diff --git a/google/cloud/cloudcontrolspartner/v1beta/BUILD.bazel b/google/cloud/cloudcontrolspartner/v1beta/BUILD.bazel new file mode 100644 index 0000000000..7ed4f0fb6d --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/BUILD.bazel @@ -0,0 +1,385 @@ +# This file was automatically generated by BuildFileGenerator +# https://github.com/googleapis/rules_gapic/tree/master/bazel + +# Most of the manual changes to this file will be overwritten. +# It's **only** allowed to change the following rule attribute values: +# - names of *_gapic_assembly_* rules +# - certain parameters of *_gapic_library rules, including but not limited to: +# * extra_protoc_parameters +# * extra_protoc_file_parameters +# The complete list of preserved parameters can be found in the source code. + +# This is an API workspace, having public visibility by default makes perfect sense. +package(default_visibility = ["//visibility:public"]) + +############################################################################## +# Common +############################################################################## +load("@rules_proto//proto:defs.bzl", "proto_library") +load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info") + +proto_library( + name = "cloudcontrolspartner_proto", + srcs = [ + "access_approval_requests.proto", + "completion_state.proto", + "core.proto", + "customer_workloads.proto", + "customers.proto", + "ekm_connections.proto", + "monitoring.proto", + "partner_permissions.proto", + "partners.proto", + "violations.proto", + ], + deps = [ + "//google/api:annotations_proto", + "//google/api:client_proto", + "//google/api:field_behavior_proto", + "//google/api:resource_proto", + "//google/type:interval_proto", + "@com_google_protobuf//:timestamp_proto", + ], +) + +proto_library_with_info( + name = "cloudcontrolspartner_proto_with_info", + deps = [ + ":cloudcontrolspartner_proto", + "//google/cloud:common_resources_proto", + ], +) + +############################################################################## +# Java +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "java_gapic_assembly_gradle_pkg", + "java_gapic_library", + "java_gapic_test", + "java_grpc_library", + "java_proto_library", +) + +java_proto_library( + name = "cloudcontrolspartner_java_proto", + deps = [":cloudcontrolspartner_proto"], +) + +java_grpc_library( + name = "cloudcontrolspartner_java_grpc", + srcs = [":cloudcontrolspartner_proto"], + deps = [":cloudcontrolspartner_java_proto"], +) + +java_gapic_library( + name = "cloudcontrolspartner_java_gapic", + srcs = [":cloudcontrolspartner_proto_with_info"], + gapic_yaml = None, + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "cloudcontrolspartner_v1beta.yaml", + test_deps = [ + ":cloudcontrolspartner_java_grpc", + ], + transport = "grpc+rest", + deps = [ + ":cloudcontrolspartner_java_proto", + "//google/api:api_java_proto", + ], +) + +java_gapic_test( + name = "cloudcontrolspartner_java_gapic_test_suite", + test_classes = [ + "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCoreClientHttpJsonTest", + "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCoreClientTest", + "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoringClientHttpJsonTest", + "com.google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoringClientTest", + ], + runtime_deps = [":cloudcontrolspartner_java_gapic_test"], +) + +# Open Source Packages +java_gapic_assembly_gradle_pkg( + name = "google-cloud-cloudcontrolspartner-v1beta-java", + transport = "grpc+rest", + deps = [ + ":cloudcontrolspartner_java_gapic", + ":cloudcontrolspartner_java_grpc", + ":cloudcontrolspartner_java_proto", + ":cloudcontrolspartner_proto", + ], + include_samples = True, +) + +############################################################################## +# Go +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "go_gapic_assembly_pkg", + "go_gapic_library", + "go_proto_library", +) + +go_proto_library( + name = "cloudcontrolspartner_go_proto", + compilers = ["@io_bazel_rules_go//proto:go_grpc"], + importpath = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb", + protos = [":cloudcontrolspartner_proto"], + deps = [ + "//google/api:annotations_go_proto", + "//google/type:interval_go_proto", + ], +) + +go_gapic_library( + name = "cloudcontrolspartner_go_gapic", + srcs = [":cloudcontrolspartner_proto_with_info"], + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + importpath = "cloud.google.com/go/cloudcontrolspartner/apiv1beta;cloudcontrolspartner", + metadata = True, + release_level = "beta", + rest_numeric_enums = True, + service_yaml = "cloudcontrolspartner_v1beta.yaml", + transport = "grpc+rest", + deps = [ + ":cloudcontrolspartner_go_proto", + ], +) + +# Open Source Packages +go_gapic_assembly_pkg( + name = "gapi-cloud-cloudcontrolspartner-v1beta-go", + deps = [ + ":cloudcontrolspartner_go_gapic", + ":cloudcontrolspartner_go_gapic_srcjar-test.srcjar", + ":cloudcontrolspartner_go_gapic_srcjar-metadata.srcjar", + ":cloudcontrolspartner_go_gapic_srcjar-snippets.srcjar", + ":cloudcontrolspartner_go_proto", + ], +) + +############################################################################## +# Python +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "py_gapic_assembly_pkg", + "py_gapic_library", + "py_test", +) + +py_gapic_library( + name = "cloudcontrolspartner_py_gapic", + srcs = [":cloudcontrolspartner_proto"], + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "cloudcontrolspartner_v1beta.yaml", + transport = "grpc+rest", + deps = [ + ], +) + +py_test( + name = "cloudcontrolspartner_py_gapic_test", + srcs = [ + "cloudcontrolspartner_py_gapic_pytest.py", + "cloudcontrolspartner_py_gapic_test.py", + ], + legacy_create_init = False, + deps = [":cloudcontrolspartner_py_gapic"], +) + +# Open Source Packages +py_gapic_assembly_pkg( + name = "cloudcontrolspartner-v1beta-py", + deps = [ + ":cloudcontrolspartner_py_gapic", + ], +) + +############################################################################## +# PHP +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "php_gapic_assembly_pkg", + "php_gapic_library", + "php_proto_library", +) + +php_proto_library( + name = "cloudcontrolspartner_php_proto", + deps = [":cloudcontrolspartner_proto"], +) + +php_gapic_library( + name = "cloudcontrolspartner_php_gapic", + srcs = [":cloudcontrolspartner_proto_with_info"], + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + rest_numeric_enums = True, + migration_mode = "NEW_SURFACE_ONLY", + service_yaml = "cloudcontrolspartner_v1beta.yaml", + transport = "grpc+rest", + deps = [ + ":cloudcontrolspartner_php_proto", + ], +) + +# Open Source Packages +php_gapic_assembly_pkg( + name = "google-cloud-cloudcontrolspartner-v1beta-php", + deps = [ + ":cloudcontrolspartner_php_gapic", + ":cloudcontrolspartner_php_proto", + ], +) + +############################################################################## +# Node.js +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "nodejs_gapic_assembly_pkg", + "nodejs_gapic_library", +) + +nodejs_gapic_library( + name = "cloudcontrolspartner_nodejs_gapic", + package_name = "@google-cloud/cloudcontrolspartner", + src = ":cloudcontrolspartner_proto_with_info", + extra_protoc_parameters = ["metadata"], + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + package = "google.cloud.cloudcontrolspartner.v1beta", + rest_numeric_enums = True, + service_yaml = "cloudcontrolspartner_v1beta.yaml", + transport = "grpc+rest", + deps = [], +) + +nodejs_gapic_assembly_pkg( + name = "cloudcontrolspartner-v1beta-nodejs", + deps = [ + ":cloudcontrolspartner_nodejs_gapic", + ":cloudcontrolspartner_proto", + ], +) + +############################################################################## +# Ruby +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "ruby_gapic_assembly_pkg", + "ruby_cloud_gapic_library", + "ruby_grpc_library", + "ruby_proto_library", +) + +ruby_proto_library( + name = "cloudcontrolspartner_ruby_proto", + deps = [":cloudcontrolspartner_proto"], +) + +ruby_grpc_library( + name = "cloudcontrolspartner_ruby_grpc", + srcs = [":cloudcontrolspartner_proto"], + deps = [":cloudcontrolspartner_ruby_proto"], +) + +ruby_cloud_gapic_library( + name = "cloudcontrolspartner_ruby_gapic", + srcs = [":cloudcontrolspartner_proto_with_info"], + extra_protoc_parameters = [ + "ruby-cloud-gem-name=google-cloud-cloudcontrolspartner-v1beta", + ], + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "cloudcontrolspartner_v1beta.yaml", + transport = "grpc+rest", + deps = [ + ":cloudcontrolspartner_ruby_grpc", + ":cloudcontrolspartner_ruby_proto", + ], +) + +# Open Source Packages +ruby_gapic_assembly_pkg( + name = "google-cloud-cloudcontrolspartner-v1beta-ruby", + deps = [ + ":cloudcontrolspartner_ruby_gapic", + ":cloudcontrolspartner_ruby_grpc", + ":cloudcontrolspartner_ruby_proto", + ], +) + +############################################################################## +# C# +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "csharp_gapic_assembly_pkg", + "csharp_gapic_library", + "csharp_grpc_library", + "csharp_proto_library", +) + +csharp_proto_library( + name = "cloudcontrolspartner_csharp_proto", + extra_opts = [], + deps = [":cloudcontrolspartner_proto"], +) + +csharp_grpc_library( + name = "cloudcontrolspartner_csharp_grpc", + srcs = [":cloudcontrolspartner_proto"], + deps = [":cloudcontrolspartner_csharp_proto"], +) + +csharp_gapic_library( + name = "cloudcontrolspartner_csharp_gapic", + srcs = [":cloudcontrolspartner_proto_with_info"], + common_resources_config = "@gax_dotnet//:Google.Api.Gax/ResourceNames/CommonResourcesConfig.json", + grpc_service_config = "cloudcontrolspartner_v1beta_grpc_service_config.json", + rest_numeric_enums = True, + service_yaml = "cloudcontrolspartner_v1beta.yaml", + transport = "grpc+rest", + deps = [ + ":cloudcontrolspartner_csharp_grpc", + ":cloudcontrolspartner_csharp_proto", + ], +) + +# Open Source Packages +csharp_gapic_assembly_pkg( + name = "google-cloud-cloudcontrolspartner-v1beta-csharp", + deps = [ + ":cloudcontrolspartner_csharp_gapic", + ":cloudcontrolspartner_csharp_grpc", + ":cloudcontrolspartner_csharp_proto", + ], +) + +############################################################################## +# C++ +############################################################################## +load( + "@com_google_googleapis_imports//:imports.bzl", + "cc_grpc_library", + "cc_proto_library", +) + +cc_proto_library( + name = "cloudcontrolspartner_cc_proto", + deps = [":cloudcontrolspartner_proto"], +) + +cc_grpc_library( + name = "cloudcontrolspartner_cc_grpc", + srcs = [":cloudcontrolspartner_proto"], + grpc_only = True, + deps = [":cloudcontrolspartner_cc_proto"], +) diff --git a/google/cloud/cloudcontrolspartner/v1beta/access_approval_requests.proto b/google/cloud/cloudcontrolspartner/v1beta/access_approval_requests.proto new file mode 100644 index 0000000000..1a7d9ccf38 --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/access_approval_requests.proto @@ -0,0 +1,146 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/protobuf/timestamp.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "AccessApprovalRequestsProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Details about the Access request. +message AccessApprovalRequest { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/AccessApprovalRequest" + pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/accessApprovalRequests/{access_approval_request}" + plural: "accessApprovalRequests" + singular: "accessApprovalRequest" + }; + + // Identifier. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/accessApprovalRequests/{access_approval_request}. + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // The time at which approval was requested. + google.protobuf.Timestamp request_time = 2; + + // The justification for which approval is being requested. + AccessReason requested_reason = 3; + + // The requested expiration for the approval. If the request is approved, + // access will be granted from the time of approval until the expiration time. + google.protobuf.Timestamp requested_expiration_time = 4; +} + +// Request for getting the access requests associated with a workload. +message ListAccessApprovalRequestsRequest { + // Required. Parent resource + // Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload} + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "cloudcontrolspartner.googleapis.com/AccessApprovalRequest" + } + ]; + + // Optional. The maximum number of access requests to return. The service may + // return fewer than this value. If unspecified, at most 500 access requests + // will be returned. + int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. A page token, received from a previous + // `ListAccessApprovalRequests` call. Provide this to retrieve the subsequent + // page. + string page_token = 3 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Filtering results. + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Hint for how to order the results. + string order_by = 5 [(google.api.field_behavior) = OPTIONAL]; +} + +// Response message for list access requests. +message ListAccessApprovalRequestsResponse { + // List of access approval requests + repeated AccessApprovalRequest access_approval_requests = 1; + + // A token that can be sent as `page_token` to retrieve the next page. + // If this field is omitted, there are no subsequent pages. + string next_page_token = 2; + + // Locations that could not be reached. + repeated string unreachable = 3; +} + +// Reason for the access. +message AccessReason { + // Type of access justification. + enum Type { + // Default value for proto, shouldn't be used. + TYPE_UNSPECIFIED = 0; + + // Customer made a request or raised an issue that required the principal to + // access customer data. `detail` is of the form ("#####" is the issue ID): + // + // - "Feedback Report: #####" + // - "Case Number: #####" + // - "Case ID: #####" + // - "E-PIN Reference: #####" + // - "Google-#####" + // - "T-#####" + CUSTOMER_INITIATED_SUPPORT = 1; + + // The principal accessed customer data in order to diagnose or resolve a + // suspected issue in services. Often this access is used to confirm that + // customers are not affected by a suspected service issue or to remediate a + // reversible system issue. + GOOGLE_INITIATED_SERVICE = 2; + + // Google initiated service for security, fraud, abuse, or compliance + // purposes. + GOOGLE_INITIATED_REVIEW = 3; + + // The principal was compelled to access customer data in order to respond + // to a legal third party data request or process, including legal processes + // from customers themselves. + THIRD_PARTY_DATA_REQUEST = 4; + + // The principal accessed customer data in order to diagnose or resolve a + // suspected issue in services or a known outage. + GOOGLE_RESPONSE_TO_PRODUCTION_ALERT = 5; + + // Similar to 'GOOGLE_INITIATED_SERVICE' or 'GOOGLE_INITIATED_REVIEW', but + // with universe agnostic naming. The principal accessed customer data in + // order to diagnose or resolve a suspected issue in services or a known + // outage, or for security, fraud, abuse, or compliance review purposes. + CLOUD_INITIATED_ACCESS = 6; + } + + // Type of access justification. + Type type = 1; + + // More detail about certain reason types. See comments for each type above. + string detail = 2; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta.yaml b/google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta.yaml new file mode 100644 index 0000000000..e165322052 --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta.yaml @@ -0,0 +1,39 @@ +type: google.api.Service +config_version: 3 +name: cloudcontrolspartner.googleapis.com +title: Cloud Controls Partner API + +apis: +- name: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore +- name: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring + +types: +- name: google.cloud.cloudcontrolspartner.v1beta.OperationMetadata + +documentation: + summary: |- + Provides insights about your customers and their Assured Workloads based on + your Sovereign Controls by Partners offering. + +authentication: + rules: + - selector: 'google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore.*' + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + - selector: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring.GetViolation + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + - selector: google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring.ListViolations + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/cloud-platform + +publishing: + new_issue_uri: https://issuetracker.google.com/issues/new?component=1504051 + documentation_uri: https://cloud.google.com/cloud-controls-partner/docs + api_short_name: cloudcontrolspartner + github_label: 'api: cloudcontrolspartner' + doc_tag_prefix: cloudcontrolspartner + organization: CLOUD diff --git a/google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta_grpc_service_config.json b/google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta_grpc_service_config.json new file mode 100644 index 0000000000..30ebddec19 --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/cloudcontrolspartner_v1beta_grpc_service_config.json @@ -0,0 +1,23 @@ +{ + "methodConfig": [{ + "name": [ + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetCustomer" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetEkmConnections" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetPartnerPermissions" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "GetWorkload" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "ListAccessApprovalRequests" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "ListCustomers" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerCore", "method": "ListWorkloads" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring", "method": "GetViolation" }, + { "service": "google.cloud.cloudcontrolspartner.v1beta.CloudControlsPartnerMonitoring", "method": "ListViolations" } + ], + "timeout": "60s", + "retryPolicy": { + "maxAttempts": 5, + "initialBackoff": "1s", + "maxBackoff": "10s", + "backoffMultiplier": 1.3, + "retryableStatusCodes": ["UNAVAILABLE"] + } + }] +} \ No newline at end of file diff --git a/google/cloud/cloudcontrolspartner/v1beta/completion_state.proto b/google/cloud/cloudcontrolspartner/v1beta/completion_state.proto new file