only** allowed to change the following rule attribute values:
+# - names of *_gapic_assembly_* rules
+# - certain parameters of *_gapic_library rules, including but not limited to:
+#    * extra_protoc_parameters
+#    * extra_protoc_file_parameters
+# The complete list of preserved parameters can be found in the source code.
+
+# This is an API workspace, having public visibility by default makes perfect sense.
+package(default_visibility = ["//visibility:public"])
+
+##############################################################################
+# Common
+##############################################################################
+load("@rules_proto//proto:defs.bzl", "proto_library")
+load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info")
+
+proto_library(
+    name = "cloudcontrolspartner_proto",
+    srcs = [
+        "access_approval_requests.proto",
+        "completion_state.proto",
+        "core.proto",
+        "customer_workloads.proto",
+        "customers.proto",
+        "ekm_connections.proto",
+        "monitoring.proto",
+        "partner_permissions.proto",
+        "partners.proto",
+        "violations.proto",
+    ],
+    deps = [
+        "//google/api:annotations_proto",
+        "//google/api:client_proto",
+        "//google/api:field_behavior_proto",
+        "//google/api:resource_proto",
+        "//google/type:interval_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+
+proto_library_with_info(
+    name = "cloudcontrolspartner_proto_with_info",
+    deps = [
+        ":cloudcontrolspartner_proto",
+        "//google/cloud:common_resources_proto",
+    ],
+)
+
+##############################################################################
+# Java
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "java_gapic_assembly_gradle_pkg",
+    "java_gapic_library",
+    "java_gapic_test",
+    "java_grpc_library",
+    "java_proto_library",
+)
+
+java_proto_library(
+    name = "cloudcontrolspartner_java_proto",
+    deps = [":cloudcontrolspartner_proto"],
+)
+
+java_grpc_library(
+    name = "cloudcontrolspartner_java_grpc",
+    srcs = [":cloudcontrolspartner_proto"],
+    deps = [":cloudcontrolspartner_java_proto"],
+)
+
+java_gapic_library(
+    name = "cloudcontrolspartner_java_gapic",
+    srcs = [":cloudcontrolspartner_proto_with_info"],
+    gapic_yaml = None,
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    rest_numeric_enums = True,
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    test_deps = [
+        ":cloudcontrolspartner_java_grpc",
+    ],
+    transport = "grpc+rest",
+    deps = [
+        ":cloudcontrolspartner_java_proto",
+        "//google/api:api_java_proto",
+    ],
+)
+
+java_gapic_test(
+    name = "cloudcontrolspartner_java_gapic_test_suite",
+    test_classes = [
+        "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCoreClientHttpJsonTest",
+        "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCoreClientTest",
+        "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoringClientHttpJsonTest",
+        "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoringClientTest",
+    ],
+    runtime_deps = [":cloudcontrolspartner_java_gapic_test"],
+)
+
+# Open Source Packages
+java_gapic_assembly_gradle_pkg(
+    name = "google-cloud-cloudcontrolspartner-v1beta-java",
+    transport = "grpc+rest",
+    deps = [
+        ":cloudcontrolspartner_java_gapic",
+        ":cloudcontrolspartner_java_grpc",
+        ":cloudcontrolspartner_java_proto",
+        ":cloudcontrolspartner_proto",
+    ],
+    include_samples = True,
+)
+
+##############################################################################
+# Go
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "go_gapic_assembly_pkg",
+    "go_gapic_library",
+    "go_proto_library",
+)
+
+go_proto_library(
+    name = "cloudcontrolspartner_go_proto",
+    compilers = ["@io_bazel_rules_go//proto:go_grpc"],
+    importpath = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb",
+    protos = [":cloudcontrolspartner_proto"],
+    deps = [
+        "//google/api:annotations_go_proto",
+        "//google/type:interval_go_proto",
+    ],
+)
+
+go_gapic_library(
+    name = "cloudcontrolspartner_go_gapic",
+    srcs = [":cloudcontrolspartner_proto_with_info"],
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    importpath = "cloud.google.com/go/cloudcontrolspartner/apiv1beta;cloudcontrolspartner",
+    metadata = True,
+    release_level = "beta",
+    rest_numeric_enums = True,
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    transport = "grpc+rest",
+    deps = [
+        ":cloudcontrolspartner_go_proto",
+    ],
+)
+
+# Open Source Packages
+go_gapic_assembly_pkg(
+    name = "gapi-cloud-cloudcontrolspartner-v1beta-go",
+    deps = [
+        ":cloudcontrolspartner_go_gapic",
+        ":cloudcontrolspartner_go_gapic_srcjar-test.srcjar",
+        ":cloudcontrolspartner_go_gapic_srcjar-metadata.srcjar",
+        ":cloudcontrolspartner_go_gapic_srcjar-snippets.srcjar",
+        ":cloudcontrolspartner_go_proto",
+    ],
+)
+
+##############################################################################
+# Python
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "py_gapic_assembly_pkg",
+    "py_gapic_library",
+    "py_test",
+)
+
+py_gapic_library(
+    name = "cloudcontrolspartner_py_gapic",
+    srcs = [":cloudcontrolspartner_proto"],
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    rest_numeric_enums = True,
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    transport = "grpc+rest",
+    deps = [
+    ],
