googleapis
Version:
Google APIs Client Library for Node.js
1,279 lines • 238 kB
TypeScript
import { OAuth2Client, JWT, Compute, UserRefreshClient, BaseExternalAccountClient, GaxiosResponseWithHTTP2, GoogleConfigurable, MethodOptions, StreamMethodOptions, GlobalOptions, GoogleAuth, BodyResponseCallback, APIRequestContext } from 'googleapis-common';
import { Readable } from 'stream';
export declare namespace assuredworkloads_v1 {
export interface Options extends GlobalOptions {
version: 'v1';
}
interface StandardParameters {
/**
* Auth client or API Key for the request
*/
auth?: string | OAuth2Client | JWT | Compute | UserRefreshClient | BaseExternalAccountClient | GoogleAuth;
/**
* V1 error format.
*/
'$.xgafv'?: string;
/**
* OAuth access token.
*/
access_token?: string;
/**
* Data format for response.
*/
alt?: string;
/**
* JSONP
*/
callback?: string;
/**
* Selector specifying which fields to include in a partial response.
*/
fields?: string;
/**
* API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.
*/
key?: string;
/**
* OAuth 2.0 token for the current user.
*/
oauth_token?: string;
/**
* Returns response with indentations and line breaks.
*/
prettyPrint?: boolean;
/**
* Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.
*/
quotaUser?: string;
/**
* Legacy upload protocol for media (e.g. "media", "multipart").
*/
uploadType?: string;
/**
* Upload protocol for media (e.g. "raw", "multipart").
*/
upload_protocol?: string;
}
/**
* Assured Workloads API
*
*
*
* @example
* ```js
* const {google} = require('googleapis');
* const assuredworkloads = google.assuredworkloads('v1');
* ```
*/
export class Assuredworkloads {
context: APIRequestContext;
assuredworkloads: Resource$Assuredworkloads;
folders: Resource$Folders;
organizations: Resource$Organizations;
projects: Resource$Projects;
constructor(options: GlobalOptions, google?: GoogleConfigurable);
}
/**
* Request for acknowledging the violation
*/
export interface Schema$GoogleCloudAssuredworkloadsV1AcknowledgeViolationRequest {
/**
* Optional. Acknowledge type of specified violation.
*/
acknowledgeType?: string | null;
/**
* Required. Business justification explaining the need for violation acknowledgement
*/
comment?: string | null;
/**
* Optional. This field is deprecated and will be removed in future version of the API. Name of the OrgPolicy which was modified with non-compliant change and resulted in this violation. Format: projects/{project_number\}/policies/{constraint_name\} folders/{folder_id\}/policies/{constraint_name\} organizations/{organization_id\}/policies/{constraint_name\}
*/
nonCompliantOrgPolicy?: string | null;
}
/**
* Response for violation acknowledgement
*/
export interface Schema$GoogleCloudAssuredworkloadsV1AcknowledgeViolationResponse {
}
/**
* The response message for AggregateDbFrameworkComplianceReport.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1AggregateDbFrameworkComplianceReportResponse {
/**
* The list of aggregated compliance reports.
*/
aggregatedComplianceReports?: Schema$GoogleCloudAssuredworkloadsV1AggregatedComplianceReport[];
}
/**
* The aggregated compliance report.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1AggregatedComplianceReport {
/**
* The control assessment details of the framework.
*/
controlAssessmentDetails?: Schema$GoogleCloudAssuredworkloadsV1ControlAssessmentDetails;
/**
* The report time of the aggregated compliance report.
*/
reportTime?: string | null;
}
/**
* Response containing the analysis results for the hypothetical resource move.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1AnalyzeWorkloadMoveResponse {
/**
* List of analysis results for each asset in scope.
*/
assetMoveAnalyses?: Schema$GoogleCloudAssuredworkloadsV1AssetMoveAnalysis[];
/**
* The next page token. Is empty if the last page is reached.
*/
nextPageToken?: string | null;
}
/**
* Operation metadata to give request details of ApplyWorkloadUpdate.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ApplyWorkloadUpdateOperationMetadata {
/**
* Optional. The time the operation was created.
*/
action?: string | null;
/**
* Optional. Output only. The time the operation was created.
*/
createTime?: string | null;
/**
* Required. The resource name of the update
*/
updateName?: string | null;
}
/**
* Request to apply update to a workload.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ApplyWorkloadUpdateRequest {
/**
* The action to be performed on the update.
*/
action?: string | null;
}
/**
* Response for ApplyWorkloadUpdate endpoint.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ApplyWorkloadUpdateResponse {
/**
* The update that was applied.