mode 100644 index 0000000000..8c3782f612 --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/completion_state.proto @@ -0,0 +1,43 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "CompletionStateProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Enum for possible completion states. +enum CompletionState { + // Unspecified completion state. + COMPLETION_STATE_UNSPECIFIED = 0; + + // Task started (has start date) but not yet completed. + PENDING = 1; + + // Succeeded state. + SUCCEEDED = 2; + + // Failed state. + FAILED = 3; + + // Not applicable state. + NOT_APPLICABLE = 4; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/core.proto b/google/cloud/cloudcontrolspartner/v1beta/core.proto new file mode 100644 index 0000000000..d81c670ce2 --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/core.proto @@ -0,0 +1,144 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/annotations.proto"; +import "google/api/client.proto"; +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/access_approval_requests.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/customer_workloads.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/customers.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/ekm_connections.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/partner_permissions.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/partners.proto"; +import "google/protobuf/timestamp.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "CoreProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; +option (google.api.resource_definition) = { + type: "cloudcontrolspartner.googleapis.com/OrganizationLocation" + pattern: "organizations/{organization}/locations/{location}" +}; + +// Service describing handlers for resources +service CloudControlsPartnerCore { + option (google.api.default_host) = "cloudcontrolspartner.googleapis.com"; + option (google.api.oauth_scopes) = + "https://www.googleapis.com/auth/cloud-platform"; + + // Gets details of a single workload + rpc GetWorkload(GetWorkloadRequest) returns (Workload) { + option (google.api.http) = { + get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*}" + }; + option (google.api.method_signature) = "name"; + } + + // Lists customer workloads for a given customer org id + rpc ListWorkloads(ListWorkloadsRequest) returns (ListWorkloadsResponse) { + option (google.api.http) = { + get: "/v1beta/{parent=organizations/*/locations/*/customers/*}/workloads" + }; + option (google.api.method_signature) = "parent"; + } + + // Gets details of a single customer + rpc GetCustomer(GetCustomerRequest) returns (Customer) { + option (google.api.http) = { + get: "/v1beta/{name=organizations/*/locations/*/customers/*}" + }; + option (google.api.method_signature) = "name"; + } + + // Lists customers of a partner identified by its GCP organization id + rpc ListCustomers(ListCustomersRequest) returns (ListCustomersResponse) { + option (google.api.http) = { + get: "/v1beta/{parent=organizations/*/locations/*}/customers" + }; + option (google.api.method_signature) = "parent"; + } + + // Gets the EKM connections associated with a workload + rpc GetEkmConnections(GetEkmConnectionsRequest) returns (EkmConnections) { + option (google.api.http) = { + get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*/ekmConnections}" + }; + option (google.api.method_signature) = "name"; + } + + // Gets the partner permissions granted for a workload + rpc GetPartnerPermissions(GetPartnerPermissionsRequest) + returns (PartnerPermissions) { + option (google.api.http) = { + get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*/partnerPermissions}" + }; + option (google.api.method_signature) = "name"; + } + + // Lists access requests associated with a workload + rpc ListAccessApprovalRequests(ListAccessApprovalRequestsRequest) + returns (ListAccessApprovalRequestsResponse) { + option (google.api.http) = { + get: "/v1beta/{parent=organizations/*/locations/*/customers/*/workloads/*}/accessApprovalRequests" + }; + option (google.api.method_signature) = "parent"; + } + + // Get details of a Partner. + rpc GetPartner(GetPartnerRequest) returns (Partner) { + option (google.api.http) = { + get: "/v1beta/{name=organizations/*/locations/*/partner}" + }; + option (google.api.method_signature) = "name"; + } +} + +// Represents the metadata of the long-running operation. +message OperationMetadata { + // Output only. The time the operation was created. + google.protobuf.Timestamp create_time = 1 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The time the operation finished running. + google.protobuf.Timestamp end_time = 2 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Server-defined resource path for the target of the operation. + string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Name of the verb executed by the operation. + string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Human-readable status of the operation, if any. + string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Identifies whether the user has requested cancellation + // of the operation. Operations that have been cancelled successfully + // have [Operation.error][] value with a + // [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to + // `Code.CANCELLED`. + bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. API version used to start the operation. + string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY]; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/customer_workloads.proto b/google/cloud/cloudcontrolspartner/v1beta/customer_workloads.proto new file mode 100644 index 0000000000..ba74f64aff --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/customer_workloads.proto @@ -0,0 +1,182 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/completion_state.proto"; +import "google/protobuf/timestamp.