+)
+
+py_test(
+    name = "cloudcontrolspartner_py_gapic_test",
+    srcs = [
+        "cloudcontrolspartner_py_gapic_pytest.py",
+        "cloudcontrolspartner_py_gapic_test.py",
+    ],
+    legacy_create_init = False,
+    deps = [":cloudcontrolspartner_py_gapic"],
+)
+
+# Open Source Packages
+py_gapic_assembly_pkg(
+    name = "cloudcontrolspartner-v1beta-py",
+    deps = [
+        ":cloudcontrolspartner_py_gapic",
+    ],
+)
+
+##############################################################################
+# PHP
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "php_gapic_assembly_pkg",
+    "php_gapic_library",
+    "php_proto_library",
+)
+
+php_proto_library(
+    name = "cloudcontrolspartner_php_proto",
+    deps = [":cloudcontrolspartner_proto"],
+)
+
+php_gapic_library(
+    name = "cloudcontrolspartner_php_gapic",
+    srcs = [":cloudcontrolspartner_proto_with_info"],
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    rest_numeric_enums = True,
+    migration_mode = "NEW_SURFACE_ONLY",
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    transport = "grpc+rest",
+    deps = [
+        ":cloudcontrolspartner_php_proto",
+    ],
+)
+
+# Open Source Packages
+php_gapic_assembly_pkg(
+    name = "google-cloud-cloudcontrolspartner-v1beta-php",
+    deps = [
+        ":cloudcontrolspartner_php_gapic",
+        ":cloudcontrolspartner_php_proto",
+    ],
+)
+
+##############################################################################
+# Node.js
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "nodejs_gapic_assembly_pkg",
+    "nodejs_gapic_library",
+)
+
+nodejs_gapic_library(
+    name = "cloudcontrolspartner_nodejs_gapic",
+    package_name = "@google-cloud/cloudcontrolspartner",
+    src = ":cloudcontrolspartner_proto_with_info",
+    extra_protoc_parameters = ["metadata"],
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    package = "google.cloud.cloudcontrolspartner.v1beta",
+    rest_numeric_enums = True,
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    transport = "grpc+rest",
+    deps = [],
+)
+
+nodejs_gapic_assembly_pkg(
+    name = "cloudcontrolspartner-v1beta-nodejs",
+    deps = [
+        ":cloudcontrolspartner_nodejs_gapic",
+        ":cloudcontrolspartner_proto",
+    ],
+)
+
+##############################################################################
+# Ruby
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "ruby_gapic_assembly_pkg",
+    "ruby_cloud_gapic_library",
+    "ruby_grpc_library",
+    "ruby_proto_library",
+)
+
+ruby_proto_library(
+    name = "cloudcontrolspartner_ruby_proto",
+    deps = [":cloudcontrolspartner_proto"],
+)
+
+ruby_grpc_library(
+    name = "cloudcontrolspartner_ruby_grpc",
+    srcs = [":cloudcontrolspartner_proto"],
+    deps = [":cloudcontrolspartner_ruby_proto"],
+)
+
+ruby_cloud_gapic_library(
+    name = "cloudcontrolspartner_ruby_gapic",
+    srcs = [":cloudcontrolspartner_proto_with_info"],
+    extra_protoc_parameters = [
+        "ruby-cloud-gem-name=google-cloud-cloudcontrolspartner-v1beta",
+    ],
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    rest_numeric_enums = True,
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    transport = "grpc+rest",
+    deps = [
+        ":cloudcontrolspartner_ruby_grpc",
+        ":cloudcontrolspartner_ruby_proto",
+    ],
+)
+
+# Open Source Packages
+ruby_gapic_assembly_pkg(
+    name = "google-cloud-cloudcontrolspartner-v1beta-ruby",
+    deps = [
+        ":cloudcontrolspartner_ruby_gapic",
+        ":cloudcontrolspartner_ruby_grpc",
+        ":cloudcontrolspartner_ruby_proto",
+    ],
+)
+
+##############################################################################
+# C#
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "csharp_gapic_assembly_pkg",
+    "csharp_gapic_library",
+    "csharp_grpc_library",
+    "csharp_proto_library",
+)
+
+csharp_proto_library(
+    name = "cloudcontrolspartner_csharp_proto",
+    extra_opts = [],
+    deps = [":cloudcontrolspartner_proto"],
+)
+
+csharp_grpc_library(
+    name = "cloudcontrolspartner_csharp_grpc",
+    srcs = [":cloudcontrolspartner_proto"],
+    deps = [":cloudcontrolspartner_csharp_proto"],
+)
+
+csharp_gapic_library(
+    name = "cloudcontrolspartner_csharp_gapic",
+    srcs = [":cloudcontrolspartner_proto_with_info"],
+    common_resources_config = "@gax_dotnet//:Google.Api.Gax/ResourceNames/CommonResourcesConfig.json",
+    grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json",
+    rest_numeric_enums = True,
+    service_yaml = "cloudcontrolspartner_v1beta.yaml",
+    transport = "grpc+rest",
+    deps = [
+        ":cloudcontrolspartner_csharp_grpc",
+        ":cloudcontrolspartner_csharp_proto",
+    ],
+)
+
+# Open Source Packages
+csharp_gapic_assembly_pkg(
+    name = "google-cloud-cloudcontrolspartner-v1beta-csharp",
+    deps = [
+        ":cloudcontrolspartner_csharp_gapic",
+        ":cloudcontrolspartner_csharp_grpc",
+        ":cloudcontrolspartner_csharp_proto",
+    ],
+)
+
+##############################################################################
+# C++
+##############################################################################
+load(
+    "@com_google_googleapis_imports//:imports.bzl",
+    "cc_grpc_library",
+    "cc_proto_library",
+)
+
+cc_proto_library(
+    name = "cloudcontrolspartner_cc_proto",
+    deps = [":cloudcontrolspartner_proto"],
+)
+
+cc_grpc_library(
+    name = "cloudcontrolspartner_cc_grpc",
+    srcs = [":cloudcontrolspartner_proto"],
+    grpc_only = True,
+    deps = [":cloudcontrolspartner_cc_proto"],
+)