*/
appliedUpdate?: Schema$GoogleCloudAssuredworkloadsV1WorkloadUpdate;
}
/**
* Request for archiving resource events.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ArchiveResourceEventsRequest {
/**
* Optional. Time to set as ArchiveTime in the archive table. If not provided, the current time is used.
*/
archiveTime?: string | null;
/**
* Required. The number of events to process in a single transaction batch.
*/
batchSize?: number | null;
/**
* Required. Only events with EventTime earlier than this cutoff will be archived.
*/
eventCutoffTime?: string | null;
/**
* Required. The maximum total number of events to move in this request.
*/
maxEventsMove?: number | null;
/**
* Required. The organization ID for which to archive events.
*/
organizationId?: string | null;
/**
* Required. The region of the workload(s) whose events should be archived. This is used to filter workloads based on AssurantWorkloadData.region.
*/
region?: string | null;
}
/**
* Response for archiving resource events.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ArchiveResourceEventsResponse {
/**
* The total number of events successfully moved to the archive table.
*/
movedEventsCount?: number | null;
}
/**
* Represents move analysis results for an asset.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1AssetMoveAnalysis {
/**
* List of eligible analyses performed for the asset.
*/
analysisGroups?: Schema$GoogleCloudAssuredworkloadsV1MoveAnalysisGroup[];
/**
* The full resource name of the asset being analyzed. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1
*/
asset?: string | null;
/**
* Type of the asset being analyzed. Possible values will be among the ones listed [here](https://cloud.google.com/asset-inventory/docs/supported-asset-types).
*/
assetType?: string | null;
}
/**
* Request for acknowledging the violations in a batch
*/
export interface Schema$GoogleCloudAssuredworkloadsV1BatchAcknowledgeViolationsRequest {
/**
* Optional. Acknowledge type of specified violations.
*/
acknowledgeType?: string | null;
/**
* Required. Business justification explaining the need for violations acknowledgement
*/
comment?: string | null;
/**
* Required. The resource names of the Violations to acknowledge. Format for each name: organizations/{organization\}/locations/{location\}/workloads/{workload\}/violations/{violation\}
*/
names?: string[] | null;
}
/**
* Response for batch violation acknowledgement
*/
export interface Schema$GoogleCloudAssuredworkloadsV1BatchAcknowledgeViolationsResponse {
/**
* Count of acknowledged violations.
*/
acknowledgedViolationsCount?: number | null;
}
/**
* A Common Expression Language (CEL) expression that's used to create a rule.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1CELExpression {
/**
* Required. The logical expression in CEL. The maximum length of the condition is 1000 characters. For more information, see [CEL expression](https://cloud.google.com/security-command-center/docs/compliance-manager-write-cel-expressions).
*/
expression?: string | null;
/**
* The resource instance types on which this expression is defined. The format is `/`. For example: `compute.googleapis.com/Instance`
*/
resourceTypesValues?: Schema$GoogleCloudAssuredworkloadsV1StringList;
}
/**
* The cloud control assessment details for non-manual cloud controls.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1CloudControlAssessmentDetails {
/**
* Output only. The evaluation status of the cloud control.
*/
evaluationState?: string | null;
/**
* The number of findings for the cloud control.
*/
findingsCount?: number | null;
}
/**
* The cloud control report.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1CloudControlReport {
/**
* The list of categories for the cloud control.
*/
categories?: string[] | null;
/**
* The name of the cloud control.
*/
cloudControl?: string | null;
/**
* The details of a cloud control assessment.
*/
cloudControlAssessmentDetails?: Schema$GoogleCloudAssuredworkloadsV1CloudControlAssessmentDetails;
/**
* The name of the cloud control deployment.
*/
cloudControlDeployment?: string | null;
/**
* The type of the cloud control.
*/
cloudControlType?: string | null;
/**
* The description of the cloud control.
*/
description?: string | null;
/**
* The display name of the cloud control.
*/
displayName?: string | null;
/**
* The enforcement mode of the cloud control.
*/
enforcementMode?: string | null;
/**
* The category of the finding.
*/
findingCategory?: string | null;
/**
* The severity of the finding.
*/
findingSeverity?: string | null;
/**
* The major revision IDs of the frameworks that the cloud control belongs to.
*/
frameworkMajorRevisionIds?: string[] | null;
/**
* The major revision ID of the cloud control.
*/
majorRevisionId?: string | null;
/**
* The details of a manual cloud control assessment.
