pulumi-google-native-kotlin/com.pulumi.googlenative.accesscontextmanager.v1.kotlin.outputs

Package-level declarations

Types

data class ApiOperationResponse(val methodSelectors: List<MethodSelectorResponse>, val serviceName: String)

Identification for an API Operation.

data class AuditConfigResponse(val auditLogConfigs: List<AuditLogConfigResponse>, val service: String)

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": "user:jose@example.com" }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": "user:aliya@example.com" } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.

AuditLogConfigResponse

data class AuditLogConfigResponse(val exemptedMembers: List<String>, val logType: String)

Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": "user:jose@example.com" }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.

BasicLevelResponse

data class BasicLevelResponse(val combiningFunction: String, val conditions: List<ConditionResponse>)

BasicLevel is an AccessLevel using a set of recommended features.

BindingResponse

data class BindingResponse(val condition: ExprResponse, val members: List<String>, val role: String)

Associates members, or principals, with a role.

ConditionResponse

data class ConditionResponse(val devicePolicy: DevicePolicyResponse, val ipSubnetworks: List<String>, val members: List<String>, val negate: Boolean, val regions: List<String>, val requiredAccessLevels: List<String>)

A condition necessary for an AccessLevel to be granted. The Condition is an AND over its fields. So a Condition is true if: 1) the request IP is from one of the listed subnetworks AND 2) the originating device complies with the listed device policy AND 3) all listed access levels are granted AND 4) the request was sent at a time allowed by the DateTimeRestriction.

CustomLevelResponse

data class CustomLevelResponse(val expr: ExprResponse)

CustomLevel is an AccessLevel using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec

DevicePolicyResponse

data class DevicePolicyResponse(val allowedDeviceManagementLevels: List<String>, val allowedEncryptionStatuses: List<String>, val osConstraints: List<OsConstraintResponse>, val requireAdminApproval: Boolean, val requireCorpOwned: Boolean, val requireScreenlock: Boolean)

DevicePolicy specifies device specific restrictions necessary to acquire a given access level. A DevicePolicy specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. DevicePolicy acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { os_type : DESKTOP_WINDOWS, os_type : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.

EgressFromResponse

data class EgressFromResponse(val identities: List<String>, val identityType: String)

Defines the conditions under which an EgressPolicy matches a request. Conditions based on information about the source of the request. Note that if the destination of the request is also protected by a ServicePerimeter, then that ServicePerimeter must have an IngressPolicy which allows access in order for this request to succeed.

EgressPolicyResponse

data class EgressPolicyResponse(val egressFrom: EgressFromResponse, val egressTo: EgressToResponse)

Policy for egress from perimeter. EgressPolicies match requests based on egress_from and egress_to stanzas. For an EgressPolicy to match, both egress_from and egress_to stanzas must be matched. If an EgressPolicy matches a request, the request is allowed to span the ServicePerimeter boundary. For example, an EgressPolicy can be used to allow VMs on networks within the ServicePerimeter to access a defined set of projects outside the perimeter in certain contexts (e.g. to read data from a Cloud Storage bucket or query against a BigQuery dataset). EgressPolicies are concerned with the resources that a request relates as well as the API services and API actions being used. They do not related to the direction of data movement. More detailed documentation for this concept can be found in the descriptions of EgressFrom and EgressTo.

EgressToResponse

data class EgressToResponse(val externalResources: List<String>, val operations: List<ApiOperationResponse>, val resources: List<String>)

Defines the conditions under which an EgressPolicy matches a request. Conditions are based on information about the ApiOperation intended to be performed on the resources specified. Note that if the destination of the request is also protected by a ServicePerimeter, then that ServicePerimeter must have an IngressPolicy which allows access in order for this request to succeed. The request must match operations AND resources fields in order to be allowed egress out of the perimeter.

ExprResponse

data class ExprResponse(val description: String, val expression: String, val location: String, val title: String)

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.

GetAccessLevelResult

data class GetAccessLevelResult(val basic: BasicLevelResponse, val custom: CustomLevelResponse, val description: String, val name: String, val title: String)

GetAccessPolicyIamPolicyResult

data class GetAccessPolicyIamPolicyResult(val auditConfigs: List<AuditConfigResponse>, val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetAccessPolicyResult

data class GetAccessPolicyResult(val etag: String, val name: String, val parent: String, val scopes: List<String>, val title: String)

GetAuthorizedOrgsDescResult

data class GetAuthorizedOrgsDescResult(val assetType: String, val authorizationDirection: String, val authorizationType: String, val name: String, val orgs: List<String>)

GetGcpUserAccessBindingResult

data class GetGcpUserAccessBindingResult(val accessLevels: List<String>, val dryRunAccessLevels: List<String>, val groupKey: String, val name: String)

GetServicePerimeterResult

data class GetServicePerimeterResult(val description: String, val name: String, val perimeterType: String, val spec: ServicePerimeterConfigResponse, val status: ServicePerimeterConfigResponse, val title: String, val useExplicitDryRunSpec: Boolean)

IngressFromResponse

data class IngressFromResponse(val identities: List<String>, val identityType: String, val sources: List<IngressSourceResponse>)

Defines the conditions under which an IngressPolicy matches a request. Conditions are based on information about the source of the request. The request must satisfy what is defined in sources AND identity related fields in order to match.

IngressPolicyResponse

data class IngressPolicyResponse(val ingressFrom: IngressFromResponse, val ingressTo: IngressToResponse)

Policy for ingress into ServicePerimeter. IngressPolicies match requests based on ingress_from and ingress_to stanzas. For an ingress policy to match, both the ingress_from and ingress_to stanzas must be matched. If an IngressPolicy matches a request, the request is allowed through the perimeter boundary from outside the perimeter. For example, access from the internet can be allowed either based on an AccessLevel or, for traffic hosted on Google Cloud, the project of the source network. For access from private networks, using the project of the hosting network is required. Individual ingress policies can be limited by restricting which services and/or actions they match using the ingress_to field.

IngressSourceResponse

data class IngressSourceResponse(val accessLevel: String, val resource: String)

The source that IngressPolicy authorizes access from.

IngressToResponse

data class IngressToResponse(val operations: List<ApiOperationResponse>, val resources: List<String>)

Defines the conditions under which an IngressPolicy matches a request. Conditions are based on information about the ApiOperation intended to be performed on the target resource of the request. The request must satisfy what is defined in operations AND resources in order to match.

MethodSelectorResponse

data class MethodSelectorResponse(val method: String, val permission: String)

An allowed method or permission of a service specified in ApiOperation.

OsConstraintResponse

data class OsConstraintResponse(val minimumVersion: String, val osType: String, val requireVerifiedChromeOs: Boolean)

A restriction on the OS type and version of devices making requests.

ServicePerimeterConfigResponse

data class ServicePerimeterConfigResponse(val accessLevels: List<String>, val egressPolicies: List<EgressPolicyResponse>, val ingressPolicies: List<IngressPolicyResponse>, val resources: List<String>, val restrictedServices: List<String>, val vpcAccessibleServices: VpcAccessibleServicesResponse)

ServicePerimeterConfig specifies a set of Google Cloud resources that describe specific Service Perimeter configuration.

VpcAccessibleServicesResponse

data class VpcAccessibleServicesResponse(val allowedServices: List<String>, val enableRestriction: Boolean)

Specifies how APIs are allowed to communicate within the Service Perimeter.