google/cloud/cloudcontrolspartner/v1beta/access_approval_requests.proto

@@ -0,0 +1,146 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "AccessApprovalRequestsProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Details about the Access request.
+message AccessApprovalRequest {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/AccessApprovalRequest"
+    pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/accessApprovalRequests/{access_approval_request}"
+    plural: "accessApprovalRequests"
+    singular: "accessApprovalRequest"
+  };
+
+  // Identifier. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/accessApprovalRequests/{access_approval_request}.
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The time at which approval was requested.
+  google.protobuf.Timestamp request_time = 2;
+
+  // The justification for which approval is being requested.
+  AccessReason requested_reason = 3;
+
+  // The requested expiration for the approval. If the request is approved,
+  // access will be granted from the time of approval until the expiration time.
+  google.protobuf.Timestamp requested_expiration_time = 4;
+}
+
+// Request for getting the access requests associated with a workload.
+message ListAccessApprovalRequestsRequest {
+  // Required. Parent resource
+  // Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "cloudcontrolspartner.googleapis.com/AccessApprovalRequest"
+    }
+  ];
+
+  // Optional. The maximum number of access requests to return. The service may
+  // return fewer than this value. If unspecified, at most 500 access requests
+  // will be returned.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token, received from a previous
+  // `ListAccessApprovalRequests` call. Provide this to retrieve the subsequent
+  // page.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Filtering results.
+  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Hint for how to order the results.
+  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Response message for list access requests.
+message ListAccessApprovalRequestsResponse {
+  // List of access approval requests
+  repeated AccessApprovalRequest access_approval_requests = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Reason for the access.
+message AccessReason {
+  // Type of access justification.
+  enum Type {
+    // Default value for proto, shouldn't be used.
+    TYPE_UNSPECIFIED = 0;
+
+    // Customer made a request or raised an issue that required the principal to
+    // access customer data. `detail` is of the form ("#####" is the issue ID):
+    //
+    // - "Feedback Report: #####"
+    // - "Case Number: #####"
+    // - "Case ID: #####"
+    // - "E-PIN Reference: #####"
+    // - "Google-#####"
+    // - "T-#####"
+    CUSTOMER_INITIATED_SUPPORT = 1;
+
+    // The principal accessed customer data in order to diagnose or resolve a
+    // suspected issue in services. Often this access is used to confirm that
+    // customers are not affected by a suspected service issue or to remediate a
+    // reversible system issue.
+    GOOGLE_INITIATED_SERVICE = 2;
+
+    // Google initiated service for security, fraud, abuse, or compliance
+    // purposes.
+    GOOGLE_INITIATED_REVIEW = 3;
+
+    // The principal was compelled to access customer data in order to respond
+    // to a legal third party data request or process, including legal processes
+    // from customers themselves.
+    THIRD_PARTY_DATA_REQUEST = 4;
+
+    // The principal accessed customer data in order to diagnose or resolve a
+    // suspected issue in services or a known outage.
+    GOOGLE_RESPONSE_TO_PRODUCTION_ALERT = 5;
+
+    // Similar to 'GOOGLE_INITIATED_SERVICE' or 'GOOGLE_INITIATED_REVIEW', but
+    // with universe agnostic naming. The principal accessed customer data in
+    // order to diagnose or resolve a suspected issue in services or a known
+    // outage, or for security, fraud, abuse, or compliance review purposes.
+    CLOUD_INITIATED_ACCESS = 6;
+  }
+
+  // Type of access justification.
+  Type type = 1;
+
+  // More detail about certain reason types. See comments for each type above.
+  string detail = 2;
+}