*/
manualCloudControlAssessmentDetails?: Schema$GoogleCloudAssuredworkloadsV1ManualCloudControlAssessmentDetails;
/**
* The minor revision ID of the cloud control.
*/
minorRevisionId?: string | null;
/**
* The list of rules that correspond to the cloud control.
*/
rules?: Schema$GoogleCloudAssuredworkloadsV1Rule[];
/**
* The list of similar controls.
*/
similarControls?: Schema$GoogleCloudAssuredworkloadsV1SimilarControls[];
}
/**
* The details for a control assessment.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ControlAssessmentDetails {
/**
* The list of controls that were assessed and are passing.
*/
assessedPassingControlIds?: string[] | null;
/**
* The number of controls that were assessed and are passing.
*/
assessedPassingControls?: number | null;
/**
* The list of controls that are failing.
*/
failingControlIds?: string[] | null;
/**
* The number of controls that are failing.
*/
failingControls?: number | null;
/**
* The list of controls that aren't assessed because they require manual review.
*/
notAssessedControlIds?: string[] | null;
/**
* The number of controls that aren't assessed because they require manual review.
*/
notAssessedControls?: number | null;
/**
* The list of controls that are passing or not assessed.
*/
passingControlIds?: string[] | null;
/**
* The number of controls that are passing or not assessed.
*/
passingControls?: number | null;
}
/**
* Operation metadata to give request details of CreateWorkload.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1CreateWorkloadOperationMetadata {
/**
* Optional. Compliance controls that should be applied to the resources managed by the workload.
*/
complianceRegime?: string | null;
/**
* Optional. Time when the operation was created.
*/
createTime?: string | null;
/**
* Optional. The display name of the workload.
*/
displayName?: string | null;
/**
* Optional. The parent of the workload.
*/
parent?: string | null;
}
/**
* The details for control compliance.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1DbControlComplianceSummary {
/**
* The list of cloud control reports.
*/
cloudControlReports?: Schema$GoogleCloudAssuredworkloadsV1CloudControlReport[];
/**
* The list of compliance frameworks that the control belongs to.
*/
complianceFrameworks?: string[] | null;
/**
* The name of the control.
*/
control?: string | null;
/**
* The responsibility type for the control.
*/
controlResponsibilityType?: string | null;
/**
* The description of the control.
*/
description?: string | null;
/**
* The display name of the control.
*/
displayName?: string | null;
/**
* Whether the control is a fake control. Fake controls are created and mapped to cloud controls that don't belong to a control group.
*/
isFakeControl?: boolean | null;
/**
* Identifier. The name of the control compliance summary.
*/
name?: string | null;
/**
* Output only. The overall evaluation status of the control.
*/
overallEvaluationState?: string | null;
/**
* The list of similar controls.
*/
similarControls?: Schema$GoogleCloudAssuredworkloadsV1SimilarControls[];
/**
* The total number of findings for the control.
*/
totalFindingsCount?: number | null;
}
/**
* The details for a finding.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1DbFindingSummary {
/**
* Output only. The category of the finding.
*/
findingCategory?: string | null;
/**
* Output only. The class of the finding.
*/
findingClass?: string | null;
/**
* Output only. The count of the finding.
*/
findingCount?: string | null;
/**
* Identifier. The name of the finding summary.
*/
name?: string | null;
/**
* Optional. The list of compliance frameworks that the finding belongs to.
*/
relatedFrameworks?: string[] | null;
/**
* Output only. The severity of the finding.
*/
severity?: string | null;
/**
* Output only. The last updated time of the finding.
*/
updateTime?: string | null;
}
/**
* The details for a framework compliance summary.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1DbFrameworkComplianceSummary {
/**
* The control assessment details of the framework.
*/
controlAssessmentDetails?: Schema$GoogleCloudAssuredworkloadsV1ControlAssessmentDetails;
/**
* Output only. The trend of controls that are passing for the given duration.
*/
controlsPassingTrend?: Schema$GoogleCloudAssuredworkloadsV1Trend;
/**
* Output only. The count of the findings generated against the framework.
*/
findingCount?: string | null;
/**
* The name of the framework.
*/
framework?: string | null;
/**
* The list of framework categories supported by the framework.
*/
frameworkCategories?: string[] | null;
/**
* Optional. The display name for the framework.
*/
frameworkDisplayName?: string | null;
/**
* The type of framework.
*/
frameworkType?: string | null;
/**
* The major revision ID of the framework.
*/
majorRevisionId?: string | null;
/**
* The minor revision ID of the framework.
