accesscontextmanager

package
v0.0.0-...-6cb3ea0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 7, 2021 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	BasicLevel_ConditionCombiningFunction_name = map[int32]string{
		0: "AND",
		1: "OR",
	}
	BasicLevel_ConditionCombiningFunction_value = map[string]int32{
		"AND": 0,
		"OR":  1,
	}
)

Enum value maps for BasicLevel_ConditionCombiningFunction.

View Source 
var (
	ServicePerimeter_PerimeterType_name = map[int32]string{
		0: "PERIMETER_TYPE_REGULAR",
		1: "PERIMETER_TYPE_BRIDGE",
	}
	ServicePerimeter_PerimeterType_value = map[string]int32{
		"PERIMETER_TYPE_REGULAR": 0,
		"PERIMETER_TYPE_BRIDGE":  1,
	}
)

Enum value maps for ServicePerimeter_PerimeterType.

View Source 
var File_google_identity_accesscontextmanager_v1_access_level_proto protoreflect.FileDescriptor
View Source 
var File_google_identity_accesscontextmanager_v1_access_policy_proto protoreflect.FileDescriptor
View Source 
var File_google_identity_accesscontextmanager_v1_service_perimeter_proto protoreflect.FileDescriptor

Functions

This section is empty.

Types

type AccessLevel 

type AccessLevel struct {

	// Required. Resource name for the Access Level. The `short_name` component
	// must begin with a letter and only include alphanumeric and '_'. Format:
	// `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length
	// of the `short_name` component is 50 characters.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Human readable title. Must be unique within the Policy.
	Title string `protobuf:"bytes,2,opt,name=title,proto3" json:"title,omitempty"`
	// Description of the `AccessLevel` and its use. Does not affect behavior.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Required. Describes the necessary conditions for the level to apply.
	//
	// Types that are assignable to Level:
	//	*AccessLevel_Basic
	//	*AccessLevel_Custom
	Level isAccessLevel_Level `protobuf_oneof:"level"`
	// Output only. Time the `AccessLevel` was created in UTC.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. Time the `AccessLevel` was updated in UTC.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// contains filtered or unexported fields
}

An `AccessLevel` is a label that can be applied to requests to Google Cloud services, along with a list of requirements necessary for the label to be applied.

func (*AccessLevel) Descriptor deprecated 

func (*AccessLevel) Descriptor() ([]byte, []int)

Deprecated: Use AccessLevel.ProtoReflect.Descriptor instead.

func (*AccessLevel) GetBasic 

func (x *AccessLevel) GetBasic() *BasicLevel

func (*AccessLevel) GetCreateTime 

func (x *AccessLevel) GetCreateTime() *timestamppb.Timestamp

func (*AccessLevel) GetCustom 

func (x *AccessLevel) GetCustom() *CustomLevel

func (*AccessLevel) GetDescription 

func (x *AccessLevel) GetDescription() string

func (*AccessLevel) GetLevel 

func (m *AccessLevel) GetLevel() isAccessLevel_Level

func (*AccessLevel) GetName 

func (x *AccessLevel) GetName() string

func (*AccessLevel) GetTitle 

func (x *AccessLevel) GetTitle() string

func (*AccessLevel) GetUpdateTime 

func (x *AccessLevel) GetUpdateTime() *timestamppb.Timestamp

func (*AccessLevel) ProtoMessage 

func (*AccessLevel) ProtoMessage()

func (*AccessLevel) ProtoReflect 

func (x *AccessLevel) ProtoReflect() protoreflect.Message

func (*AccessLevel) Reset 

func (x *AccessLevel) Reset()

func (*AccessLevel) String 

func (x *AccessLevel) String() string

type AccessLevel_Basic 

type AccessLevel_Basic struct {
	// A `BasicLevel` composed of `Conditions`.
	Basic *BasicLevel `protobuf:"bytes,4,opt,name=basic,proto3,oneof"`
}

type AccessLevel_Custom 

type AccessLevel_Custom struct {
	// A `CustomLevel` written in the Common Expression Language.
	Custom *CustomLevel `protobuf:"bytes,5,opt,name=custom,proto3,oneof"`
}