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "CustomerWorkloadsProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Contains metadata around the [Workload +// resource](https://cloud.google.com/assured-workloads/docs/reference/rest/Shared.Types/Workload) +// in the Assured Workloads API. +message Workload { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/Workload" + pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}" + plural: "workloads" + singular: "workload" + }; + + // Supported Assured Workloads Partners. + enum Partner { + // Unknown Partner. + PARTNER_UNSPECIFIED = 0; + + // Enum representing S3NS (Thales) partner. + PARTNER_LOCAL_CONTROLS_BY_S3NS = 1; + + // Enum representing T_SYSTEM (TSI) partner. + PARTNER_SOVEREIGN_CONTROLS_BY_T_SYSTEMS = 2; + + // Enum representing SIA_MINSAIT (Indra) partner. + PARTNER_SOVEREIGN_CONTROLS_BY_SIA_MINSAIT = 3; + + // Enum representing PSN (TIM) partner. + PARTNER_SOVEREIGN_CONTROLS_BY_PSN = 4; + + // Enum representing CNTXT (Kingdom of Saudi Arabia) partner. + PARTNER_SOVEREIGN_CONTROLS_BY_CNTXT = 6; + + // Enum representing CNXT (Kingdom of Saudi Arabia) partner offering without + // EKM provisioning. + PARTNER_SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM = 7; + } + + // Identifier. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload} + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // Output only. Folder id this workload is associated with + int64 folder_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Time the resource was created. + google.protobuf.Timestamp create_time = 3 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The name of container folder of the assured workload + string folder = 4 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Container for workload onboarding steps. + WorkloadOnboardingState workload_onboarding_state = 5; + + // Indicates whether a workload is fully onboarded. + bool is_onboarded = 6; + + // The project id of the key management project for the workload + string key_management_project_id = 7; + + // The gcp location of the workload + string location = 8; + + // Partner associated with this workload. + Partner partner = 9; +} + +// Request to list customer workloads. +message ListWorkloadsRequest { + // Required. Parent resource + // Format: + // organizations/{organization}/locations/{location}/customers/{customer} + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "cloudcontrolspartner.googleapis.com/Workload" + } + ]; + + // The maximum number of workloads to return. The service may return fewer + // than this value. If unspecified, at most 500 workloads will be returned. + int32 page_size = 2; + + // A page token, received from a previous `ListWorkloads` call. + // Provide this to retrieve the subsequent page. + string page_token = 3; + + // Optional. Filtering results. + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Hint for how to order the results. + string order_by = 5 [(google.api.field_behavior) = OPTIONAL]; +} + +// Response message for list customer workloads requests. +message ListWorkloadsResponse { + // List of customer workloads + repeated Workload workloads = 1; + + // A token that can be sent as `page_token` to retrieve the next page. + // If this field is omitted, there are no subsequent pages. + string next_page_token = 2; + + // Locations that could not be reached. + repeated string unreachable = 3; +} + +// Message for getting a customer workload. +message GetWorkloadRequest { + // Required. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload} + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudcontrolspartner.googleapis.com/Workload" + } + ]; +} + +// Container for workload onboarding steps. +message WorkloadOnboardingState { + // List of workload onboarding steps. + repeated WorkloadOnboardingStep onboarding_steps = 1; +} + +// Container for workload onboarding information. +message WorkloadOnboardingStep { + // Enum for possible onboarding steps. + enum Step { + // Unspecified step. + STEP_UNSPECIFIED = 0; + + // EKM Provisioned step. + EKM_PROVISIONED = 1; + + // Signed Access Approval step. + SIGNED_ACCESS_APPROVAL_CONFIGURED = 2; + } + + // The onboarding step. + Step step = 1; + + // The starting time of the onboarding step. + google.protobuf.Timestamp start_time = 2; + + // The completion time of the onboarding step. + google.protobuf.Timestamp completion_time = 3; + + // Output only. The completion state of the onboarding step. + CompletionState completion_state = 4 + [(google.api.field_behavior) = OUTPUT_ONLY]; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/customers.proto b/google/cloud/cloudcontrolspartner/v1beta/customers.proto new file mode 100644 index 0000000000..2d1127504f --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/customers.proto @@ -0,0 +1,138 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/completion_state.proto"; +import "google/protobuf/timestamp.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "CustomersProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Contains metadata around a Cloud Controls Partner Customer +message Customer { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/Customer" + pattern: "organizations/{organization}/locations/{location}/customers/{customer}" + plural: "customers" + singular: "customer" + }; + + // Identifier. Format: + // organizations/{organization}/locations/{location}/customers/{customer} + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // The customer organization's display name. E.g. "google.com". + string display_name = 2; + + // Container for customer onboarding steps + CustomerOnboardingState customer_onboarding_state = 3; + + // Indicates whether a customer is fully onboarded + bool is_onboarded = 4; +} + +// Request to list customers +message ListCustomersRequest { + // Required. Parent resource + // Format: organizations/{organization}/locations/{location} + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "cloudcontrolspartner.googleapis.com/Customer" + } + ]; + + // The maximum number of Customers to return. The service may return fewer + // than this value. If unspecified, at most 500 Customers will be returned. + int32 page_size = 2; + + // A page token, received from a previous `ListCustomers` call. + // Provide this to retrieve the subsequent page. + string page_token = 3; + + // Optional. Filtering results + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Hint for how to order the results + string order_by = 5 [(google.api.field_behavior) = OPTIONAL]; +} + +// Response message for list customer Customers requests +message ListCustomersResponse { + // List of customers + repeated Customer customers = 1; + + // A token that can be sent as `page_token` to retrieve the next page. + // If this field is omitted, there are no subsequent pages. + string next_page_token = 2; + + // Locations that could not be reached. + repeated string unreachable = 3; +} + +// Message for getting a customer +message GetCustomerRequest { + // Required. Format: + // organizations/{organization}/locations/{location}/customers/{customer} + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudcontrolspartner.googleapis.com/Customer" + } + ]; +} + +// Container for customer onboarding steps +message CustomerOnboardingState { + // List of customer onboarding steps + repeated CustomerOnboardingStep onboarding_steps = 1; +} + +// Container for customer onboarding information +message CustomerOnboardingStep { + // Enum for possible onboarding steps + enum Step { + // Unspecified step + STEP_UNSPECIFIED = 0; + + // KAJ Enrollment + KAJ_ENROLLMENT = 1; + + // Customer Environment + CUSTOMER_ENVIRONMENT = 2; + } + + // The onboarding step + Step step = 1; + + // The starting time of the onboarding step + google.protobuf.Timestamp start_time = 2; + + // The completion time of the onboarding step + google.protobuf.Timestamp completion_time = 3; + + // Output only. Current state of the step + CompletionState completion_state = 4 + [(google.api.field_behavior) = OUTPUT_ONLY]; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/ekm_connections.proto b/google/cloud/cloudcontrolspartner/v1beta/ekm_connections.proto new file mode 100644 index 0000000000..efefa4844b --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/ekm_connections.proto @@ -0,0 +1,97 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "EkmConnectionsProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// The EKM connections associated with a workload +message EkmConnections { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/EkmConnections" + pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/ekmConnections" + }; + + // Identifier. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/ekmConnections + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // The EKM connections associated with the workload + repeated EkmConnection ekm_connections = 2; +} + +// Request for getting the EKM connections associated with a workload +message GetEkmConnectionsRequest { + // Required. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/ekmConnections + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudcontrolspartner.googleapis.com/EkmConnections" + } + ]; +} + +// Details about the EKM connection +message EkmConnection { + // Information around the error that occurred if the connection state is + // anything other than available or unspecified + message ConnectionError { + // The error domain for the error + string error_domain = 1; + + // The error message for the error + string error_message = 2; + } + + // The EKM connection state. + enum ConnectionState { + // Unspecified EKM connection state + CONNECTION_STATE_UNSPECIFIED = 0; + + // Available EKM connection state + AVAILABLE = 1; + + // Not available EKM connection state + NOT_AVAILABLE = 2; + + // Error EKM connection state + ERROR = 3; + + // Permission denied EKM connection state + PERMISSION_DENIED = 4; + } + + // Resource name of the EKM connection in the format: + // projects/{project}/locations/{location}/ekmConnections/{ekm_connection} + string connection_name = 1; + + // Output only. The connection state + ConnectionState connection_state = 2 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // The connection error that occurred if any + ConnectionError connection_error = 3; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/monitoring.proto b/google/cloud/cloudcontrolspartner/v1beta/monitoring.proto new file mode 100644 index 0000000000..1e433f62af --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/monitoring.proto @@ -0,0 +1,58 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/annotations.proto"; +import "google/api/client.proto"; +import "google/cloud/cloudcontrolspartner/v1beta/violations.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "MonitoringProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Service describing handlers for resources +service CloudControlsPartnerMonitoring { + option (google.api.default_host) = "cloudcontrolspartner.googleapis.com"; + option (google.api.oauth_scopes) = + "https://www.googleapis.com/auth/cloud-platform"; + + // Lists Violations for a workload + // Callers may also choose to read across multiple Customers or for a single + // customer as per + // [AIP-159](https://google.aip.dev/159) by using '-' (the hyphen or dash + // character) as a wildcard character instead of {customer} & {workload}. + // Format: + // `organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}` + rpc ListViolations(ListViolationsRequest) returns (ListViolationsResponse) { + option (google.api.http) = { + get: "/v1beta/{parent=organizations/*/locations/*/customers/*/workloads/*}/violations" + }; + option (google.api.method_signature) = "parent"; + } + + // Gets details of a single Violation. + rpc GetViolation(GetViolationRequest) returns (Violation) { + option (google.api.http) = { + get: "/v1beta/{name=organizations/*/locations/*/customers/*/workloads/*/violations/*}" + }; + option (google.api.method_signature) = "name"; + } +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/partner_permissions.proto b/google/cloud/cloudcontrolspartner/v1beta/partner_permissions.proto new file mode 100644 index 0000000000..6011b0221b --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/partner_permissions.proto @@ -0,0 +1,72 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "PartnerPermissionsProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// The permissions granted to the partner for a workload +message PartnerPermissions { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/PartnerPermissions" + pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/partnerPermissions" + }; + + enum Permission { + // Unspecified partner permission + PERMISSION_UNSPECIFIED = 0; + + // Permission for Access Transparency and emergency logs + ACCESS_TRANSPARENCY_AND_EMERGENCY_ACCESS_LOGS = 1; + + // Permission for Assured Workloads monitoring violations + ASSURED_WORKLOADS_MONITORING = 2; + + // Permission for Access Approval requests + ACCESS_APPROVAL_REQUESTS = 3; + + // Permission for External Key Manager connection status + ASSURED_WORKLOADS_EKM_CONNECTION_STATUS = 4; + } + + // Identifier. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/partnerPermissions + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // The partner permissions granted for the workload + repeated Permission partner_permissions = 2; +} + +// Request for getting the partner permissions granted for a workload +message GetPartnerPermissionsRequest { + // Required. Name of the resource to get in the format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/partnerPermissions + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudcontrolspartner.googleapis.com/PartnerPermissions" + } + ]; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/partners.proto b/google/cloud/cloudcontrolspartner/v1beta/partners.proto new file mode 100644 index 0000000000..b84c343805 --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/partners.proto @@ -0,0 +1,120 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/protobuf/timestamp.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "PartnersProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Message describing Partner resource +message Partner { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/Partner" + pattern: "organizations/{organization}/locations/{location}/partner" + singular: "partner" + }; + + // Identifier. The resource name of the partner. + // Format: organizations/{organization}/locations/{location}/partner + // Example: "organizations/123456/locations/us-central1/partner" + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // List of SKUs the partner is offering + repeated Sku skus = 3; + + // List of Google Cloud supported EKM partners supported by the partner + repeated EkmMetadata ekm_solutions = 4; + + // List of Google Cloud regions that the partner sells services to customers. + // Valid Google Cloud regions found here: + // https://cloud.google.com/compute/docs/regions-zones + repeated string operated_cloud_regions = 5; + + // GCP project ID in the partner's GCP organization for receiving enhanced + // Logs for Partners. + string partner_project_id = 7; + + // Output only. Time the resource was created + google.protobuf.Timestamp create_time = 9 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The last time the resource was updated + google.protobuf.Timestamp update_time = 10 + [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// Message for getting a Partner +message GetPartnerRequest { + // Required. Format: organizations/{organization}/locations/{location}/partner + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudcontrolspartner.googleapis.com/Partner" + } + ]; +} + +// Represents the SKU a partner owns inside Google Cloud to sell to customers. +message Sku { + // Argentum product SKU, that is associated with the partner offerings to + // customers used by Syntro for billing purposes. SKUs can represent resold + // Google products or support services. + string id = 1; + + // Display name of the product identified by the SKU. A partner may want to + // show partner branded names for their offerings such as local sovereign + // cloud solutions. + string display_name = 2; +} + +// Holds information needed by Mudbray to use partner EKMs for workloads. +message EkmMetadata { + // Represents Google Cloud supported external key management partners + // [Google Cloud EKM partners + // docs](https://cloud.google.com/kms/docs/ekm#supported_partners). + enum EkmSolution { + // Unspecified EKM solution + EKM_SOLUTION_UNSPECIFIED = 0; + + // EKM Partner Fortanix + FORTANIX = 1; + + // EKM Partner FutureX + FUTUREX = 2; + + // EKM Partner Thales + THALES = 3; + + // EKM Partner Virtu + VIRTRU = 4; + } + + // The Cloud EKM partner. + EkmSolution ekm_solution = 1; + + // Endpoint for sending requests to the EKM for key provisioning during + // Assured Workload creation. + string ekm_endpoint_uri = 2; +} diff --git a/google/cloud/cloudcontrolspartner/v1beta/violations.proto b/google/cloud/cloudcontrolspartner/v1beta/violations.proto new file mode 100644 index 0000000000..ea2531cd9d --- /dev/null +++ b/google/cloud/cloudcontrolspartner/v1beta/violations.proto @@ -0,0 +1,233 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.cloudcontrolspartner.v1beta; + +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/protobuf/timestamp.proto"; +import "google/type/interval.proto"; + +option csharp_namespace = "Google.Cloud.CloudControlsPartner.V1Beta"; +option go_package = "cloud.google.com/go/cloudcontrolspartner/apiv1beta/cloudcontrolspartnerpb;cloudcontrolspartnerpb"; +option java_multiple_files = true; +option java_outer_classname = "ViolationsProto"; +option java_package = "com.google.cloud.cloudcontrolspartner.v1beta"; +option php_namespace = "Google\\Cloud\\CloudControlsPartner\\V1beta"; +option ruby_package = "Google::Cloud::CloudControlsPartner::V1beta"; + +// Details of resource Violation +message Violation { + option (google.api.resource) = { + type: "cloudcontrolspartner.googleapis.com/Violation" + pattern: "organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/violations/{violation}" + plural: "violations" + singular: "violation" + }; + + // Represents remediation guidance to resolve compliance violation for + // AssuredWorkload + message Remediation { + // Instructions to remediate violation + message Instructions { + // Remediation instructions to resolve violation via gcloud cli + message Gcloud { + // Gcloud command to resolve violation + repeated string gcloud_commands = 1; + + // Steps to