*/
minorRevisionId?: string | null;
/**
* Identifier. The name of the framework compliance summary.
*/
name?: string | null;
/**
* The list of cloud providers supported by the framework.
*/
supportedCloudProviders?: string[] | null;
/**
* The target resource details for the framework.
*/
targetResourceDetails?: Schema$GoogleCloudAssuredworkloadsV1TargetResourceDetails[];
}
/**
* Response for EnableComplianceUpdates endpoint.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1EnableComplianceUpdatesResponse {
}
/**
* Response for EnableResourceMonitoring endpoint.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1EnableResourceMonitoringResponse {
}
/**
* The response message for FetchDbFrameworkComplianceReport.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1FetchDbFrameworkComplianceReportResponse {
/**
* The control assessment details of the framework.
*/
controlAssessmentDetails?: Schema$GoogleCloudAssuredworkloadsV1ControlAssessmentDetails;
/**
* The name of the framework.
*/
framework?: string | null;
/**
* The list of framework categories supported.
*/
frameworkCategories?: string[] | null;
/**
* The description of the framework.
*/
frameworkDescription?: string | null;
/**
* Optional. The display name for the framework.
*/
frameworkDisplayName?: string | null;
/**
* The type of the framework.
*/
frameworkType?: string | null;
/**
* The latest major revision ID of the framework.
*/
majorRevisionId?: string | null;
/**
* The latest minor revision ID of the latest major revision of the framework.
*/
minorRevisionId?: string | null;
/**
* The name of the framework compliance report.
*/
name?: string | null;
/**
* The list of cloud providers that are supported by the framework.
*/
supportedCloudProviders?: string[] | null;
/**
* The target resource details of the framework.
*/
targetResourceDetails?: Schema$GoogleCloudAssuredworkloadsV1TargetResourceDetails[];
/**
* Output only. The last updated time of the report.
*/
updateTime?: string | null;
}
/**
* The response message for ListDBControlComplianceSummaries.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ListDbControlComplianceSummariesResponse {
/**
* The list of control compliance details.
*/
dbControlComplianceSummaries?: Schema$GoogleCloudAssuredworkloadsV1DbControlComplianceSummary[];
/**
* Output only. The token to retrieve the next page of results.
*/
nextPageToken?: string | null;
}
/**
* The response message for ListDbFindingSummaries.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ListDbFindingSummariesResponse {
/**
* List of finding summary by category.
*/
dbFindingSummaries?: Schema$GoogleCloudAssuredworkloadsV1DbFindingSummary[];
/**
* Output only. The token to retrieve the next page of results.
*/
nextPageToken?: string | null;
}
/**
* The response message for ListDbFrameworkComplianceSummariesResponse.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ListDbFrameworkComplianceSummariesResponse {
/**
* The list of framework compliance summaries.
*/
dbFrameworkComplianceSummaries?: Schema$GoogleCloudAssuredworkloadsV1DbFrameworkComplianceSummary[];
/**
* Output only. The token to retrieve the next page of results.
*/
nextPageToken?: string | null;
}
/**
* Response of ListViolations endpoint.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ListViolationsResponse {
/**
* The next page token. Returns empty if reached the last page.
*/
nextPageToken?: string | null;
/**
* The total number of violations.
*/
totalSize?: number | null;
/**
* List of Violations under a Workload.
*/
violations?: Schema$GoogleCloudAssuredworkloadsV1Violation[];
}
/**
* Response of ListWorkloads endpoint.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ListWorkloadsResponse {
/**
* The next page token. Return empty if reached the last page.
*/
nextPageToken?: string | null;
/**
* List of Workloads under a given parent.
*/
workloads?: Schema$GoogleCloudAssuredworkloadsV1Workload[];
}
/**
* Response of listing the compliance updates per workload with pagination.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ListWorkloadUpdatesResponse {
/**
* The next page token. Return empty if reached the last page.
*/
nextPageToken?: string | null;
/**
* The list of workload updates for a given workload.
*/
workloadUpdates?: Schema$GoogleCloudAssuredworkloadsV1WorkloadUpdate[];
}
/**
* The details for a manual cloud control assessment.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ManualCloudControlAssessmentDetails {
/**
* The guide for assessing a cloud control manually.
*/
manualCloudControlGuide?: string[] | null;
}
/**
* Represents a logical group of checks performed for an asset. If successful, the group contains the analysis result, otherwise it contains an error with the failure reason.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1MoveAnalysisGroup {
/**
* Result of a successful analysis.