type AccessPolicy 

type AccessPolicy struct {

	// Output only. Resource name of the `AccessPolicy`. Format:
	// `accessPolicies/{policy_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Required. The parent of this `AccessPolicy` in the Cloud Resource
	// Hierarchy. Currently immutable once created. Format:
	// `organizations/{organization_id}`
	Parent string `protobuf:"bytes,2,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. Human readable title. Does not affect behavior.
	Title string `protobuf:"bytes,3,opt,name=title,proto3" json:"title,omitempty"`
	// Output only. Time the `AccessPolicy` was created in UTC.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. Time the `AccessPolicy` was updated in UTC.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// Output only. An opaque identifier for the current version of the
	// `AccessPolicy`. This will always be a strongly validated etag, meaning that
	// two Access Polices will be identical if and only if their etags are
	// identical. Clients should not expect this to be in any specific format.
	Etag string `protobuf:"bytes,6,opt,name=etag,proto3" json:"etag,omitempty"`
	// contains filtered or unexported fields
}

`AccessPolicy` is a container for `AccessLevels` (which define the necessary attributes to use Google Cloud services) and `ServicePerimeters` (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization.

func (*AccessPolicy) Descriptor deprecated 

func (*AccessPolicy) Descriptor() ([]byte, []int)

Deprecated: Use AccessPolicy.ProtoReflect.Descriptor instead.

func (*AccessPolicy) GetCreateTime 

func (x *AccessPolicy) GetCreateTime() *timestamppb.Timestamp

func (*AccessPolicy) GetEtag 

func (x *AccessPolicy) GetEtag() string

func (*AccessPolicy) GetName 

func (x *AccessPolicy) GetName() string

func (*AccessPolicy) GetParent 

func (x *AccessPolicy) GetParent() string

func (*AccessPolicy) GetTitle 

func (x *AccessPolicy) GetTitle() string

func (*AccessPolicy) GetUpdateTime 

func (x *AccessPolicy) GetUpdateTime() *timestamppb.Timestamp

func (*AccessPolicy) ProtoMessage 

func (*AccessPolicy) ProtoMessage()

func (*AccessPolicy) ProtoReflect 

func (x *AccessPolicy) ProtoReflect() protoreflect.Message

func (*AccessPolicy) Reset 

func (x *AccessPolicy) Reset()

func (*AccessPolicy) String 

func (x *AccessPolicy) String() string

type BasicLevel 

type BasicLevel struct {

	// Required. A list of requirements for the `AccessLevel` to be granted.
	Conditions []*Condition `protobuf:"bytes,1,rep,name=conditions,proto3" json:"conditions,omitempty"`
	// How the `conditions` list should be combined to determine if a request is
	// granted this `AccessLevel`. If AND is used, each `Condition` in
	// `conditions` must be satisfied for the `AccessLevel` to be applied. If OR
	// is used, at least one `Condition` in `conditions` must be satisfied for the
	// `AccessLevel` to be applied. Default behavior is AND.
	CombiningFunction BasicLevel_ConditionCombiningFunction `` /* 196-byte string literal not displayed */
	// contains filtered or unexported fields
}

`BasicLevel` is an `AccessLevel` using a set of recommended features.

func (*BasicLevel) Descriptor deprecated 

func (*BasicLevel) Descriptor() ([]byte, []int)

Deprecated: Use BasicLevel.ProtoReflect.Descriptor instead.

func (*BasicLevel) GetCombiningFunction 

func (x *BasicLevel) GetCombiningFunction() BasicLevel_ConditionCombiningFunction

func (*BasicLevel) GetConditions 

func (x *BasicLevel) GetConditions() []*Condition

func (*BasicLevel) ProtoMessage 

func (*BasicLevel) ProtoMessage()

func (*BasicLevel) ProtoReflect 

func (x *BasicLevel) ProtoReflect() protoreflect.Message

func (*BasicLevel) Reset 

func (x *BasicLevel) Reset()

func (*BasicLevel) String 

func (x *BasicLevel) String() string

type BasicLevel_ConditionCombiningFunction 

type BasicLevel_ConditionCombiningFunction int32

Options for how the `conditions` list should be combined to determine if this `AccessLevel` is applied. Default is AND. 

