-
Notifications
You must be signed in to change notification settings - Fork 2.2k
/
access_level.proto
192 lines (160 loc) · 8.18 KB
/
access_level.proto
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.identity.accesscontextmanager.v1;
import "google/api/resource.proto";
import "google/identity/accesscontextmanager/type/device_resources.proto";
import "google/protobuf/timestamp.proto";
import "google/type/expr.proto";
option csharp_namespace = "Google.Identity.AccessContextManager.V1";
option go_package = "cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb";
option java_multiple_files = true;
option java_outer_classname = "AccessLevelProto";
option java_package = "com.google.identity.accesscontextmanager.v1";
option objc_class_prefix = "GACM";
option php_namespace = "Google\\Identity\\AccessContextManager\\V1";
option ruby_package = "Google::Identity::AccessContextManager::V1";
// An `AccessLevel` is a label that can be applied to requests to Google Cloud
// services, along with a list of requirements necessary for the label to be
// applied.
message AccessLevel {
option (google.api.resource) = {
type: "accesscontextmanager.googleapis.com/AccessLevel"
pattern: "accessPolicies/{access_policy}/accessLevels/{access_level}"
};
// Required. Resource name for the Access Level. The `short_name` component
// must begin with a letter and only include alphanumeric and '_'. Format:
// `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum
// length of the `access_level` component is 50 characters.
string name = 1;
// Human readable title. Must be unique within the Policy.
string title = 2;
// Description of the `AccessLevel` and its use. Does not affect behavior.
string description = 3;
// Required. Describes the necessary conditions for the level to apply.
oneof level {
// A `BasicLevel` composed of `Conditions`.
BasicLevel basic = 4;
// A `CustomLevel` written in the Common Expression Language.
CustomLevel custom = 5;
}
// Output only. Time the `AccessLevel` was created in UTC.
google.protobuf.Timestamp create_time = 6;
// Output only. Time the `AccessLevel` was updated in UTC.
google.protobuf.Timestamp update_time = 7;
}
// `BasicLevel` is an `AccessLevel` using a set of recommended features.
message BasicLevel {
// Options for how the `conditions` list should be combined to determine if
// this `AccessLevel` is applied. Default is AND.
enum ConditionCombiningFunction {
// All `Conditions` must be true for the `BasicLevel` to be true.
AND = 0;
// If at least one `Condition` is true, then the `BasicLevel` is true.
OR = 1;
}
// Required. A list of requirements for the `AccessLevel` to be granted.
repeated Condition conditions = 1;
// How the `conditions` list should be combined to determine if a request is
// granted this `AccessLevel`. If AND is used, each `Condition` in
// `conditions` must be satisfied for the `AccessLevel` to be applied. If OR
// is used, at least one `Condition` in `conditions` must be satisfied for the
// `AccessLevel` to be applied. Default behavior is AND.
ConditionCombiningFunction combining_function = 2;
}
// A condition necessary for an `AccessLevel` to be granted. The Condition is an
// AND over its fields. So a Condition is true if: 1) the request IP is from one
// of the listed subnetworks AND 2) the originating device complies with the
// listed device policy AND 3) all listed access levels are granted AND 4) the
// request was sent at a time allowed by the DateTimeRestriction.
message Condition {
// CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for
// a CIDR IP address block, the specified IP address portion must be properly
// truncated (i.e. all the host bits must be zero) or the input is considered
// malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is
// not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas
// "2001:db8::1/32" is not. The originating IP of a request must be in one of
// the listed subnets in order for this Condition to be true. If empty, all IP
// addresses are allowed.
repeated string ip_subnetworks = 1;
// Device specific restrictions, all restrictions must hold for the
// Condition to be true. If not specified, all devices are allowed.
DevicePolicy device_policy = 2;
// A list of other access levels defined in the same `Policy`, referenced by
// resource name. Referencing an `AccessLevel` which does not exist is an
// error. All access levels listed must be granted for the Condition
// to be true. Example:
// "`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"`
repeated string required_access_levels = 3;
// Whether to negate the Condition. If true, the Condition becomes a NAND over
// its non-empty fields, each field must be false for the Condition overall to
// be satisfied. Defaults to false.
bool negate = 5;
// The request must be made by one of the provided user or service
// accounts. Groups are not supported.
// Syntax:
// `user:{emailid}`
// `serviceAccount:{emailid}`
// If not specified, a request may come from any user.
repeated string members = 6;
// The request must originate from one of the provided countries/regions.
// Must be valid ISO 3166-1 alpha-2 codes.
repeated string regions = 7;
}
// `CustomLevel` is an `AccessLevel` using the Cloud Common Expression Language
// to represent the necessary conditions for the level to apply to a request.
// See CEL spec at: https://github.com/google/cel-spec
message CustomLevel {
// Required. A Cloud CEL expression evaluating to a boolean.
google.type.Expr expr = 1;
}
// `DevicePolicy` specifies device specific restrictions necessary to acquire a
// given access level. A `DevicePolicy` specifies requirements for requests from
// devices to be granted access levels, it does not do any enforcement on the
// device. `DevicePolicy` acts as an AND over all specified fields, and each
// repeated field is an OR over its elements. Any unset fields are ignored. For
// example, if the proto is { os_type : DESKTOP_WINDOWS, os_type :
// DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be
// true for requests originating from encrypted Linux desktops and encrypted
// Windows desktops.
message DevicePolicy {
// Whether or not screenlock is required for the DevicePolicy to be true.
// Defaults to `false`.
bool require_screenlock = 1;
// Allowed encryptions statuses, an empty list allows all statuses.
repeated google.identity.accesscontextmanager.type.DeviceEncryptionStatus allowed_encryption_statuses = 2;
// Allowed OS versions, an empty list allows all types and all versions.
repeated OsConstraint os_constraints = 3;
// Allowed device management levels, an empty list allows all management
// levels.
repeated google.identity.accesscontextmanager.type.DeviceManagementLevel allowed_device_management_levels = 6;
// Whether the device needs to be approved by the customer admin.
bool require_admin_approval = 7;
// Whether the device needs to be corp owned.
bool require_corp_owned = 8;
}
// A restriction on the OS type and version of devices making requests.
message OsConstraint {
// Required. The allowed OS type.
google.identity.accesscontextmanager.type.OsType os_type = 1;
// The minimum allowed OS version. If not set, any version of this OS
// satisfies the constraint. Format: `"major.minor.patch"`.
// Examples: `"10.5.301"`, `"9.2.1"`.
string minimum_version = 2;
// Only allows requests from devices with a verified Chrome OS.
// Verifications includes requirements that the device is enterprise-managed,
// conformant to domain policies, and the caller has permission to call
// the API targeted by the request.
bool require_verified_chrome_os = 3;
}