*/
analysisResult?: Schema$GoogleCloudAssuredworkloadsV1MoveAnalysisResult;
/**
* Name of the analysis group.
*/
displayName?: string | null;
/**
* Error details for a failed analysis.
*/
error?: Schema$GoogleRpcStatus;
}
/**
* Represents the successful move analysis results for a group.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1MoveAnalysisResult {
/**
* List of blockers. If not resolved, these will result in compliance violations in the target.
*/
blockers?: Schema$GoogleCloudAssuredworkloadsV1MoveImpact[];
/**
* List of warnings. These are risks that may or may not result in compliance violations.
*/
warnings?: Schema$GoogleCloudAssuredworkloadsV1MoveImpact[];
}
/**
* Represents the impact of moving the asset to the target.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1MoveImpact {
/**
* Explanation of the impact.
*/
detail?: string | null;
}
/**
* Request for updating permission settings for a partner workload.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1MutatePartnerPermissionsRequest {
/**
* Optional. The etag of the workload. If this is provided, it must match the server's etag.
*/
etag?: string | null;
/**
* Required. The partner permissions to be updated.
*/
partnerPermissions?: Schema$GoogleCloudAssuredworkloadsV1WorkloadPartnerPermissions;
/**
* Required. The list of fields to be updated. E.g. update_mask { paths: "partner_permissions.data_logs_viewer"\}
*/
updateMask?: string | null;
}
/**
* This assured workload service object is used to represent the org policy attached to a resource. It servces the same purpose as the orgpolicy.v2.Policy object but with functionality that is limited to what is supported by Assured Workloads(e.g. only one rule under one OrgPolicy object, no conditions, etc).
*/
export interface Schema$GoogleCloudAssuredworkloadsV1OrgPolicy {
/**
* The constraint name of the OrgPolicy. e.g. "constraints/gcp.resourceLocations".
*/
constraint?: string | null;
/**
* If `inherit` is true, policy rules of the lowest ancestor in the resource hierarchy chain are inherited. If it is false, policy rules are not inherited.
*/
inherit?: boolean | null;
/**
* Ignores policies set above this resource and restores to the `constraint_default` value. `reset` can only be true when `rules` is empty and `inherit` is false.
*/
reset?: boolean | null;
/**
* Resource that the OrgPolicy attaches to. Format: folders/123" projects/123".
*/
resource?: string | null;
/**
* The rule of the OrgPolicy.
*/
rule?: Schema$GoogleCloudAssuredworkloadsV1OrgPolicyPolicyRule;
}
/**
* A rule used to express this policy.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1OrgPolicyPolicyRule {
/**
* ListPolicy only when all values are allowed.
*/
allowAll?: boolean | null;
/**
* ListPolicy only when all values are denied.
*/
denyAll?: boolean | null;
/**
* BooleanPolicy only.
*/
enforce?: boolean | null;
/**
* ListPolicy only when custom values are specified.
*/
values?: Schema$GoogleCloudAssuredworkloadsV1OrgPolicyPolicyRuleStringValues;
}
/**
* The values allowed for a ListPolicy.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1OrgPolicyPolicyRuleStringValues {
/**
* List of values allowed at this resource.
*/
allowedValues?: string[] | null;
/**
* List of values denied at this resource.
*/
deniedValues?: string[] | null;
}
/**
* Represents an update for an org policy control applied on an Assured Workload resource. The inherited org policy is not considered.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1OrgPolicyUpdate {
/**
* The org policy currently applied on the assured workload resource.
*/
appliedPolicy?: Schema$GoogleCloudAssuredworkloadsV1OrgPolicy;
/**
* The suggested org policy that replaces the applied policy.
*/
suggestedPolicy?: Schema$GoogleCloudAssuredworkloadsV1OrgPolicy;
}
/**
* Request for restricting list of available resources in Workload environment.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1RestrictAllowedResourcesRequest {
/**
* Required. The type of restriction for using gcp products in the Workload environment.
*/
restrictionType?: string | null;
}
/**
* Response for restricting the list of allowed resources.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1RestrictAllowedResourcesResponse {
}
/**
* Request for reverting archived resource events.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1RevertArchivedResourceEventsRequest {
/**
* Required. Only events within this time range will be reverted. This helps prevent reverting everything when something goes wrong.
*/
archiveEndTime?: string | null;
/**
* Required. Only events within this time range will be reverted. This helps prevent reverting everything when something goes wrong.
*/
archiveStartTime?: string | null;
/**
* Required. The number of events to process in a single transaction batch.
*/
batchSize?: number | null;
/**
* Required. The maximum total number of events to move in this request.