const (
	// All `Conditions` must be true for the `BasicLevel` to be true.
	BasicLevel_AND BasicLevel_ConditionCombiningFunction = 0
	// If at least one `Condition` is true, then the `BasicLevel` is true.
	BasicLevel_OR BasicLevel_ConditionCombiningFunction = 1
)

func (BasicLevel_ConditionCombiningFunction) Descriptor 

func (BasicLevel_ConditionCombiningFunction) Descriptor() protoreflect.EnumDescriptor

func (BasicLevel_ConditionCombiningFunction) Enum 

func (x BasicLevel_ConditionCombiningFunction) Enum() *BasicLevel_ConditionCombiningFunction

func (BasicLevel_ConditionCombiningFunction) EnumDescriptor deprecated 

func (BasicLevel_ConditionCombiningFunction) EnumDescriptor() ([]byte, []int)

Deprecated: Use BasicLevel_ConditionCombiningFunction.Descriptor instead.

func (BasicLevel_ConditionCombiningFunction) Number 

func (x BasicLevel_ConditionCombiningFunction) Number() protoreflect.EnumNumber

func (BasicLevel_ConditionCombiningFunction) String 

func (x BasicLevel_ConditionCombiningFunction) String() string

func (BasicLevel_ConditionCombiningFunction) Type 

func (BasicLevel_ConditionCombiningFunction) Type() protoreflect.EnumType

type Condition 

type Condition struct {

	// CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for
	// a CIDR IP address block, the specified IP address portion must be properly
	// truncated (i.e. all the host bits must be zero) or the input is considered
	// malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is
	// not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas
	// "2001:db8::1/32" is not. The originating IP of a request must be in one of
	// the listed subnets in order for this Condition to be true. If empty, all IP
	// addresses are allowed.
	IpSubnetworks []string `protobuf:"bytes,1,rep,name=ip_subnetworks,json=ipSubnetworks,proto3" json:"ip_subnetworks,omitempty"`
	// Device specific restrictions, all restrictions must hold for the
	// Condition to be true. If not specified, all devices are allowed.
	DevicePolicy *DevicePolicy `protobuf:"bytes,2,opt,name=device_policy,json=devicePolicy,proto3" json:"device_policy,omitempty"`
	// A list of other access levels defined in the same `Policy`, referenced by
	// resource name. Referencing an `AccessLevel` which does not exist is an
	// error. All access levels listed must be granted for the Condition
	// to be true. Example:
	// "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
	RequiredAccessLevels []string `protobuf:"bytes,3,rep,name=required_access_levels,json=requiredAccessLevels,proto3" json:"required_access_levels,omitempty"`
	// Whether to negate the Condition. If true, the Condition becomes a NAND over
	// its non-empty fields, each field must be false for the Condition overall to
	// be satisfied. Defaults to false.
	Negate bool `protobuf:"varint,5,opt,name=negate,proto3" json:"negate,omitempty"`
	// The request must be made by one of the provided user or service
	// accounts. Groups are not supported.
	// Syntax:
	// `user:{emailid}`
	// `serviceAccount:{emailid}`
	// If not specified, a request may come from any user.
	Members []string `protobuf:"bytes,6,rep,name=members,proto3" json:"members,omitempty"`
	// The request must originate from one of the provided countries/regions.
	// Must be valid ISO 3166-1 alpha-2 codes.
	Regions []string `protobuf:"bytes,7,rep,name=regions,proto3" json:"regions,omitempty"`
	// contains filtered or unexported fields
}

A condition necessary for an `AccessLevel` to be granted. The Condition is an AND over its fields. So a Condition is true if: 1) the request IP is from one of the listed subnetworks AND 2) the originating device complies with the listed device policy AND 3) all listed access levels are granted AND 4) the request was sent at a time allowed by the DateTimeRestriction.

func (*Condition) Descriptor deprecated 

func (*Condition) Descriptor() ([]byte, []int)

Deprecated: Use Condition.ProtoReflect.Descriptor instead.

func (*Condition) GetDevicePolicy 

func (x *Condition) GetDevicePolicy() *DevicePolicy

func (*Condition) GetIpSubnetworks 

func (x *Condition) GetIpSubnetworks() []string

func (*Condition) GetMembers 

func (x *Condition) GetMembers() []string

func (*Condition) GetNegate 

func (x *Condition) GetNegate() bool

func (*Condition) GetRegions 

func (x *Condition) GetRegions() []string

func (*Condition) GetRequiredAccessLevels 

func (x *Condition) GetRequiredAccessLevels() []string

func (*Condition) ProtoMessage 

func (*Condition) ProtoMessage()

func (*Condition) ProtoReflect 

func (x *Condition) ProtoReflect() protoreflect.Message

func (*Condition) Reset 

func (x *Condition) Reset()

func (*Condition) String 

func (x *Condition) String() string

type CustomLevel 

type CustomLevel struct {

	// Required. A Cloud CEL expression evaluating to a boolean.
	Expr *expr.Expr `protobuf:"bytes,1,opt,name=expr,proto3" json:"expr,omitempty"`
	// contains filtered or unexported fields
}

`CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec

func (*CustomLevel) Descriptor deprecated 

func (*CustomLevel) Descriptor() ([]byte, []int)

Deprecated: Use CustomLevel.ProtoReflect.Descriptor instead.

func (*CustomLevel) GetExpr 

func (x *CustomLevel) GetExpr() *expr.Expr

func (*CustomLevel) ProtoMessage 

func (*CustomLevel) ProtoMessage()

func (*CustomLevel) ProtoReflect 

func (x *CustomLevel) ProtoReflect() protoreflect.Message

func (*CustomLevel) Reset 

func (x *CustomLevel) Reset()

func (*CustomLevel) String 

func (x *CustomLevel) String() string

type DevicePolicy 

type DevicePolicy struct {

	// Whether or not screenlock is required for the DevicePolicy to be true.
	// Defaults to `false`.
	RequireScreenlock bool `protobuf:"varint,1,opt,name=require_screenlock,json=requireScreenlock,proto3" json:"require_screenlock,omitempty"`
	// Allowed encryptions statuses, an empty list allows all statuses.
	AllowedEncryptionStatuses []_type.DeviceEncryptionStatus `` /* 216-byte string literal not displayed */
	// Allowed OS versions, an empty list allows all types and all versions.
	OsConstraints []*OsConstraint `protobuf:"bytes,3,rep,name=os_constraints,json=osConstraints,proto3" json:"os_constraints,omitempty"`
	// Allowed device management levels, an empty list allows all management
	// levels.
	AllowedDeviceManagementLevels []_type.DeviceManagementLevel `` /* 229-byte string literal not displayed */
	// Whether the device needs to be approved by the customer admin.
	RequireAdminApproval bool `protobuf:"varint,7,opt,name=require_admin_approval,json=requireAdminApproval,proto3" json:"require_admin_approval,omitempty"`
	// Whether the device needs to be corp owned.
	RequireCorpOwned bool `protobuf:"varint,8,opt,name=require_corp_owned,json=requireCorpOwned,proto3" json:"require_corp_owned,omitempty"`
	// contains filtered or unexported fields
}

`DevicePolicy` specifies device specific restrictions necessary to acquire a given access level. A `DevicePolicy` specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. `DevicePolicy` acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.

func (*DevicePolicy) Descriptor deprecated 

func (*DevicePolicy) Descriptor() ([]byte, []int)

Deprecated: Use DevicePolicy.ProtoReflect.Descriptor instead.

func (*DevicePolicy) GetAllowedDeviceManagementLevels 

func (x *DevicePolicy) GetAllowedDeviceManagementLevels() []_type.DeviceManagementLevel

func (*DevicePolicy) GetAllowedEncryptionStatuses 

func (x *DevicePolicy) GetAllowedEncryptionStatuses() []_type.DeviceEncryptionStatus

func (*DevicePolicy) GetOsConstraints 

func (x *DevicePolicy) GetOsConstraints() []*OsConstraint

func (*DevicePolicy) GetRequireAdminApproval 

func (x *DevicePolicy) GetRequireAdminApproval() bool

func (*DevicePolicy) GetRequireCorpOwned 

func (x *DevicePolicy) GetRequireCorpOwned() bool

func (*DevicePolicy) GetRequireScreenlock 

func (x *DevicePolicy) GetRequireScreenlock() bool

func (*DevicePolicy) ProtoMessage 

func (*DevicePolicy) ProtoMessage()

func (*DevicePolicy) ProtoReflect 

func (x *DevicePolicy) ProtoReflect() protoreflect.Message

func (*DevicePolicy) Reset 

func (x *DevicePolicy) Reset()

func (*DevicePolicy) String 

func (x *DevicePolicy) String() string

type OsConstraint 

type OsConstraint struct {

	// Required. The allowed OS type.
	OsType _type.OsType `` /* 134-byte string literal not displayed */
	// The minimum allowed OS version. If not set, any version of this OS
	// satisfies the constraint. Format: `"major.minor.patch"`.
	// Examples: `"10.5.301"`, `"9.2.1"`.
	MinimumVersion string `protobuf:"bytes,2,opt,name=minimum_version,json=minimumVersion,proto3" json:"minimum_version,omitempty"`
	// Only allows requests from devices with a verified Chrome OS.
	// Verifications includes requirements that the device is enterprise-managed,
	// conformant to domain policies, and the caller has permission to call
	// the API targeted by the request.
	RequireVerifiedChromeOs bool `` /* 135-byte string literal not displayed */
	// contains filtered or unexported fields
}

A restriction on the OS type and version of devices making requests.

func (*OsConstraint) Descriptor deprecated 

func (*OsConstraint) Descriptor() ([]byte, []int)

Deprecated: Use OsConstraint.ProtoReflect.Descriptor instead.

func (*OsConstraint) GetMinimumVersion 

func (x *OsConstraint) GetMinimumVersion() string

func (*OsConstraint) GetOsType 

func (x *OsConstraint) GetOsType() _type.OsType

func (*OsConstraint) GetRequireVerifiedChromeOs 

func (x *OsConstraint) GetRequireVerifiedChromeOs() bool

func (*OsConstraint) ProtoMessage 

func (*OsConstraint) ProtoMessage()

func (*OsConstraint) ProtoReflect 

func (x *OsConstraint) ProtoReflect() protoreflect.Message

func (*OsConstraint) Reset 

func (x *OsConstraint) Reset()

func (*OsConstraint) String 

func (x *OsConstraint) String() string

type ServicePerimeter 

type ServicePerimeter struct {

	// Required. Resource name for the ServicePerimeter.  The `short_name`
	// component must begin with a letter and only include alphanumeric and '_'.
	// Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Human readable title. Must be unique within the Policy.
	Title string `protobuf:"bytes,2,opt,name=title,proto3" json:"title,omitempty"`
	// Description of the `ServicePerimeter` and its use. Does not affect
	// behavior.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Output only. Time the `ServicePerimeter` was created in UTC.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. Time the `ServicePerimeter` was updated in UTC.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// Perimeter type indicator. A single project is
	// allowed to be a member of single regular perimeter, but multiple service
	// perimeter bridges. A project cannot be a included in a perimeter bridge
	// without being included in regular perimeter. For perimeter bridges,
	// the restricted service list as well as access level lists must be
	// empty.
	PerimeterType ServicePerimeter_PerimeterType `` /* 177-byte string literal not displayed */
	// Current ServicePerimeter configuration. Specifies sets of resources,
	// restricted services and access levels that determine perimeter
	// content and boundaries.
	Status *ServicePerimeterConfig `protobuf:"bytes,7,opt,name=status,proto3" json:"status,omitempty"`
	// Proposed (or dry run) ServicePerimeter configuration. This configuration
	// allows to specify and test ServicePerimeter configuration without enforcing
	// actual access restrictions. Only allowed to be set when the
	// "use_explicit_dry_run_spec" flag is set.
	Spec *ServicePerimeterConfig `protobuf:"bytes,8,opt,name=spec,proto3" json:"spec,omitempty"`
	// Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
	// exists  for all Service Perimeters, and that spec is identical to the
	// status for those Service Perimeters. When this flag is set, it inhibits the
	// generation of the implicit spec, thereby allowing the user to explicitly
	// provide a configuration ("spec") to use in a dry-run version of the Service
	// Perimeter. This allows the user to test changes to the enforced config
	// ("status") without actually enforcing them. This testing is done through
	// analyzing the differences between currently enforced and suggested
	// restrictions. use_explicit_dry_run_spec must bet set to True if any of the
	// fields in the spec are set to non-default values.
	UseExplicitDryRunSpec bool `` /* 131-byte string literal not displayed */
	// contains filtered or unexported fields
}

`ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges.

func (*ServicePerimeter) Descriptor deprecated 

func (*ServicePerimeter) Descriptor() ([]byte, []int)

Deprecated: Use ServicePerimeter.ProtoReflect.Descriptor instead.