google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta.yaml

@@ -0,0 +1,39 @@
+type: google.api.Service
+config_version: 3
+name: cloudcontrolspartner.googleapis.com
+title: Cloud Controls Partner API
+
+apis:
+- name: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore
+- name: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring
+
+types:
+- name: google.cloud.cloudcontrolspartner.v1beta.OperationMetadata
+
+documentation:
+  summary: |-
+    Provides insights about your customers and their Assured Workloads based on
+    your Sovereign Controls by Partners offering.
+
+authentication:
+  rules:
+  - selector: 'google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring.GetViolation
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring.ListViolations
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+
+publishing:
+  new_issue_uri: https://issuetracker.google.com/issues/new?component=1504051
+  documentation_uri: https://cloud.google.com/cloud-controls-partner/docs
+  api_short_name: cloudcontrolspartner
+  github_label: 'api: cloudcontrolspartner'
+  doc_tag_prefix: cloudcontrolspartner
+  organization: CLOUD

google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta_grpc_service_config.json

@@ -0,0 +1,23 @@
+{
+  "methodConfig": [{
+    "name": [
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetCustomer" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetEkmConnections" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetPartnerPermissions" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetWorkload" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "ListAccessApprovalRequests" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "ListCustomers" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "ListWorkloads" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring", "method": "GetViolation" },
+      { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring", "method": "ListViolations" }
+    ],
+    "timeout": "60s",
+    "retryPolicy": {
+      "maxAttempts": 5,
+      "initialBackoff": "1s",
+      "maxBackoff": "10s",
+      "backoffMultiplier": 1.3,
+      "retryableStatusCodes": ["UNAVAILABLE"]
+    }
+  }]
+}

google/cloud/cloudcontrolspartner/v1beta/completion_state.proto

@@ -0,0 +1,43 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "CompletionStateProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Enum for possible completion states.
+enum CompletionState {
+  // Unspecified completion state.
+  COMPLETION_STATE_UNSPECIFIED = 0;
+
+  // Task started (has start date) but not yet completed.
+  PENDING = 1;
+
+  // Succeeded state.
+  SUCCEEDED = 2;
+
+  // Failed state.
+  FAILED = 3;
+
+  // Not applicable state.
+  NOT_APPLICABLE = 4;
+}

google/cloud/cloudcontrolspartner/v1beta/core.proto

@@ -0,0 +1,144 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/access_approval_requests.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/customer_workloads.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/customers.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/ekm_connections.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/partner_permissions.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/partners.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "CoreProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+option (google.api.resource_definition) = {
+  type: "cloudcontrolspartner.googleapis.com/OrganizationLocation"
+  pattern: "organizations/{organization}/locations/{location}"
+};
+
+// Service describing handlers for resources
+service CloudControlsPartnerCore {
+  option (google.api.default_host) = "cloudcontrolspartner.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/cloud-platform";
+
+  // Gets details of a single workload
+  rpc GetWorkload(GetWorkloadRequest) returns (Workload) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Lists customer workloads for a given customer org id
+  rpc ListWorkloads(ListWorkloadsRequest) returns (ListWorkloadsResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=organizations/*/locations/*/customers/*}/workloads"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets details of a single customer
+  rpc GetCustomer(GetCustomerRequest) returns (Customer) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=organizations/*/locations/*/customers/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Lists customers of a partner identified by its GCP organization id
+  rpc ListCustomers(ListCustomersRequest) returns (ListCustomersResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=organizations/*/locations/*}/customers"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets the EKM connections associated with a workload
+  rpc GetEkmConnections(GetEkmConnectionsRequest) returns (EkmConnections) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*/ekmConnections}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Gets the partner permissions granted for a workload
+  rpc GetPartnerPermissions(GetPartnerPermissionsRequest)
+      returns (PartnerPermissions) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*/partnerPermissions}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Lists access requests associated with a workload
+  rpc ListAccessApprovalRequests(ListAccessApprovalRequestsRequest)
+      returns (ListAccessApprovalRequestsResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=organizations/*/locations/*/customers/*/workloads/*}/accessApprovalRequests"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Get details of a Partner.
+  rpc GetPartner(GetPartnerRequest) returns (Partner) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=organizations/*/locations/*/partner}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+}
+
+// Represents the metadata of the long-running operation.
+message OperationMetadata {
+  // Output only. The time the operation was created.
+  google.protobuf.Timestamp create_time = 1
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The time the operation finished running.
+  google.protobuf.Timestamp end_time = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Server-defined resource path for the target of the operation.
+  string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Name of the verb executed by the operation.
+  string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Human-readable status of the operation, if any.
+  string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Identifies whether the user has requested cancellation
+  // of the operation. Operations that have been cancelled successfully
+  // have [Operation.error][] value with a
+  // [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to
+  // `Code.CANCELLED`.
+  bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. API version used to start the operation.
+  string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+}