*/
maxEventsMove?: number | null;
/**
* Required. The organization ID for which to revert events.
*/
organizationId?: string | null;
/**
* Required. The region of the workload(s) whose events should be reverted. This is used to filter workloads based on AssurantWorkloadData.region.
*/
region?: string | null;
}
/**
* Response for reverting archived resource events.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1RevertArchivedResourceEventsResponse {
/**
* The total number of events successfully moved to the original table.
*/
movedEventsCount?: number | null;
}
/**
* A rule in the cloud control.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1Rule {
/**
* The rule's logic expression in Common Expression Language (CEL).
*/
celExpression?: Schema$GoogleCloudAssuredworkloadsV1CELExpression;
/**
* Optional. The rule description. The maximum length is 2000 characters.
*/
description?: string | null;
/**
* Required. The functionality that's enabled by the rule.
*/
ruleActionTypes?: string[] | null;
}
/**
* The similar controls.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1SimilarControls {
/**
* The ID of the control.
*/
controlId?: string | null;
/**
* The name of the framework.
*/
framework?: string | null;
}
/**
* A list of strings for the parameter value.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1StringList {
/**
* Required. The strings in the list.
*/
values?: string[] | null;
}
/**
* The details for a target resource.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1TargetResourceDetails {
/**
* The create time of the target resource.
*/
createTime?: string | null;
/**
* The framework deployment name for the target resource. For example, `organizations/{organization_id\}/locations/{location\}/frameworkDeployments/{framework_deployment_id\}`
*/
frameworkDeployment?: string | null;
/**
* The major revision ID of the framework for the target resource.
*/
majorRevisionId?: string | null;
/**
* The minor revision ID of the framework for the target resource.
*/
minorRevisionId?: string | null;
/**
* The target resource. For example, `organizations/1234567890`, `projects/1234567890`, or `folders/1234567890`.
*/
targetResource?: string | null;
/**
* The display name of the target resource. For example, `google.com`, `staging-project`, or `development-folder`.
*/
targetResourceDisplayName?: string | null;
/**
* The update time of the target resource.
*/
updateTime?: string | null;
}
/**
* The trend of a compliance metric.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1Trend {
/**
* Output only. The duration for the trend.
*/
duration?: string | null;
/**
* Output only. The trend value as a percentage. The value can be positive or negative.
*/
valuePercent?: number | null;
}
/**
* The details of the update.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1UpdateDetails {
/**
* Update to one org policy, e.g. gcp.resourceLocation.
*/
orgPolicyUpdate?: Schema$GoogleCloudAssuredworkloadsV1OrgPolicyUpdate;
}
/**
* Workload monitoring Violation.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1Violation {
/**
* A boolean that indicates if the violation is acknowledged
*/
acknowledged?: boolean | null;
/**
* Optional. Timestamp when this violation was acknowledged first. Check exception_contexts to find the last time the violation was acknowledged when there are more than one violations. This field will be absent when acknowledged field is marked as false.
*/
acknowledgementTime?: string | null;
/**
* Optional. Output only. Violation Id of the org-policy violation due to which the resource violation is caused. Empty for org-policy violations.
*/
associatedOrgPolicyViolationId?: string | null;
/**
* Output only. Immutable. Audit Log Link for violated resource Format: https://console.cloud.google.com/logs/query;query={logName\}{protoPayload.resourceName\}{timeRange\}{folder\}
*/
auditLogLink?: string | null;
/**
* Output only. Time of the event which triggered the Violation.
*/
beginTime?: string | null;
/**
* Output only. Category under which this violation is mapped. e.g. Location, Service Usage, Access, Encryption, etc.
*/
category?: string | null;
/**
* Output only. Description for the Violation. e.g. OrgPolicy gcp.resourceLocations has non compliant value.
*/
description?: string | null;
/**
* Output only. Immutable. Audit Log link to find business justification provided for violation exception. Format: https://console.cloud.google.com/logs/query;query={logName\}{protoPayload.resourceName\}{protoPayload.methodName\}{timeRange\}{organization\}
*/
exceptionAuditLogLink?: string | null;
/**
* Output only. List of all the exception detail added for the violation.