func (*ServicePerimeter) GetCreateTime 

func (x *ServicePerimeter) GetCreateTime() *timestamppb.Timestamp

func (*ServicePerimeter) GetDescription 

func (x *ServicePerimeter) GetDescription() string

func (*ServicePerimeter) GetName 

func (x *ServicePerimeter) GetName() string

func (*ServicePerimeter) GetPerimeterType 

func (x *ServicePerimeter) GetPerimeterType() ServicePerimeter_PerimeterType

func (*ServicePerimeter) GetSpec 

func (x *ServicePerimeter) GetSpec() *ServicePerimeterConfig

func (*ServicePerimeter) GetStatus 

func (x *ServicePerimeter) GetStatus() *ServicePerimeterConfig

func (*ServicePerimeter) GetTitle 

func (x *ServicePerimeter) GetTitle() string

func (*ServicePerimeter) GetUpdateTime 

func (x *ServicePerimeter) GetUpdateTime() *timestamppb.Timestamp

func (*ServicePerimeter) GetUseExplicitDryRunSpec 

func (x *ServicePerimeter) GetUseExplicitDryRunSpec() bool

func (*ServicePerimeter) ProtoMessage 

func (*ServicePerimeter) ProtoMessage()

func (*ServicePerimeter) ProtoReflect 

func (x *ServicePerimeter) ProtoReflect() protoreflect.Message

func (*ServicePerimeter) Reset 

func (x *ServicePerimeter) Reset()

func (*ServicePerimeter) String 

func (x *ServicePerimeter) String() string

type ServicePerimeterConfig 

type ServicePerimeterConfig struct {

	// A list of Google Cloud resources that are inside of the service perimeter.
	// Currently only projects are allowed. Format: `projects/{project_number}`
	Resources []string `protobuf:"bytes,1,rep,name=resources,proto3" json:"resources,omitempty"`
	// A list of `AccessLevel` resource names that allow resources within the
	// `ServicePerimeter` to be accessed from the internet. `AccessLevels` listed
	// must be in the same policy as this `ServicePerimeter`. Referencing a
	// nonexistent `AccessLevel` is a syntax error. If no `AccessLevel` names are
	// listed, resources within the perimeter can only be accessed via Google
	// Cloud calls with request origins within the perimeter. Example:
	// `"accessPolicies/MY_POLICY/accessLevels/MY_LEVEL"`.
	// For Service Perimeter Bridge, must be empty.
	AccessLevels []string `protobuf:"bytes,2,rep,name=access_levels,json=accessLevels,proto3" json:"access_levels,omitempty"`
	// Google Cloud services that are subject to the Service Perimeter
	// restrictions. For example, if `storage.googleapis.com` is specified, access
	// to the storage buckets inside the perimeter must meet the perimeter's
	// access restrictions.
	RestrictedServices []string `protobuf:"bytes,4,rep,name=restricted_services,json=restrictedServices,proto3" json:"restricted_services,omitempty"`
	// Configuration for APIs allowed within Perimeter.
	VpcAccessibleServices *ServicePerimeterConfig_VpcAccessibleServices `` /* 127-byte string literal not displayed */
	// contains filtered or unexported fields
}

`ServicePerimeterConfig` specifies a set of Google Cloud resources that describe specific Service Perimeter configuration.

func (*ServicePerimeterConfig) Descriptor deprecated 

func (*ServicePerimeterConfig) Descriptor() ([]byte, []int)

Deprecated: Use ServicePerimeterConfig.ProtoReflect.Descriptor instead.

func (*ServicePerimeterConfig) GetAccessLevels 

func (x *ServicePerimeterConfig) GetAccessLevels() []string

func (*ServicePerimeterConfig) GetResources 

func (x *ServicePerimeterConfig) GetResources() []string

func (*ServicePerimeterConfig) GetRestrictedServices 

func (x *ServicePerimeterConfig) GetRestrictedServices() []string

func (*ServicePerimeterConfig) GetVpcAccessibleServices 

func (x *ServicePerimeterConfig) GetVpcAccessibleServices() *ServicePerimeterConfig_VpcAccessibleServices

func (*ServicePerimeterConfig) ProtoMessage 

func (*ServicePerimeterConfig) ProtoMessage()

func (*ServicePerimeterConfig) ProtoReflect 

func (x *ServicePerimeterConfig) ProtoReflect() protoreflect.Message

func (*ServicePerimeterConfig) Reset 

func (x *ServicePerimeterConfig) Reset()

func (*ServicePerimeterConfig) String 

func (x *ServicePerimeterConfig) String() string

type ServicePerimeterConfig_VpcAccessibleServices 

type ServicePerimeterConfig_VpcAccessibleServices struct {

	// Whether to restrict API calls within the Service Perimeter to the list of
	// APIs specified in 'allowed_services'.
	EnableRestriction bool `protobuf:"varint,1,opt,name=enable_restriction,json=enableRestriction,proto3" json:"enable_restriction,omitempty"`
	// The list of APIs usable within the Service Perimeter. Must be empty
	// unless 'enable_restriction' is True.
	AllowedServices []string `protobuf:"bytes,2,rep,name=allowed_services,json=allowedServices,proto3" json:"allowed_services,omitempty"`
	// contains filtered or unexported fields
}

Specifies how APIs are allowed to communicate within the Service Perimeter.

func (*ServicePerimeterConfig_VpcAccessibleServices) Descriptor deprecated 

func (*ServicePerimeterConfig_VpcAccessibleServices) Descriptor() ([]byte, []int)

Deprecated: Use ServicePerimeterConfig_VpcAccessibleServices.ProtoReflect.Descriptor instead.

func (*ServicePerimeterConfig_VpcAccessibleServices) GetAllowedServices 

func (x *ServicePerimeterConfig_VpcAccessibleServices) GetAllowedServices() []string

func (*ServicePerimeterConfig_VpcAccessibleServices) GetEnableRestriction 

func (x *ServicePerimeterConfig_VpcAccessibleServices) GetEnableRestriction() bool

func (*ServicePerimeterConfig_VpcAccessibleServices) ProtoMessage 

func (*ServicePerimeterConfig_VpcAccessibleServices) ProtoMessage()

func (*ServicePerimeterConfig_VpcAccessibleServices) ProtoReflect 

func (x *ServicePerimeterConfig_VpcAccessibleServices) ProtoReflect() protoreflect.Message

func (*ServicePerimeterConfig_VpcAccessibleServices) Reset 

func (x *ServicePerimeterConfig_VpcAccessibleServices) Reset()

func (*ServicePerimeterConfig_VpcAccessibleServices) String 

func (x *ServicePerimeterConfig_VpcAccessibleServices) String() string

type ServicePerimeter_PerimeterType 

type ServicePerimeter_PerimeterType int32

Specifies the type of the Perimeter. There are two types: regular and bridge. Regular Service Perimeter contains resources, access levels, and restricted services. Every resource can be in at most ONE regular Service Perimeter.

In addition to being in a regular service perimeter, a resource can also be in zero or more perimeter bridges. A perimeter bridge only contains resources. Cross project operations are permitted if all effected resources share some perimeter (whether bridge or regular). Perimeter Bridge does not contain access levels or services: those are governed entirely by the regular perimeter that resource is in.

Perimeter Bridges are typically useful when building more complex toplogies with many independent perimeters that need to share some data with a common perimeter, but should not be able to share data among themselves. 

const (
	// Regular Perimeter.
	ServicePerimeter_PERIMETER_TYPE_REGULAR ServicePerimeter_PerimeterType = 0
	// Perimeter Bridge.
	ServicePerimeter_PERIMETER_TYPE_BRIDGE ServicePerimeter_PerimeterType = 1
)

func (ServicePerimeter_PerimeterType) Descriptor 

func (ServicePerimeter_PerimeterType) Descriptor() protoreflect.EnumDescriptor

func (ServicePerimeter_PerimeterType) Enum 

func (x ServicePerimeter_PerimeterType) Enum() *ServicePerimeter_PerimeterType

func (ServicePerimeter_PerimeterType) EnumDescriptor deprecated 

func (ServicePerimeter_PerimeterType) EnumDescriptor() ([]byte, []int)

Deprecated: Use ServicePerimeter_PerimeterType.Descriptor instead.

func (ServicePerimeter_PerimeterType) Number 

func (x ServicePerimeter_PerimeterType) Number() protoreflect.EnumNumber

func (ServicePerimeter_PerimeterType) String 

func (x ServicePerimeter_PerimeterType) String() string

func (ServicePerimeter_PerimeterType) Type 

func (ServicePerimeter_PerimeterType) Type() protoreflect.EnumType

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.