resolve violation via gcloud cli + repeated string steps = 2; + + // Additional urls for more information about steps + repeated string additional_links = 3; + } + + // Remediation instructions to resolve violation via cloud console + message Console { + // Link to console page where violations can be resolved + repeated string console_uris = 1; + + // Steps to resolve violation via cloud console + repeated string steps = 2; + + // Additional urls for more information about steps + repeated string additional_links = 3; + } + + // Remediation instructions to resolve violation via gcloud cli + Gcloud gcloud_instructions = 1; + + // Remediation instructions to resolve violation via cloud console + Console console_instructions = 2; + } + + // Classifying remediation into various types based on the kind of + // violation. For example, violations caused due to changes in boolean org + // policy requires different remediation instructions compared to violation + // caused due to changes in allowed values of list org policy. + enum RemediationType { + // Unspecified remediation type + REMEDIATION_TYPE_UNSPECIFIED = 0; + + // Remediation type for boolean org policy + REMEDIATION_BOOLEAN_ORG_POLICY_VIOLATION = 1; + + // Remediation type for list org policy which have allowed values in the + // monitoring rule + REMEDIATION_LIST_ALLOWED_VALUES_ORG_POLICY_VIOLATION = 2; + + // Remediation type for list org policy which have denied values in the + // monitoring rule + REMEDIATION_LIST_DENIED_VALUES_ORG_POLICY_VIOLATION = 3; + + // Remediation type for gcp.restrictCmekCryptoKeyProjects + REMEDIATION_RESTRICT_CMEK_CRYPTO_KEY_PROJECTS_ORG_POLICY_VIOLATION = 4; + + // Remediation type for resource violation. + REMEDIATION_RESOURCE_VIOLATION = 5; + } + + // Required. Remediation instructions to resolve violations + Instructions instructions = 1 [(google.api.field_behavior) = REQUIRED]; + + // Values that can resolve the violation + // For example: for list org policy violations, this will either be the list + // of allowed or denied values + repeated string compliant_values = 2; + + // Output only. Remediation type based on the type of org policy values + // violated + RemediationType remediation_type = 3 + [(google.api.field_behavior) = OUTPUT_ONLY]; + } + + // Violation State Values + enum State { + // Unspecified state. + STATE_UNSPECIFIED = 0; + + // Violation is resolved. + RESOLVED = 1; + + // Violation is Unresolved + UNRESOLVED = 2; + + // Violation is Exception + EXCEPTION = 3; + } + + // Identifier. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/violations/{violation} + string name = 1 [(google.api.field_behavior) = IDENTIFIER]; + + // Output only. Description for the Violation. + // e.g. OrgPolicy gcp.resourceLocations has non compliant value. + string description = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Time of the event which triggered the Violation. + google.protobuf.Timestamp begin_time = 3 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The last time when the Violation record was updated. + google.protobuf.Timestamp update_time = 4 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Time of the event which fixed the Violation. + // If the violation is ACTIVE this will be empty. + google.protobuf.Timestamp resolve_time = 5 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Category under which this violation is mapped. + // e.g. Location, Service Usage, Access, Encryption, etc. + string category = 6 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. State of the violation + State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. Immutable. Name of the OrgPolicy which was modified with + // non-compliant change and resulted this violation. Format: + // projects/{project_number}/policies/{constraint_name} + // folders/{folder_id}/policies/{constraint_name} + // organizations/{organization_id}/policies/{constraint_name} + string non_compliant_org_policy = 8 [ + (google.api.field_behavior) = OUTPUT_ONLY, + (google.api.field_behavior) = IMMUTABLE + ]; + + // The folder_id of the violation + int64 folder_id = 9; + + // Output only. Compliance violation remediation + Remediation remediation = 13 [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// Message for requesting list of Violations +message ListViolationsRequest { + // Required. Parent resource + // Format + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload} + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "cloudcontrolspartner.googleapis.com/Violation" + } + ]; + + // Optional. The maximum number of customers row to return. The service may + // return fewer than this value. If unspecified, at most 10 customers will be + // returned. + int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. A page token, received from a previous `ListViolations` call. + // Provide this to retrieve the subsequent page. + string page_token = 3 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Filtering results + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Hint for how to order the results + string order_by = 5 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Specifies the interval for retrieving violations. + // if unspecified, all violations will be returned. + google.type.Interval interval = 6 [(google.api.field_behavior) = OPTIONAL]; +} + +// Response message for list customer violation requests +message ListViolationsResponse { + // List of violation + repeated Violation violations = 1; + + // A token that can be sent as `page_token` to retrieve the next page. + // If this field is omitted, there are no subsequent pages. + string next_page_token = 2; + + // Workloads that could not be reached due to permission errors or any other + // error. Ref: https://google.aip.dev/217 + repeated string unreachable = 3; +} + +// Message for getting a Violation +message GetViolationRequest { + // Required. Format: + // organizations/{organization}/locations/{location}/customers/{customer}/workloads/{workload}/violations/{violation} + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudcontrolspartner.googleapis.com/Violation" + } + ]; +}