*/
exceptionContexts?: Schema$GoogleCloudAssuredworkloadsV1ViolationExceptionContext[];
/**
* Output only. Immutable. Name of the Violation. Format: organizations/{organization\}/locations/{location\}/workloads/{workload_id\}/violations/{violations_id\}
*/
name?: string | null;
/**
* Output only. Immutable. Name of the OrgPolicy which was modified with non-compliant change and resulted this violation. Format: projects/{project_number\}/policies/{constraint_name\} folders/{folder_id\}/policies/{constraint_name\} organizations/{organization_id\}/policies/{constraint_name\}
*/
nonCompliantOrgPolicy?: string | null;
/**
* Output only. Immutable. The org-policy-constraint that was incorrectly changed, which resulted in this violation.
*/
orgPolicyConstraint?: string | null;
/**
* Optional. Output only. Parent project number where resource is present. Empty for org-policy violations.
*/
parentProjectNumber?: string | null;
/**
* Output only. Compliance violation remediation
*/
remediation?: Schema$GoogleCloudAssuredworkloadsV1ViolationRemediation;
/**
* Output only. Time of the event which fixed the Violation. If the violation is ACTIVE this will be empty.
*/
resolveTime?: string | null;
/**
* Optional. Output only. Name of the resource like //storage.googleapis.com/myprojectxyz-testbucket. Empty for org-policy violations.
*/
resourceName?: string | null;
/**
* Optional. Output only. Type of the resource like compute.googleapis.com/Disk, etc. Empty for org-policy violations.
*/
resourceType?: string | null;
/**
* Output only. State of the violation
*/
state?: string | null;
/**
* Output only. The last time when the Violation record was updated.
*/
updateTime?: string | null;
/**
* Output only. Type of the violation
*/
violationType?: string | null;
}
/**
* Violation exception detail.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ViolationExceptionContext {
/**
* Timestamp when the violation was acknowledged.
*/
acknowledgementTime?: string | null;
/**
* Business justification provided towards the acknowledgement of the violation.
*/
comment?: string | null;
/**
* Name of the user (or service account) who acknowledged the violation.
*/
userName?: string | null;
}
/**
* Represents remediation guidance to resolve compliance violation for AssuredWorkload
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ViolationRemediation {
/**
* Values that can resolve the violation For example: for list org policy violations, this will either be the list of allowed or denied values
*/
compliantValues?: string[] | null;
/**
* Required. Remediation instructions to resolve violations
*/
instructions?: Schema$GoogleCloudAssuredworkloadsV1ViolationRemediationInstructions;
/**
* Output only. Reemediation type based on the type of org policy values violated
*/
remediationType?: string | null;
}
/**
* Instructions to remediate violation
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ViolationRemediationInstructions {
/**
* Remediation instructions to resolve violation via cloud console
*/
consoleInstructions?: Schema$GoogleCloudAssuredworkloadsV1ViolationRemediationInstructionsConsole;
/**
* Remediation instructions to resolve violation via gcloud cli
*/
gcloudInstructions?: Schema$GoogleCloudAssuredworkloadsV1ViolationRemediationInstructionsGcloud;
}
/**
* Remediation instructions to resolve violation via cloud console
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ViolationRemediationInstructionsConsole {
/**
* Additional urls for more information about steps
*/
additionalLinks?: string[] | null;
/**
* Link to console page where violations can be resolved
*/
consoleUris?: string[] | null;
/**
* Steps to resolve violation via cloud console
*/
steps?: string[] | null;
}
/**
* Remediation instructions to resolve violation via gcloud cli
*/
export interface Schema$GoogleCloudAssuredworkloadsV1ViolationRemediationInstructionsGcloud {
/**
* Additional urls for more information about steps
*/
additionalLinks?: string[] | null;
/**
* Gcloud command to resolve violation
*/
gcloudCommands?: string[] | null;
/**
* Steps to resolve violation via gcloud cli
*/
steps?: string[] | null;
}
/**
* A Workload object for managing highly regulated workloads of cloud customers.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1Workload {
/**
* Optional. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id\}`. For example, `billingAccounts/012345-567890-ABCDEF`.
*/
billingAccount?: string | null;
/**
* Required. Immutable. Compliance Regime associated with this workload.
*/
complianceRegime?: string | null;
/**
* Output only. Count of active Violations in the Workload.
*/
complianceStatus?: Schema$GoogleCloudAssuredworkloadsV1WorkloadComplianceStatus;
/**
* Output only. Urls for services which are compliant for this Assured Workload, but which are currently disallowed by the ResourceUsageRestriction org policy. Invoke RestrictAllowedResources endpoint to allow your project developers to use these services in their environment.
*/
compliantButDisallowedServices?: string[] | null;
/**
* Output only. Immutable. The Workload creation timestamp.