google/cloud/cloudcontrolspartner/v1beta/customer_workloads.proto

@@ -0,0 +1,182 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/completion_state.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "CustomerWorkloadsProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Contains metadata around the [Workload
+// resource](https://cloud.google.com/assured-workloads/docs/reference/rest/Shared.Types/Workload)
+// in the Assured Workloads API.
+message Workload {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/Workload"
+    pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}"
+    plural: "workloads"
+    singular: "workload"
+  };
+
+  // Supported Assured Workloads Partners.
+  enum Partner {
+    // Unknown Partner.
+    PARTNER_UNSPECIFIED = 0;
+
+    // Enum representing S3NS (Thales) partner.
+    PARTNER_LOCAL_CONTROLS_BY_S3NS = 1;
+
+    // Enum representing T_SYSTEM (TSI) partner.
+    PARTNER_SOVEREIGN_CONTROLS_BY_T_SYSTEMS = 2;
+
+    // Enum representing SIA_MINSAIT (Indra) partner.
+    PARTNER_SOVEREIGN_CONTROLS_BY_SIA_MINSAIT = 3;
+
+    // Enum representing PSN (TIM) partner.
+    PARTNER_SOVEREIGN_CONTROLS_BY_PSN = 4;
+
+    // Enum representing CNTXT (Kingdom of Saudi Arabia) partner.
+    PARTNER_SOVEREIGN_CONTROLS_BY_CNTXT = 6;
+
+    // Enum representing CNXT (Kingdom of Saudi Arabia) partner offering without
+    // EKM provisioning.
+    PARTNER_SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM = 7;
+  }
+
+  // Identifier. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // Output only. Folder id this workload is associated with
+  int64 folder_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time the resource was created.
+  google.protobuf.Timestamp create_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The name of container folder of the assured workload
+  string folder = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Container for workload onboarding steps.
+  WorkloadOnboardingState workload_onboarding_state = 5;
+
+  // Indicates whether a workload is fully onboarded.
+  bool is_onboarded = 6;
+
+  // The project id of the key management project for the workload
+  string key_management_project_id = 7;
+
+  // The gcp location of the workload
+  string location = 8;
+
+  // Partner associated with this workload.
+  Partner partner = 9;
+}
+
+// Request to list customer workloads.
+message ListWorkloadsRequest {
+  // Required. Parent resource
+  // Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "cloudcontrolspartner.googleapis.com/Workload"
+    }
+  ];
+
+  // The maximum number of workloads to return. The service may return fewer
+  // than this value. If unspecified, at most 500 workloads will be returned.
+  int32 page_size = 2;
+
+  // A page token, received from a previous `ListWorkloads` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 3;
+
+  // Optional. Filtering results.
+  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Hint for how to order the results.
+  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Response message for list customer workloads requests.
+message ListWorkloadsResponse {
+  // List of customer workloads
+  repeated Workload workloads = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Message for getting a customer workload.
+message GetWorkloadRequest {
+  // Required. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudcontrolspartner.googleapis.com/Workload"
+    }
+  ];
+}
+
+// Container for workload onboarding steps.
+message WorkloadOnboardingState {
+  // List of workload onboarding steps.
+  repeated WorkloadOnboardingStep onboarding_steps = 1;
+}
+
+// Container for workload onboarding information.
+message WorkloadOnboardingStep {
+  // Enum for possible onboarding steps.
+  enum Step {
+    // Unspecified step.
+    STEP_UNSPECIFIED = 0;
+
+    // EKM Provisioned step.
+    EKM_PROVISIONED = 1;
+
+    // Signed Access Approval step.
+    SIGNED_ACCESS_APPROVAL_CONFIGURED = 2;
+  }
+
+  // The onboarding step.
+  Step step = 1;
+
+  // The starting time of the onboarding step.
+  google.protobuf.Timestamp start_time = 2;
+
+  // The completion time of the onboarding step.
+  google.protobuf.Timestamp completion_time = 3;
+
+  // Output only. The completion state of the onboarding step.
+  CompletionState completion_state = 4
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+}

google/cloud/cloudcontrolspartner/v1beta/customers.proto

@@ -0,0 +1,138 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/completion_state.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "CustomersProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Contains metadata around a Cloud Controls Partner Customer
+message Customer {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/Customer"
+    pattern: "organizations/{organization}/locations/{location}/customers/{customer}"
+    plural: "customers"
+    singular: "customer"
+  };
+
+  // Identifier. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The customer organization's display name. E.g. "google.com".
+  string display_name = 2;
+
+  // Container for customer onboarding steps
+  CustomerOnboardingState customer_onboarding_state = 3;
+
+  // Indicates whether a customer is fully onboarded
+  bool is_onboarded = 4;
+}
+
+// Request to list customers
+message ListCustomersRequest {
+  // Required. Parent resource
+  // Format: organizations/{organization}/locations/{location}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "cloudcontrolspartner.googleapis.com/Customer"
+    }
+  ];
+
+  // The maximum number of Customers to return. The service may return fewer
+  // than this value. If unspecified, at most 500 Customers will be returned.
+  int32 page_size = 2;
+
+  // A page token, received from a previous `ListCustomers` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 3;
+
+  // Optional. Filtering results
+  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Hint for how to order the results
+  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Response message for list customer Customers requests
+message ListCustomersResponse {
+  // List of customers
+  repeated Customer customers = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Message for getting a customer
+message GetCustomerRequest {
+  // Required. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudcontrolspartner.googleapis.com/Customer"
+    }
+  ];
+}
+
+// Container for customer onboarding steps
+message CustomerOnboardingState {
+  // List of customer onboarding steps
+  repeated CustomerOnboardingStep onboarding_steps = 1;
+}
+
+// Container for customer onboarding information
+message CustomerOnboardingStep {
+  // Enum for possible onboarding steps
+  enum Step {
+    // Unspecified step
+    STEP_UNSPECIFIED = 0;
+
+    // KAJ Enrollment
+    KAJ_ENROLLMENT = 1;
+
+    // Customer Environment
+    CUSTOMER_ENVIRONMENT = 2;
+  }
+
+  // The onboarding step
+  Step step = 1;
+
+  // The starting time of the onboarding step
+  google.protobuf.Timestamp start_time = 2;
+
+  // The completion time of the onboarding step
+  google.protobuf.Timestamp completion_time = 3;
+
+  // Output only. Current state of the step
+  CompletionState completion_state = 4
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+}

google/cloud/cloudcontrolspartner/v1beta/ekm_connections.proto

@@ -0,0 +1,97 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "EkmConnectionsProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// The EKM connections associated with a workload
+message EkmConnections {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/EkmConnections"
+    pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/ekmConnections"
+  };
+
+  // Identifier. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/ekmConnections
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The EKM connections associated with the workload
+  repeated EkmConnection ekm_connections = 2;
+}
+
+// Request for getting the EKM connections associated with a workload
+message GetEkmConnectionsRequest {
+  // Required. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/ekmConnections
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudcontrolspartner.googleapis.com/EkmConnections"
+    }
+  ];
+}
+
+// Details about the EKM connection
+message EkmConnection {
+  // Information around the error that occurred if the connection state is
+  // anything other than available or unspecified
+  message ConnectionError {
+    // The error domain for the error
+    string error_domain = 1;
+
+    // The error message for the error
+    string error_message = 2;
+  }
+
+  // The EKM connection state.
+  enum ConnectionState {
+    // Unspecified EKM connection state
+    CONNECTION_STATE_UNSPECIFIED = 0;
+
+    // Available EKM connection state
+    AVAILABLE = 1;
+
+    // Not available EKM connection state
+    NOT_AVAILABLE = 2;
+
+    // Error EKM connection state
+    ERROR = 3;
+
+    // Permission denied EKM connection state
+    PERMISSION_DENIED = 4;
+  }
+
+  // Resource name of the EKM connection in the format:
+  // projects/{project}/locations/{location}/ekmConnections/{ekm_connection}
+  string connection_name = 1;
+
+  // Output only. The connection state
+  ConnectionState connection_state = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The connection error that occurred if any
+  ConnectionError connection_error = 3;
+}

google/cloud/cloudcontrolspartner/v1beta/monitoring.proto

@@ -0,0 +1,58 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/cloud/cloudcontrolspartner/v1beta/violations.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "MonitoringProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Service describing handlers for resources
+service CloudControlsPartnerMonitoring {
+  option (google.api.default_host) = "cloudcontrolspartner.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/cloud-platform";
+
+  // Lists Violations for a workload
+  // Callers may also choose to read across multiple Customers or for a single
+  // customer as per
+  // [AIP-159](https://google.aip.dev/159) by using '-' (the hyphen or dash
+  // character) as a wildcard character instead of {customer} & {workload}.
+  // Format:
+  // `organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}`
+  rpc ListViolations(ListViolationsRequest) returns (ListViolationsResponse) {
+    option (google.api.http) = {
+      get: "/v1beta/{parent=organizations/*/locations/*/customers/*/workloads/*}/violations"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets details of a single Violation.
+  rpc GetViolation(GetViolationRequest) returns (Violation) {
+    option (google.api.http) = {
+      get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*/violations/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+}

google/cloud/cloudcontrolspartner/v1beta/partner_permissions.proto

@@ -0,0 +1,72 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "PartnerPermissionsProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// The permissions granted to the partner for a workload
+message PartnerPermissions {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/PartnerPermissions"
+    pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/partnerPermissions"
+  };
+
+  enum Permission {
+    // Unspecified partner permission
+    PERMISSION_UNSPECIFIED = 0;
+
+    // Permission for Access Transparency and emergency logs
+    ACCESS_TRANSPARENCY_AND_EMERGENCY_ACCESS_LOGS = 1;
+
+    // Permission for Assured Workloads monitoring violations
+    ASSURED_WORKLOADS_MONITORING = 2;
+
+    // Permission for Access Approval requests
+    ACCESS_APPROVAL_REQUESTS = 3;
+
+    // Permission for External Key Manager connection status
+    ASSURED_WORKLOADS_EKM_CONNECTION_STATUS = 4;
+  }
+
+  // Identifier. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/partnerPermissions
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // The partner permissions granted for the workload
+  repeated Permission partner_permissions = 2;
+}
+
+// Request for getting the partner permissions granted for a workload
+message GetPartnerPermissionsRequest {
+  // Required. Name of the resource to get in the format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/partnerPermissions
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudcontrolspartner.googleapis.com/PartnerPermissions"
+    }
+  ];
+}

google/cloud/cloudcontrolspartner/v1beta/partners.proto

@@ -0,0 +1,120 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "PartnersProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Message describing Partner resource
+message Partner {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/Partner"
+    pattern: "organizations/{organization}/locations/{location}/partner"
+    singular: "partner"
+  };
+
+  // Identifier. The resource name of the partner.
+  // Format: organizations/{organization}/locations/{location}/partner
+  // Example: "organizations/123456/locations/us-central1/partner"
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // List of SKUs the partner is offering
+  repeated Sku skus = 3;
+
+  // List of Google Cloud supported EKM partners supported by the partner
+  repeated EkmMetadata ekm_solutions = 4;
+
+  // List of Google Cloud regions that the partner sells services to customers.
+  // Valid Google Cloud regions found here:
+  // https://cloud.google.com/compute/docs/regions-zones
+  repeated string operated_cloud_regions = 5;
+
+  // GCP project ID in the partner's GCP organization for receiving enhanced
+  // Logs for Partners.
+  string partner_project_id = 7;
+
+  // Output only. Time the resource was created
+  google.protobuf.Timestamp create_time = 9
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The last time the resource was updated
+  google.protobuf.Timestamp update_time = 10
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+// Message for getting a Partner
+message GetPartnerRequest {
+  // Required. Format: organizations/{organization}/locations/{location}/partner
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudcontrolspartner.googleapis.com/Partner"
+    }
+  ];
+}
+
+// Represents the SKU a partner owns inside Google Cloud to sell to customers.
+message Sku {
+  // Argentum product SKU, that is associated with the partner offerings to
+  // customers used by Syntro for billing purposes. SKUs can represent resold
+  // Google products or support services.
+  string id = 1;
+
+  // Display name of the product identified by the SKU. A partner may want to
+  // show partner branded names for their offerings such as local sovereign
+  // cloud solutions.
+  string display_name = 2;
+}
+
+// Holds information needed by Mudbray to use partner EKMs for workloads.
+message EkmMetadata {
+  // Represents Google Cloud supported external key management partners
+  // [Google Cloud EKM partners
+  // docs](https://cloud.google.com/kms/docs/ekm#supported_partners).
+  enum EkmSolution {
+    // Unspecified EKM solution
+    EKM_SOLUTION_UNSPECIFIED = 0;
+
+    // EKM Partner Fortanix
+    FORTANIX = 1;
+
+    // EKM Partner FutureX
+    FUTUREX = 2;
+
+    // EKM Partner Thales
+    THALES = 3;
+
+    // EKM Partner Virtu
+    VIRTRU = 4;
+  }
+
+  // The Cloud EKM partner.
+  EkmSolution ekm_solution = 1;
+
+  // Endpoint for sending requests to the EKM for key provisioning during
+  // Assured Workload creation.
+  string ekm_endpoint_uri = 2;
+}

google/cloud/cloudcontrolspartner/v1beta/violations.proto

@@ -0,0 +1,233 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.cloudcontrolspartner.v1beta;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
+import "google/type/interval.proto";
+
+option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta";
+option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb";
+option java_multiple_files = true;
+option java_outer_classname = "ViolationsProto";
+option java_package = "com.google.cloud.cloudcontrolspartner.v1beta";
+option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta";
+option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta";
+
+// Details of resource Violation
+message Violation {
+  option (google.api.resource) = {
+    type: "cloudcontrolspartner.googleapis.com/Violation"
+    pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/violations/{violation}"
+    plural: "violations"
+    singular: "violation"
+  };
+
+  // Represents remediation guidance to resolve compliance violation for
+  // AssuredWorkload
+  message Remediation {
+    // Instructions to remediate violation
+    message Instructions {
+      // Remediation instructions to resolve violation via gcloud cli
+      message Gcloud {
+        // Gcloud command to resolve violation
+        repeated string gcloud_commands = 1;
+
+        // Steps to resolve violation via gcloud cli
+        repeated string steps = 2;
+
+        // Additional urls for more information about steps
+        repeated string additional_links = 3;
+      }
+
+      // Remediation instructions to resolve violation via cloud console
+      message Console {
+        // Link to console page where violations can be resolved
+        repeated string console_uris = 1;
+
+        // Steps to resolve violation via cloud console
+        repeated string steps = 2;
+
+        // Additional urls for more information about steps
+        repeated string additional_links = 3;
+      }
+
+      // Remediation instructions to resolve violation via gcloud cli
+      Gcloud gcloud_instructions = 1;
+
+      // Remediation instructions to resolve violation via cloud console
+      Console console_instructions = 2;
+    }
+
+    // Classifying remediation into various types based on the kind of
+    // violation. For example, violations caused due to changes in boolean org
+    // policy requires different remediation instructions compared to violation
+    // caused due to changes in allowed values of list org policy.
+    enum RemediationType {
+      // Unspecified remediation type
+      REMEDIATION_TYPE_UNSPECIFIED = 0;
+
+      // Remediation type for boolean org policy
+      REMEDIATION_BOOLEAN_ORG_POLICY_VIOLATION = 1;
+
+      // Remediation type for list org policy which have allowed values in the
+      // monitoring rule
+      REMEDIATION_LIST_ALLOWED_VALUES_ORG_POLICY_VIOLATION = 2;
+
+      // Remediation type for list org policy which have denied values in the
+      // monitoring rule
+      REMEDIATION_LIST_DENIED_VALUES_ORG_POLICY_VIOLATION = 3;
+
+      // Remediation type for gcp.restrictCmekCryptoKeyProjects
+      REMEDIATION_RESTRICT_CMEK_CRYPTO_KEY_PROJECTS_ORG_POLICY_VIOLATION = 4;
+
+      // Remediation type for resource violation.
+      REMEDIATION_RESOURCE_VIOLATION = 5;
+    }
+
+    // Required. Remediation instructions to resolve violations
+    Instructions instructions = 1 [(google.api.field_behavior) = REQUIRED];
+
+    // Values that can resolve the violation
+    // For example: for list org policy violations, this will either be the list
+    // of allowed or denied values
+    repeated string compliant_values = 2;
+
+    // Output only. Remediation type based on the type of org policy values
+    // violated
+    RemediationType remediation_type = 3
+        [(google.api.field_behavior) = OUTPUT_ONLY];
+  }
+
+  // Violation State Values
+  enum State {
+    // Unspecified state.
+    STATE_UNSPECIFIED = 0;
+
+    // Violation is resolved.
+    RESOLVED = 1;
+
+    // Violation is Unresolved
+    UNRESOLVED = 2;
+
+    // Violation is Exception
+    EXCEPTION = 3;
+  }
+
+  // Identifier. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/violations/{violation}
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // Output only. Description for the Violation.
+  // e.g. OrgPolicy gcp.resourceLocations has non compliant value.
+  string description = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time of the event which triggered the Violation.
+  google.protobuf.Timestamp begin_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The last time when the Violation record was updated.
+  google.protobuf.Timestamp update_time = 4
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time of the event which fixed the Violation.
+  // If the violation is ACTIVE this will be empty.
+  google.protobuf.Timestamp resolve_time = 5
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Category under which this violation is mapped.
+  // e.g. Location, Service Usage, Access, Encryption, etc.
+  string category = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. State of the violation
+  State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Immutable. Name of the OrgPolicy which was modified with
+  // non-compliant change and resulted this violation. Format:
+  //  projects/{project_number}/policies/{constraint_name}
+  //  folders/{folder_id}/policies/{constraint_name}
+  //  organizations/{organization_id}/policies/{constraint_name}
+  string non_compliant_org_policy = 8 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.field_behavior) = IMMUTABLE
+  ];
+
+  // The folder_id of the violation
+  int64 folder_id = 9;
+
+  // Output only. Compliance violation remediation
+  Remediation remediation = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+// Message for requesting list of Violations
+message ListViolationsRequest {
+  // Required. Parent resource
+  // Format
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "cloudcontrolspartner.googleapis.com/Violation"
+    }
+  ];
+
+  // Optional. The maximum number of customers row to return. The service may
+  // return fewer than this value. If unspecified, at most 10 customers will be
+  // returned.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A page token, received from a previous `ListViolations` call.
+  // Provide this to retrieve the subsequent page.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Filtering results
+  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Hint for how to order the results
+  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Specifies the interval for retrieving violations.
+  // if unspecified, all violations will be returned.
+  google.type.Interval interval = 6 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Response message for list customer violation requests
+message ListViolationsResponse {
+  // List of violation
+  repeated Violation violations = 1;
+
+  // A token that can be sent as `page_token` to retrieve the next page.
+  // If this field is omitted, there are no subsequent pages.
+  string next_page_token = 2;
+
+  // Workloads that could not be reached due to permission errors or any other
+  // error. Ref: https://google.aip.dev/217
+  repeated string unreachable = 3;
+}
+
+// Message for getting a Violation
+message GetViolationRequest {
+  // Required. Format:
+  // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/violations/{violation}
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudcontrolspartner.googleapis.com/Violation"
+    }
+  ];
+}