*/
createTime?: string | null;
/**
* Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
*/
displayName?: string | null;
/**
* Output only. Represents the Ekm Provisioning State of the given workload.
*/
ekmProvisioningResponse?: Schema$GoogleCloudAssuredworkloadsV1WorkloadEkmProvisioningResponse;
/**
* Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers.
*/
enableSovereignControls?: boolean | null;
/**
* Optional. ETag of the workload, it is calculated on the basis of the Workload contents. It will be used in Update & Delete operations.
*/
etag?: string | null;
/**
* Output only. Represents the KAJ enrollment state of the given workload.
*/
kajEnrollmentState?: string | null;
/**
* Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field.
*/
kmsSettings?: Schema$GoogleCloudAssuredworkloadsV1WorkloadKMSSettings;
/**
* Optional. Labels applied to the workload.
*/
labels?: {
[key: string]: string;
} | null;
/**
* Optional. The resource name of the workload. Format: organizations/{organization\}/locations/{location\}/workloads/{workload\} Read-only.
*/
name?: string | null;
/**
* Optional. Partner regime associated with this workload.
*/
partner?: string | null;
/**
* Optional. Permissions granted to the AW Partner SA account for the customer workload
*/
partnerPermissions?: Schema$GoogleCloudAssuredworkloadsV1WorkloadPartnerPermissions;
/**
* Optional. Billing account necessary for purchasing services from Sovereign Partners. This field is required for creating SIA/PSN/CNTXT/Telefonica partner workloads. The caller should have 'billing.resourceAssociations.create' IAM permission on this billing-account. The format of this string is billingAccounts/AAAAAA-BBBBBB-CCCCCC
*/
partnerServicesBillingAccount?: string | null;
/**
* Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id\}
*/
provisionedResourcesParent?: string | null;
/**
* Output only. Indicates whether resource monitoring is enabled for workload or not. It is true when Resource feed is subscribed to AWM topic and AWM Service Agent Role is binded to AW Service Account for resource Assured workload.
*/
resourceMonitoringEnabled?: boolean | null;
/**
* Output only. The resources associated with this workload. These resources will be created when creating the workload. If any of the projects already exist, the workload creation will fail. Always read only.
*/
resources?: Schema$GoogleCloudAssuredworkloadsV1WorkloadResourceInfo[];
/**
* Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
*/
resourceSettings?: Schema$GoogleCloudAssuredworkloadsV1WorkloadResourceSettings[];
/**
* Output only. Represents the SAA enrollment response of the given workload. SAA enrollment response is queried during GetWorkload call. In failure cases, user friendly error message is shown in SAA details page.
*/
saaEnrollmentResponse?: Schema$GoogleCloudAssuredworkloadsV1WorkloadSaaEnrollmentResponse;
/**
* Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload.
*/
violationNotificationsEnabled?: boolean | null;
/**
* Optional. Options to be set for the given created workload.
*/
workloadOptions?: Schema$GoogleCloudAssuredworkloadsV1WorkloadWorkloadOptions;
}
/**
* Represents the Compliance Status of this workload
*/
export interface Schema$GoogleCloudAssuredworkloadsV1WorkloadComplianceStatus {
/**
* Number of current resource violations which are not acknowledged.
*/
acknowledgedResourceViolationCount?: number | null;
/**
* Number of current orgPolicy violations which are acknowledged.
*/
acknowledgedViolationCount?: number | null;
/**
* Number of current resource violations which are acknowledged.
*/
activeResourceViolationCount?: number | null;
/**
* Number of current orgPolicy violations which are not acknowledged.
*/
activeViolationCount?: number | null;
}
/**
* External key management systems(EKM) Provisioning response
*/
export interface Schema$GoogleCloudAssuredworkloadsV1WorkloadEkmProvisioningResponse {
/**
* Indicates Ekm provisioning error if any.
*/
ekmProvisioningErrorDomain?: string | null;
/**
* Detailed error message if Ekm provisioning fails
*/
ekmProvisioningErrorMapping?: string | null;
/**
* Output only. Indicates Ekm enrollment Provisioning of a given workload.
*/
ekmProvisioningState?: string | null;
}
/**
* Settings specific to the Key Management Service.
*/
export interface Schema$GoogleCloudAssuredworkloadsV1WorkloadKMSSettings {
/**
* Required. Input only. Immutable. The time at which the Key Management Service will automatically create a new version of the crypto key and mark it as the primary.
*/
nextRotationTime?: string | null;
/**
* Required. Input only. Immutable. [next_rotation_time] will be advanced by this period when the Key Management Service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours.
*/
rotationPeriod?: