zz_serviceperimeter_types.go

// SPDX-FileCopyrightText: 2024 The Crossplane Authors <https://crossplane.io>
//
// SPDX-License-Identifier: Apache-2.0

// Code generated by upjet. DO NOT EDIT.

package v1beta1

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime/schema"

	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
)

type EgressFromInitParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Whether to enforce traffic restrictions based on sources field. If the sources field is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
	// Possible values are: SOURCE_RESTRICTION_UNSPECIFIED, SOURCE_RESTRICTION_ENABLED, SOURCE_RESTRICTION_DISABLED.
	SourceRestriction *string `json:"sourceRestriction,omitempty" tf:"source_restriction,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []SourcesInitParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type EgressFromObservation struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Whether to enforce traffic restrictions based on sources field. If the sources field is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
	// Possible values are: SOURCE_RESTRICTION_UNSPECIFIED, SOURCE_RESTRICTION_ENABLED, SOURCE_RESTRICTION_DISABLED.
	SourceRestriction *string `json:"sourceRestriction,omitempty" tf:"source_restriction,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []SourcesObservation `json:"sources,omitempty" tf:"sources,omitempty"`
}

type EgressFromParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +kubebuilder:validation:Optional
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	// +kubebuilder:validation:Optional
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Whether to enforce traffic restrictions based on sources field. If the sources field is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
	// Possible values are: SOURCE_RESTRICTION_UNSPECIFIED, SOURCE_RESTRICTION_ENABLED, SOURCE_RESTRICTION_DISABLED.
	// +kubebuilder:validation:Optional
	SourceRestriction *string `json:"sourceRestriction,omitempty" tf:"source_restriction,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Sources []SourcesParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type EgressFromSourcesInitParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`
}

type EgressFromSourcesObservation struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`
}

type EgressFromSourcesParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	// +kubebuilder:validation:Optional
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`
}

type EgressPoliciesEgressFromInitParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Whether to enforce traffic restrictions based on sources field. If the sources field is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
	// Possible values are: SOURCE_RESTRICTION_UNSPECIFIED, SOURCE_RESTRICTION_ENABLED, SOURCE_RESTRICTION_DISABLED.
	SourceRestriction *string `json:"sourceRestriction,omitempty" tf:"source_restriction,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []EgressFromSourcesInitParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type EgressPoliciesEgressFromObservation struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Whether to enforce traffic restrictions based on sources field. If the sources field is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
	// Possible values are: SOURCE_RESTRICTION_UNSPECIFIED, SOURCE_RESTRICTION_ENABLED, SOURCE_RESTRICTION_DISABLED.
	SourceRestriction *string `json:"sourceRestriction,omitempty" tf:"source_restriction,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []EgressFromSourcesObservation `json:"sources,omitempty" tf:"sources,omitempty"`
}

type EgressPoliciesEgressFromParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +kubebuilder:validation:Optional
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	// +kubebuilder:validation:Optional
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Whether to enforce traffic restrictions based on sources field. If the sources field is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
	// Possible values are: SOURCE_RESTRICTION_UNSPECIFIED, SOURCE_RESTRICTION_ENABLED, SOURCE_RESTRICTION_DISABLED.
	// +kubebuilder:validation:Optional
	SourceRestriction *string `json:"sourceRestriction,omitempty" tf:"source_restriction,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Sources []EgressFromSourcesParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type EgressPoliciesEgressToInitParameters struct {

	// A list of external resources that are allowed to be accessed. A request
	// matches if it contains an external resource in this list (Example:
	// s3://bucket/path). Currently '*' is not allowed.
	// +listType=set
	ExternalResources []*string `json:"externalResources,omitempty" tf:"external_resources,omitempty"`

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []EgressToOperationsInitParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type EgressPoliciesEgressToObservation struct {

	// A list of external resources that are allowed to be accessed. A request
	// matches if it contains an external resource in this list (Example:
	// s3://bucket/path). Currently '*' is not allowed.
	// +listType=set
	ExternalResources []*string `json:"externalResources,omitempty" tf:"external_resources,omitempty"`

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []EgressToOperationsObservation `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type EgressPoliciesEgressToParameters struct {

	// A list of external resources that are allowed to be accessed. A request
	// matches if it contains an external resource in this list (Example:
	// s3://bucket/path). Currently '*' is not allowed.
	// +kubebuilder:validation:Optional
	// +listType=set
	ExternalResources []*string `json:"externalResources,omitempty" tf:"external_resources,omitempty"`

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Operations []EgressToOperationsParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +kubebuilder:validation:Optional
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type EgressPoliciesInitParameters struct {

	// Defines conditions on the source of a request causing this EgressPolicy to apply.
	// Structure is documented below.
	EgressFrom []EgressFromInitParameters `json:"egressFrom,omitempty" tf:"egress_from,omitempty"`

	// Defines the conditions on the ApiOperation and destination resources that
	// cause this EgressPolicy to apply.
	// Structure is documented below.
	EgressTo []EgressToInitParameters `json:"egressTo,omitempty" tf:"egress_to,omitempty"`
}

type EgressPoliciesObservation struct {

	// Defines conditions on the source of a request causing this EgressPolicy to apply.
	// Structure is documented below.
	EgressFrom []EgressFromObservation `json:"egressFrom,omitempty" tf:"egress_from,omitempty"`

	// Defines the conditions on the ApiOperation and destination resources that
	// cause this EgressPolicy to apply.
	// Structure is documented below.
	EgressTo []EgressToObservation `json:"egressTo,omitempty" tf:"egress_to,omitempty"`
}

type EgressPoliciesParameters struct {

	// Defines conditions on the source of a request causing this EgressPolicy to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	EgressFrom []EgressFromParameters `json:"egressFrom,omitempty" tf:"egress_from,omitempty"`

	// Defines the conditions on the ApiOperation and destination resources that
	// cause this EgressPolicy to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	EgressTo []EgressToParameters `json:"egressTo,omitempty" tf:"egress_to,omitempty"`
}

type EgressToInitParameters struct {

	// A list of external resources that are allowed to be accessed. A request
	// matches if it contains an external resource in this list (Example:
	// s3://bucket/path). Currently '*' is not allowed.
	// +listType=set
	ExternalResources []*string `json:"externalResources,omitempty" tf:"external_resources,omitempty"`

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []OperationsInitParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type EgressToObservation struct {

	// A list of external resources that are allowed to be accessed. A request
	// matches if it contains an external resource in this list (Example:
	// s3://bucket/path). Currently '*' is not allowed.
	// +listType=set
	ExternalResources []*string `json:"externalResources,omitempty" tf:"external_resources,omitempty"`

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []OperationsObservation `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type EgressToOperationsInitParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []EgressToOperationsMethodSelectorsInitParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type EgressToOperationsMethodSelectorsInitParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type EgressToOperationsMethodSelectorsObservation struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type EgressToOperationsMethodSelectorsParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	// +kubebuilder:validation:Optional
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	// +kubebuilder:validation:Optional
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type EgressToOperationsObservation struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []EgressToOperationsMethodSelectorsObservation `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type EgressToOperationsParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	MethodSelectors []EgressToOperationsMethodSelectorsParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	// +kubebuilder:validation:Optional
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type EgressToParameters struct {

	// A list of external resources that are allowed to be accessed. A request
	// matches if it contains an external resource in this list (Example:
	// s3://bucket/path). Currently '*' is not allowed.
	// +kubebuilder:validation:Optional
	// +listType=set
	ExternalResources []*string `json:"externalResources,omitempty" tf:"external_resources,omitempty"`

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Operations []OperationsParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +kubebuilder:validation:Optional
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type IngressFromInitParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []IngressFromSourcesInitParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type IngressFromObservation struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []IngressFromSourcesObservation `json:"sources,omitempty" tf:"sources,omitempty"`
}

type IngressFromParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +kubebuilder:validation:Optional
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	// +kubebuilder:validation:Optional
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Sources []IngressFromSourcesParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type IngressFromSourcesInitParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`

	// A Google Cloud resource that is allowed to ingress the perimeter.
	// Requests from these resources will be allowed to access perimeter data.
	// Currently only projects are allowed. Format projects/{project_number}
	// The project may be in any Google Cloud organization, not just the
	// organization that the perimeter is defined in. * is not allowed, the case
	// of allowing all Google Cloud resources only is not supported.
	Resource *string `json:"resource,omitempty" tf:"resource,omitempty"`
}

type IngressFromSourcesObservation struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`

	// A Google Cloud resource that is allowed to ingress the perimeter.
	// Requests from these resources will be allowed to access perimeter data.
	// Currently only projects are allowed. Format projects/{project_number}
	// The project may be in any Google Cloud organization, not just the
	// organization that the perimeter is defined in. * is not allowed, the case
	// of allowing all Google Cloud resources only is not supported.
	Resource *string `json:"resource,omitempty" tf:"resource,omitempty"`
}

type IngressFromSourcesParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	// +kubebuilder:validation:Optional
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`

	// A Google Cloud resource that is allowed to ingress the perimeter.
	// Requests from these resources will be allowed to access perimeter data.
	// Currently only projects are allowed. Format projects/{project_number}
	// The project may be in any Google Cloud organization, not just the
	// organization that the perimeter is defined in. * is not allowed, the case
	// of allowing all Google Cloud resources only is not supported.
	// +kubebuilder:validation:Optional
	Resource *string `json:"resource,omitempty" tf:"resource,omitempty"`
}

type IngressPoliciesIngressFromInitParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []IngressPoliciesIngressFromSourcesInitParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type IngressPoliciesIngressFromObservation struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	Sources []IngressPoliciesIngressFromSourcesObservation `json:"sources,omitempty" tf:"sources,omitempty"`
}

type IngressPoliciesIngressFromParameters struct {

	// A list of identities that are allowed access through this ingress policy.
	// Should be in the format of email address. The email address should represent
	// individual user or service account only.
	// +kubebuilder:validation:Optional
	// +listType=set
	Identities []*string `json:"identities,omitempty" tf:"identities,omitempty"`

	// Specifies the type of identities that are allowed access from outside the
	// perimeter. If left unspecified, then members of identities field will be
	// allowed access.
	// Possible values are: IDENTITY_TYPE_UNSPECIFIED, ANY_IDENTITY, ANY_USER_ACCOUNT, ANY_SERVICE_ACCOUNT.
	// +kubebuilder:validation:Optional
	IdentityType *string `json:"identityType,omitempty" tf:"identity_type,omitempty"`

	// Sources that this IngressPolicy authorizes access from.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Sources []IngressPoliciesIngressFromSourcesParameters `json:"sources,omitempty" tf:"sources,omitempty"`
}

type IngressPoliciesIngressFromSourcesInitParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1.AccessLevel
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("name",false)
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`

	// Reference to a AccessLevel in accesscontextmanager to populate accessLevel.
	// +kubebuilder:validation:Optional
	AccessLevelRef *v1.Reference `json:"accessLevelRef,omitempty" tf:"-"`

	// Selector for a AccessLevel in accesscontextmanager to populate accessLevel.
	// +kubebuilder:validation:Optional
	AccessLevelSelector *v1.Selector `json:"accessLevelSelector,omitempty" tf:"-"`

	// A Google Cloud resource that is allowed to ingress the perimeter.
	// Requests from these resources will be allowed to access perimeter data.
	// Currently only projects are allowed. Format projects/{project_number}
	// The project may be in any Google Cloud organization, not just the
	// organization that the perimeter is defined in. * is not allowed, the case
	// of allowing all Google Cloud resources only is not supported.
	Resource *string `json:"resource,omitempty" tf:"resource,omitempty"`
}

type IngressPoliciesIngressFromSourcesObservation struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`

	// A Google Cloud resource that is allowed to ingress the perimeter.
	// Requests from these resources will be allowed to access perimeter data.
	// Currently only projects are allowed. Format projects/{project_number}
	// The project may be in any Google Cloud organization, not just the
	// organization that the perimeter is defined in. * is not allowed, the case
	// of allowing all Google Cloud resources only is not supported.
	Resource *string `json:"resource,omitempty" tf:"resource,omitempty"`
}

type IngressPoliciesIngressFromSourcesParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1.AccessLevel
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractParamPath("name",false)
	// +kubebuilder:validation:Optional
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`

	// Reference to a AccessLevel in accesscontextmanager to populate accessLevel.
	// +kubebuilder:validation:Optional
	AccessLevelRef *v1.Reference `json:"accessLevelRef,omitempty" tf:"-"`

	// Selector for a AccessLevel in accesscontextmanager to populate accessLevel.
	// +kubebuilder:validation:Optional
	AccessLevelSelector *v1.Selector `json:"accessLevelSelector,omitempty" tf:"-"`

	// A Google Cloud resource that is allowed to ingress the perimeter.
	// Requests from these resources will be allowed to access perimeter data.
	// Currently only projects are allowed. Format projects/{project_number}
	// The project may be in any Google Cloud organization, not just the
	// organization that the perimeter is defined in. * is not allowed, the case
	// of allowing all Google Cloud resources only is not supported.
	// +kubebuilder:validation:Optional
	Resource *string `json:"resource,omitempty" tf:"resource,omitempty"`
}

type IngressPoliciesIngressToInitParameters struct {

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []IngressPoliciesIngressToOperationsInitParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type IngressPoliciesIngressToObservation struct {

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []IngressPoliciesIngressToOperationsObservation `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type IngressPoliciesIngressToOperationsInitParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []IngressToOperationsMethodSelectorsInitParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type IngressPoliciesIngressToOperationsObservation struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []IngressToOperationsMethodSelectorsObservation `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type IngressPoliciesIngressToOperationsParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	MethodSelectors []IngressToOperationsMethodSelectorsParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	// +kubebuilder:validation:Optional
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type IngressPoliciesIngressToParameters struct {

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Operations []IngressPoliciesIngressToOperationsParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +kubebuilder:validation:Optional
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type IngressPoliciesInitParameters struct {

	// Defines the conditions on the source of a request causing this IngressPolicy
	// to apply.
	// Structure is documented below.
	IngressFrom []IngressFromInitParameters `json:"ingressFrom,omitempty" tf:"ingress_from,omitempty"`

	// Defines the conditions on the ApiOperation and request destination that cause
	// this IngressPolicy to apply.
	// Structure is documented below.
	IngressTo []IngressToInitParameters `json:"ingressTo,omitempty" tf:"ingress_to,omitempty"`
}

type IngressPoliciesObservation struct {

	// Defines the conditions on the source of a request causing this IngressPolicy
	// to apply.
	// Structure is documented below.
	IngressFrom []IngressFromObservation `json:"ingressFrom,omitempty" tf:"ingress_from,omitempty"`

	// Defines the conditions on the ApiOperation and request destination that cause
	// this IngressPolicy to apply.
	// Structure is documented below.
	IngressTo []IngressToObservation `json:"ingressTo,omitempty" tf:"ingress_to,omitempty"`
}

type IngressPoliciesParameters struct {

	// Defines the conditions on the source of a request causing this IngressPolicy
	// to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IngressFrom []IngressFromParameters `json:"ingressFrom,omitempty" tf:"ingress_from,omitempty"`

	// Defines the conditions on the ApiOperation and request destination that cause
	// this IngressPolicy to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IngressTo []IngressToParameters `json:"ingressTo,omitempty" tf:"ingress_to,omitempty"`
}

type IngressToInitParameters struct {

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []IngressToOperationsInitParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type IngressToObservation struct {

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	Operations []IngressToOperationsObservation `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type IngressToOperationsInitParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []OperationsMethodSelectorsInitParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type IngressToOperationsMethodSelectorsInitParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type IngressToOperationsMethodSelectorsObservation struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type IngressToOperationsMethodSelectorsParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	// +kubebuilder:validation:Optional
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	// +kubebuilder:validation:Optional
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type IngressToOperationsObservation struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []OperationsMethodSelectorsObservation `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type IngressToOperationsParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	MethodSelectors []OperationsMethodSelectorsParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	// +kubebuilder:validation:Optional
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type IngressToParameters struct {

	// A list of ApiOperations the sources specified in corresponding IngressFrom
	// are allowed to perform in this ServicePerimeter.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Operations []IngressToOperationsParameters `json:"operations,omitempty" tf:"operations,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +kubebuilder:validation:Optional
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`
}

type MethodSelectorsInitParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type MethodSelectorsObservation struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type MethodSelectorsParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	// +kubebuilder:validation:Optional
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	// +kubebuilder:validation:Optional
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type OperationsInitParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []MethodSelectorsInitParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type OperationsMethodSelectorsInitParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type OperationsMethodSelectorsObservation struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type OperationsMethodSelectorsParameters struct {

	// Value for method should be a valid method name for the corresponding
	// serviceName in ApiOperation. If * used as value for method, then
	// ALL methods and permissions are allowed.
	// +kubebuilder:validation:Optional
	Method *string `json:"method,omitempty" tf:"method,omitempty"`

	// Value for permission should be a valid Cloud IAM permission for the
	// corresponding serviceName in ApiOperation.
	// +kubebuilder:validation:Optional
	Permission *string `json:"permission,omitempty" tf:"permission,omitempty"`
}

type OperationsObservation struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	MethodSelectors []MethodSelectorsObservation `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type OperationsParameters struct {

	// API methods or permissions to allow. Method or permission must belong to
	// the service specified by serviceName field. A single MethodSelector entry
	// with * specified for the method field will allow all methods AND
	// permissions for the service specified in serviceName.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	MethodSelectors []MethodSelectorsParameters `json:"methodSelectors,omitempty" tf:"method_selectors,omitempty"`

	// The name of the API whose methods or permissions the IngressPolicy or
	// EgressPolicy want to allow. A single ApiOperation with serviceName
	// field set to * will allow all methods AND permissions for all services.
	// +kubebuilder:validation:Optional
	ServiceName *string `json:"serviceName,omitempty" tf:"service_name,omitempty"`
}

type ServicePerimeterInitParameters struct {

	// Description of the ServicePerimeter and its use. Does not affect
	// behavior.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Resource name for the ServicePerimeter. The short_name component must
	// begin with a letter and only include alphanumeric and '_'.
	// Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// The AccessPolicy this ServicePerimeter lives in.
	// Format: accessPolicies/{policy_id}
	Parent *string `json:"parent,omitempty" tf:"parent,omitempty"`

	// Specifies the type of the Perimeter. There are two types: regular and
	// bridge. Regular Service Perimeter contains resources, access levels,
	// and restricted services. Every resource can be in at most
	// ONE regular Service Perimeter.
	// In addition to being in a regular service perimeter, a resource can also
	// be in zero or more perimeter bridges. A perimeter bridge only contains
	// resources. Cross project operations are permitted if all effected
	// resources share some perimeter (whether bridge or regular). Perimeter
	// Bridge does not contain access levels or services: those are governed
	// entirely by the regular perimeter that resource is in.
	// Perimeter Bridges are typically useful when building more complex
	// topologies with many independent perimeters that need to share some data
	// with a common perimeter, but should not be able to share data among
	// themselves.
	// Default value is PERIMETER_TYPE_REGULAR.
	// Possible values are: PERIMETER_TYPE_REGULAR, PERIMETER_TYPE_BRIDGE.
	PerimeterType *string `json:"perimeterType,omitempty" tf:"perimeter_type,omitempty"`

	// Proposed (or dry run) ServicePerimeter configuration.
	// This configuration allows to specify and test ServicePerimeter configuration
	// without enforcing actual access restrictions. Only allowed to be set when
	// the useExplicitDryRunSpec flag is set.
	// Structure is documented below.
	Spec []SpecInitParameters `json:"spec,omitempty" tf:"spec,omitempty"`

	// ServicePerimeter configuration. Specifies sets of resources,
	// restricted services and access levels that determine
	// perimeter content and boundaries.
	// Structure is documented below.
	Status []StatusInitParameters `json:"status,omitempty" tf:"status,omitempty"`

	// Human readable title. Must be unique within the Policy.
	Title *string `json:"title,omitempty" tf:"title,omitempty"`

	// Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists
	// for all Service Perimeters, and that spec is identical to the status for those
	// Service Perimeters. When this flag is set, it inhibits the generation of the
	// implicit spec, thereby allowing the user to explicitly provide a
	// configuration ("spec") to use in a dry-run version of the Service Perimeter.
	// This allows the user to test changes to the enforced config ("status") without
	// actually enforcing them. This testing is done through analyzing the differences
	// between currently enforced and suggested restrictions. useExplicitDryRunSpec must
	// bet set to True if any of the fields in the spec are set to non-default values.
	UseExplicitDryRunSpec *bool `json:"useExplicitDryRunSpec,omitempty" tf:"use_explicit_dry_run_spec,omitempty"`
}

type ServicePerimeterObservation struct {

	// Time the AccessPolicy was created in UTC.
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// Description of the ServicePerimeter and its use. Does not affect
	// behavior.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// an identifier for the resource with format {{name}}
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Resource name for the ServicePerimeter. The short_name component must
	// begin with a letter and only include alphanumeric and '_'.
	// Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// The AccessPolicy this ServicePerimeter lives in.
	// Format: accessPolicies/{policy_id}
	Parent *string `json:"parent,omitempty" tf:"parent,omitempty"`

	// Specifies the type of the Perimeter. There are two types: regular and
	// bridge. Regular Service Perimeter contains resources, access levels,
	// and restricted services. Every resource can be in at most
	// ONE regular Service Perimeter.
	// In addition to being in a regular service perimeter, a resource can also
	// be in zero or more perimeter bridges. A perimeter bridge only contains
	// resources. Cross project operations are permitted if all effected
	// resources share some perimeter (whether bridge or regular). Perimeter
	// Bridge does not contain access levels or services: those are governed
	// entirely by the regular perimeter that resource is in.
	// Perimeter Bridges are typically useful when building more complex
	// topologies with many independent perimeters that need to share some data
	// with a common perimeter, but should not be able to share data among
	// themselves.
	// Default value is PERIMETER_TYPE_REGULAR.
	// Possible values are: PERIMETER_TYPE_REGULAR, PERIMETER_TYPE_BRIDGE.
	PerimeterType *string `json:"perimeterType,omitempty" tf:"perimeter_type,omitempty"`

	// Proposed (or dry run) ServicePerimeter configuration.
	// This configuration allows to specify and test ServicePerimeter configuration
	// without enforcing actual access restrictions. Only allowed to be set when
	// the useExplicitDryRunSpec flag is set.
	// Structure is documented below.
	Spec []SpecObservation `json:"spec,omitempty" tf:"spec,omitempty"`

	// ServicePerimeter configuration. Specifies sets of resources,
	// restricted services and access levels that determine
	// perimeter content and boundaries.
	// Structure is documented below.
	Status []StatusObservation `json:"status,omitempty" tf:"status,omitempty"`

	// Human readable title. Must be unique within the Policy.
	Title *string `json:"title,omitempty" tf:"title,omitempty"`

	// Time the AccessPolicy was updated in UTC.
	UpdateTime *string `json:"updateTime,omitempty" tf:"update_time,omitempty"`

	// Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists
	// for all Service Perimeters, and that spec is identical to the status for those
	// Service Perimeters. When this flag is set, it inhibits the generation of the
	// implicit spec, thereby allowing the user to explicitly provide a
	// configuration ("spec") to use in a dry-run version of the Service Perimeter.
	// This allows the user to test changes to the enforced config ("status") without
	// actually enforcing them. This testing is done through analyzing the differences
	// between currently enforced and suggested restrictions. useExplicitDryRunSpec must
	// bet set to True if any of the fields in the spec are set to non-default values.
	UseExplicitDryRunSpec *bool `json:"useExplicitDryRunSpec,omitempty" tf:"use_explicit_dry_run_spec,omitempty"`
}

type ServicePerimeterParameters struct {

	// Description of the ServicePerimeter and its use. Does not affect
	// behavior.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Resource name for the ServicePerimeter. The short_name component must
	// begin with a letter and only include alphanumeric and '_'.
	// Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// The AccessPolicy this ServicePerimeter lives in.
	// Format: accessPolicies/{policy_id}
	// +kubebuilder:validation:Optional
	Parent *string `json:"parent,omitempty" tf:"parent,omitempty"`

	// Specifies the type of the Perimeter. There are two types: regular and
	// bridge. Regular Service Perimeter contains resources, access levels,
	// and restricted services. Every resource can be in at most
	// ONE regular Service Perimeter.
	// In addition to being in a regular service perimeter, a resource can also
	// be in zero or more perimeter bridges. A perimeter bridge only contains
	// resources. Cross project operations are permitted if all effected
	// resources share some perimeter (whether bridge or regular). Perimeter
	// Bridge does not contain access levels or services: those are governed
	// entirely by the regular perimeter that resource is in.
	// Perimeter Bridges are typically useful when building more complex
	// topologies with many independent perimeters that need to share some data
	// with a common perimeter, but should not be able to share data among
	// themselves.
	// Default value is PERIMETER_TYPE_REGULAR.
	// Possible values are: PERIMETER_TYPE_REGULAR, PERIMETER_TYPE_BRIDGE.
	// +kubebuilder:validation:Optional
	PerimeterType *string `json:"perimeterType,omitempty" tf:"perimeter_type,omitempty"`

	// Proposed (or dry run) ServicePerimeter configuration.
	// This configuration allows to specify and test ServicePerimeter configuration
	// without enforcing actual access restrictions. Only allowed to be set when
	// the useExplicitDryRunSpec flag is set.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Spec []SpecParameters `json:"spec,omitempty" tf:"spec,omitempty"`

	// ServicePerimeter configuration. Specifies sets of resources,
	// restricted services and access levels that determine
	// perimeter content and boundaries.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	Status []StatusParameters `json:"status,omitempty" tf:"status,omitempty"`

	// Human readable title. Must be unique within the Policy.
	// +kubebuilder:validation:Optional
	Title *string `json:"title,omitempty" tf:"title,omitempty"`

	// Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists
	// for all Service Perimeters, and that spec is identical to the status for those
	// Service Perimeters. When this flag is set, it inhibits the generation of the
	// implicit spec, thereby allowing the user to explicitly provide a
	// configuration ("spec") to use in a dry-run version of the Service Perimeter.
	// This allows the user to test changes to the enforced config ("status") without
	// actually enforcing them. This testing is done through analyzing the differences
	// between currently enforced and suggested restrictions. useExplicitDryRunSpec must
	// bet set to True if any of the fields in the spec are set to non-default values.
	// +kubebuilder:validation:Optional
	UseExplicitDryRunSpec *bool `json:"useExplicitDryRunSpec,omitempty" tf:"use_explicit_dry_run_spec,omitempty"`
}

type SourcesInitParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`
}

type SourcesObservation struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`
}

type SourcesParameters struct {

	// An AccessLevel resource name that allow resources within the
	// ServicePerimeters to be accessed from the internet. AccessLevels listed
	// must be in the same policy as this ServicePerimeter. Referencing a nonexistent
	// AccessLevel will cause an error. If no AccessLevel names are listed,
	// resources within the perimeter can only be accessed via Google Cloud calls
	// with request origins within the perimeter.
	// Example accessPolicies/MY_POLICY/accessLevels/MY_LEVEL.
	// If * is specified, then all IngressSources will be allowed.
	// +kubebuilder:validation:Optional
	AccessLevel *string `json:"accessLevel,omitempty" tf:"access_level,omitempty"`
}

type SpecInitParameters struct {

	// A list of AccessLevel resource names that allow resources within
	// the ServicePerimeter to be accessed from the internet.
	// AccessLevels listed must be in the same policy as this
	// ServicePerimeter. Referencing a nonexistent AccessLevel is a
	// syntax error. If no AccessLevel names are listed, resources within
	// the perimeter can only be accessed via GCP calls with request
	// origins within the perimeter. For Service Perimeter Bridge, must
	// be empty.
	// Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1.AccessLevel
	// +listType=set
	AccessLevels []*string `json:"accessLevels,omitempty" tf:"access_levels,omitempty"`

	// References to AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsRefs []v1.Reference `json:"accessLevelsRefs,omitempty" tf:"-"`

	// Selector for a list of AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsSelector *v1.Selector `json:"accessLevelsSelector,omitempty" tf:"-"`

	// List of EgressPolicies to apply to the perimeter. A perimeter may
	// have multiple EgressPolicies, each of which is evaluated separately.
	// Access is granted if any EgressPolicy grants it. Must be empty for
	// a perimeter bridge.
	// Structure is documented below.
	EgressPolicies []EgressPoliciesInitParameters `json:"egressPolicies,omitempty" tf:"egress_policies,omitempty"`

	// List of IngressPolicies to apply to the perimeter. A perimeter may
	// have multiple IngressPolicies, each of which is evaluated
	// separately. Access is granted if any Ingress Policy grants it.
	// Must be empty for a perimeter bridge.
	// Structure is documented below.
	IngressPolicies []IngressPoliciesInitParameters `json:"ingressPolicies,omitempty" tf:"ingress_policies,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`

	// GCP services that are subject to the Service Perimeter
	// restrictions. Must contain a list of services. For example, if
	// storage.googleapis.com is specified, access to the storage
	// buckets inside the perimeter must meet the perimeter's access
	// restrictions.
	// +listType=set
	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`

	// Specifies how APIs are allowed to communicate within the Service
	// Perimeter.
	// Structure is documented below.
	VPCAccessibleServices []VPCAccessibleServicesInitParameters `json:"vpcAccessibleServices,omitempty" tf:"vpc_accessible_services,omitempty"`
}

type SpecObservation struct {

	// A list of AccessLevel resource names that allow resources within
	// the ServicePerimeter to be accessed from the internet.
	// AccessLevels listed must be in the same policy as this
	// ServicePerimeter. Referencing a nonexistent AccessLevel is a
	// syntax error. If no AccessLevel names are listed, resources within
	// the perimeter can only be accessed via GCP calls with request
	// origins within the perimeter. For Service Perimeter Bridge, must
	// be empty.
	// Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
	// +listType=set
	AccessLevels []*string `json:"accessLevels,omitempty" tf:"access_levels,omitempty"`

	// List of EgressPolicies to apply to the perimeter. A perimeter may
	// have multiple EgressPolicies, each of which is evaluated separately.
	// Access is granted if any EgressPolicy grants it. Must be empty for
	// a perimeter bridge.
	// Structure is documented below.
	EgressPolicies []EgressPoliciesObservation `json:"egressPolicies,omitempty" tf:"egress_policies,omitempty"`

	// List of IngressPolicies to apply to the perimeter. A perimeter may
	// have multiple IngressPolicies, each of which is evaluated
	// separately. Access is granted if any Ingress Policy grants it.
	// Must be empty for a perimeter bridge.
	// Structure is documented below.
	IngressPolicies []IngressPoliciesObservation `json:"ingressPolicies,omitempty" tf:"ingress_policies,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`

	// GCP services that are subject to the Service Perimeter
	// restrictions. Must contain a list of services. For example, if
	// storage.googleapis.com is specified, access to the storage
	// buckets inside the perimeter must meet the perimeter's access
	// restrictions.
	// +listType=set
	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`

	// Specifies how APIs are allowed to communicate within the Service
	// Perimeter.
	// Structure is documented below.
	VPCAccessibleServices []VPCAccessibleServicesObservation `json:"vpcAccessibleServices,omitempty" tf:"vpc_accessible_services,omitempty"`
}

type SpecParameters struct {

	// A list of AccessLevel resource names that allow resources within
	// the ServicePerimeter to be accessed from the internet.
	// AccessLevels listed must be in the same policy as this
	// ServicePerimeter. Referencing a nonexistent AccessLevel is a
	// syntax error. If no AccessLevel names are listed, resources within
	// the perimeter can only be accessed via GCP calls with request
	// origins within the perimeter. For Service Perimeter Bridge, must
	// be empty.
	// Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1.AccessLevel
	// +kubebuilder:validation:Optional
	// +listType=set
	AccessLevels []*string `json:"accessLevels,omitempty" tf:"access_levels,omitempty"`

	// References to AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsRefs []v1.Reference `json:"accessLevelsRefs,omitempty" tf:"-"`

	// Selector for a list of AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsSelector *v1.Selector `json:"accessLevelsSelector,omitempty" tf:"-"`

	// List of EgressPolicies to apply to the perimeter. A perimeter may
	// have multiple EgressPolicies, each of which is evaluated separately.
	// Access is granted if any EgressPolicy grants it. Must be empty for
	// a perimeter bridge.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	EgressPolicies []EgressPoliciesParameters `json:"egressPolicies,omitempty" tf:"egress_policies,omitempty"`

	// List of IngressPolicies to apply to the perimeter. A perimeter may
	// have multiple IngressPolicies, each of which is evaluated
	// separately. Access is granted if any Ingress Policy grants it.
	// Must be empty for a perimeter bridge.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IngressPolicies []IngressPoliciesParameters `json:"ingressPolicies,omitempty" tf:"ingress_policies,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +kubebuilder:validation:Optional
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`

	// GCP services that are subject to the Service Perimeter
	// restrictions. Must contain a list of services. For example, if
	// storage.googleapis.com is specified, access to the storage
	// buckets inside the perimeter must meet the perimeter's access
	// restrictions.
	// +kubebuilder:validation:Optional
	// +listType=set
	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`

	// Specifies how APIs are allowed to communicate within the Service
	// Perimeter.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	VPCAccessibleServices []VPCAccessibleServicesParameters `json:"vpcAccessibleServices,omitempty" tf:"vpc_accessible_services,omitempty"`
}

type StatusEgressPoliciesInitParameters struct {

	// Defines conditions on the source of a request causing this EgressPolicy to apply.
	// Structure is documented below.
	EgressFrom []EgressPoliciesEgressFromInitParameters `json:"egressFrom,omitempty" tf:"egress_from,omitempty"`

	// Defines the conditions on the ApiOperation and destination resources that
	// cause this EgressPolicy to apply.
	// Structure is documented below.
	EgressTo []EgressPoliciesEgressToInitParameters `json:"egressTo,omitempty" tf:"egress_to,omitempty"`
}

type StatusEgressPoliciesObservation struct {

	// Defines conditions on the source of a request causing this EgressPolicy to apply.
	// Structure is documented below.
	EgressFrom []EgressPoliciesEgressFromObservation `json:"egressFrom,omitempty" tf:"egress_from,omitempty"`

	// Defines the conditions on the ApiOperation and destination resources that
	// cause this EgressPolicy to apply.
	// Structure is documented below.
	EgressTo []EgressPoliciesEgressToObservation `json:"egressTo,omitempty" tf:"egress_to,omitempty"`
}

type StatusEgressPoliciesParameters struct {

	// Defines conditions on the source of a request causing this EgressPolicy to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	EgressFrom []EgressPoliciesEgressFromParameters `json:"egressFrom,omitempty" tf:"egress_from,omitempty"`

	// Defines the conditions on the ApiOperation and destination resources that
	// cause this EgressPolicy to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	EgressTo []EgressPoliciesEgressToParameters `json:"egressTo,omitempty" tf:"egress_to,omitempty"`
}

type StatusIngressPoliciesInitParameters struct {

	// Defines the conditions on the source of a request causing this IngressPolicy
	// to apply.
	// Structure is documented below.
	IngressFrom []IngressPoliciesIngressFromInitParameters `json:"ingressFrom,omitempty" tf:"ingress_from,omitempty"`

	// Defines the conditions on the ApiOperation and request destination that cause
	// this IngressPolicy to apply.
	// Structure is documented below.
	IngressTo []IngressPoliciesIngressToInitParameters `json:"ingressTo,omitempty" tf:"ingress_to,omitempty"`
}

type StatusIngressPoliciesObservation struct {

	// Defines the conditions on the source of a request causing this IngressPolicy
	// to apply.
	// Structure is documented below.
	IngressFrom []IngressPoliciesIngressFromObservation `json:"ingressFrom,omitempty" tf:"ingress_from,omitempty"`

	// Defines the conditions on the ApiOperation and request destination that cause
	// this IngressPolicy to apply.
	// Structure is documented below.
	IngressTo []IngressPoliciesIngressToObservation `json:"ingressTo,omitempty" tf:"ingress_to,omitempty"`
}

type StatusIngressPoliciesParameters struct {

	// Defines the conditions on the source of a request causing this IngressPolicy
	// to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IngressFrom []IngressPoliciesIngressFromParameters `json:"ingressFrom,omitempty" tf:"ingress_from,omitempty"`

	// Defines the conditions on the ApiOperation and request destination that cause
	// this IngressPolicy to apply.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IngressTo []IngressPoliciesIngressToParameters `json:"ingressTo,omitempty" tf:"ingress_to,omitempty"`
}

type StatusInitParameters struct {

	// A list of AccessLevel resource names that allow resources within
	// the ServicePerimeter to be accessed from the internet.
	// AccessLevels listed must be in the same policy as this
	// ServicePerimeter. Referencing a nonexistent AccessLevel is a
	// syntax error. If no AccessLevel names are listed, resources within
	// the perimeter can only be accessed via GCP calls with request
	// origins within the perimeter. For Service Perimeter Bridge, must
	// be empty.
	// Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1.AccessLevel
	// +listType=set
	AccessLevels []*string `json:"accessLevels,omitempty" tf:"access_levels,omitempty"`

	// References to AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsRefs []v1.Reference `json:"accessLevelsRefs,omitempty" tf:"-"`

	// Selector for a list of AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsSelector *v1.Selector `json:"accessLevelsSelector,omitempty" tf:"-"`

	// List of EgressPolicies to apply to the perimeter. A perimeter may
	// have multiple EgressPolicies, each of which is evaluated separately.
	// Access is granted if any EgressPolicy grants it. Must be empty for
	// a perimeter bridge.
	// Structure is documented below.
	EgressPolicies []StatusEgressPoliciesInitParameters `json:"egressPolicies,omitempty" tf:"egress_policies,omitempty"`

	// List of IngressPolicies to apply to the perimeter. A perimeter may
	// have multiple IngressPolicies, each of which is evaluated
	// separately. Access is granted if any Ingress Policy grants it.
	// Must be empty for a perimeter bridge.
	// Structure is documented below.
	IngressPolicies []StatusIngressPoliciesInitParameters `json:"ingressPolicies,omitempty" tf:"ingress_policies,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`

	// GCP services that are subject to the Service Perimeter
	// restrictions. Must contain a list of services. For example, if
	// storage.googleapis.com is specified, access to the storage
	// buckets inside the perimeter must meet the perimeter's access
	// restrictions.
	// +listType=set
	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`

	// Specifies how APIs are allowed to communicate within the Service
	// Perimeter.
	// Structure is documented below.
	VPCAccessibleServices []StatusVPCAccessibleServicesInitParameters `json:"vpcAccessibleServices,omitempty" tf:"vpc_accessible_services,omitempty"`
}

type StatusObservation struct {

	// A list of AccessLevel resource names that allow resources within
	// the ServicePerimeter to be accessed from the internet.
	// AccessLevels listed must be in the same policy as this
	// ServicePerimeter. Referencing a nonexistent AccessLevel is a
	// syntax error. If no AccessLevel names are listed, resources within
	// the perimeter can only be accessed via GCP calls with request
	// origins within the perimeter. For Service Perimeter Bridge, must
	// be empty.
	// Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
	// +listType=set
	AccessLevels []*string `json:"accessLevels,omitempty" tf:"access_levels,omitempty"`

	// List of EgressPolicies to apply to the perimeter. A perimeter may
	// have multiple EgressPolicies, each of which is evaluated separately.
	// Access is granted if any EgressPolicy grants it. Must be empty for
	// a perimeter bridge.
	// Structure is documented below.
	EgressPolicies []StatusEgressPoliciesObservation `json:"egressPolicies,omitempty" tf:"egress_policies,omitempty"`

	// List of IngressPolicies to apply to the perimeter. A perimeter may
	// have multiple IngressPolicies, each of which is evaluated
	// separately. Access is granted if any Ingress Policy grants it.
	// Must be empty for a perimeter bridge.
	// Structure is documented below.
	IngressPolicies []StatusIngressPoliciesObservation `json:"ingressPolicies,omitempty" tf:"ingress_policies,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`

	// GCP services that are subject to the Service Perimeter
	// restrictions. Must contain a list of services. For example, if
	// storage.googleapis.com is specified, access to the storage
	// buckets inside the perimeter must meet the perimeter's access
	// restrictions.
	// +listType=set
	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`

	// Specifies how APIs are allowed to communicate within the Service
	// Perimeter.
	// Structure is documented below.
	VPCAccessibleServices []StatusVPCAccessibleServicesObservation `json:"vpcAccessibleServices,omitempty" tf:"vpc_accessible_services,omitempty"`
}

type StatusParameters struct {

	// A list of AccessLevel resource names that allow resources within
	// the ServicePerimeter to be accessed from the internet.
	// AccessLevels listed must be in the same policy as this
	// ServicePerimeter. Referencing a nonexistent AccessLevel is a
	// syntax error. If no AccessLevel names are listed, resources within
	// the perimeter can only be accessed via GCP calls with request
	// origins within the perimeter. For Service Perimeter Bridge, must
	// be empty.
	// Format: accessPolicies/{policy_id}/accessLevels/{access_level_name}
	// +crossplane:generate:reference:type=github.com/upbound/provider-gcp/apis/accesscontextmanager/v1beta1.AccessLevel
	// +kubebuilder:validation:Optional
	// +listType=set
	AccessLevels []*string `json:"accessLevels,omitempty" tf:"access_levels,omitempty"`

	// References to AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsRefs []v1.Reference `json:"accessLevelsRefs,omitempty" tf:"-"`

	// Selector for a list of AccessLevel in accesscontextmanager to populate accessLevels.
	// +kubebuilder:validation:Optional
	AccessLevelsSelector *v1.Selector `json:"accessLevelsSelector,omitempty" tf:"-"`

	// List of EgressPolicies to apply to the perimeter. A perimeter may
	// have multiple EgressPolicies, each of which is evaluated separately.
	// Access is granted if any EgressPolicy grants it. Must be empty for
	// a perimeter bridge.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	EgressPolicies []StatusEgressPoliciesParameters `json:"egressPolicies,omitempty" tf:"egress_policies,omitempty"`

	// List of IngressPolicies to apply to the perimeter. A perimeter may
	// have multiple IngressPolicies, each of which is evaluated
	// separately. Access is granted if any Ingress Policy grants it.
	// Must be empty for a perimeter bridge.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	IngressPolicies []StatusIngressPoliciesParameters `json:"ingressPolicies,omitempty" tf:"ingress_policies,omitempty"`

	// A list of GCP resources that are inside of the service perimeter.
	// Currently only projects are allowed.
	// Format: projects/{project_number}
	// +kubebuilder:validation:Optional
	// +listType=set
	Resources []*string `json:"resources,omitempty" tf:"resources,omitempty"`

	// GCP services that are subject to the Service Perimeter
	// restrictions. Must contain a list of services. For example, if
	// storage.googleapis.com is specified, access to the storage
	// buckets inside the perimeter must meet the perimeter's access
	// restrictions.
	// +kubebuilder:validation:Optional
	// +listType=set
	RestrictedServices []*string `json:"restrictedServices,omitempty" tf:"restricted_services,omitempty"`

	// Specifies how APIs are allowed to communicate within the Service
	// Perimeter.
	// Structure is documented below.
	// +kubebuilder:validation:Optional
	VPCAccessibleServices []StatusVPCAccessibleServicesParameters `json:"vpcAccessibleServices,omitempty" tf:"vpc_accessible_services,omitempty"`
}

type StatusVPCAccessibleServicesInitParameters struct {

	// The list of APIs usable within the Service Perimeter.
	// Must be empty unless enableRestriction is True.
	// +listType=set
	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`

	// Whether to restrict API calls within the Service Perimeter to the
	// list of APIs specified in 'allowedServices'.
	EnableRestriction *bool `json:"enableRestriction,omitempty" tf:"enable_restriction,omitempty"`
}

type StatusVPCAccessibleServicesObservation struct {

	// The list of APIs usable within the Service Perimeter.
	// Must be empty unless enableRestriction is True.
	// +listType=set
	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`

	// Whether to restrict API calls within the Service Perimeter to the
	// list of APIs specified in 'allowedServices'.
	EnableRestriction *bool `json:"enableRestriction,omitempty" tf:"enable_restriction,omitempty"`
}

type StatusVPCAccessibleServicesParameters struct {

	// The list of APIs usable within the Service Perimeter.
	// Must be empty unless enableRestriction is True.
	// +kubebuilder:validation:Optional
	// +listType=set
	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`

	// Whether to restrict API calls within the Service Perimeter to the
	// list of APIs specified in 'allowedServices'.
	// +kubebuilder:validation:Optional
	EnableRestriction *bool `json:"enableRestriction,omitempty" tf:"enable_restriction,omitempty"`
}

type VPCAccessibleServicesInitParameters struct {

	// The list of APIs usable within the Service Perimeter.
	// Must be empty unless enableRestriction is True.
	// +listType=set
	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`

	// Whether to restrict API calls within the Service Perimeter to the
	// list of APIs specified in 'allowedServices'.
	EnableRestriction *bool `json:"enableRestriction,omitempty" tf:"enable_restriction,omitempty"`
}

type VPCAccessibleServicesObservation struct {

	// The list of APIs usable within the Service Perimeter.
	// Must be empty unless enableRestriction is True.
	// +listType=set
	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`

	// Whether to restrict API calls within the Service Perimeter to the
	// list of APIs specified in 'allowedServices'.
	EnableRestriction *bool `json:"enableRestriction,omitempty" tf:"enable_restriction,omitempty"`
}

type VPCAccessibleServicesParameters struct {

	// The list of APIs usable within the Service Perimeter.
	// Must be empty unless enableRestriction is True.
	// +kubebuilder:validation:Optional
	// +listType=set
	AllowedServices []*string `json:"allowedServices,omitempty" tf:"allowed_services,omitempty"`

	// Whether to restrict API calls within the Service Perimeter to the
	// list of APIs specified in 'allowedServices'.
	// +kubebuilder:validation:Optional
	EnableRestriction *bool `json:"enableRestriction,omitempty" tf:"enable_restriction,omitempty"`
}

// ServicePerimeterSpec defines the desired state of ServicePerimeter
type ServicePerimeterSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     ServicePerimeterParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider ServicePerimeterInitParameters `json:"initProvider,omitempty"`
}

// ServicePerimeterStatus defines the observed state of ServicePerimeter.
type ServicePerimeterStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        ServicePerimeterObservation `json:"atProvider,omitempty"`
}

// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
// +kubebuilder:storageversion

// ServicePerimeter is the Schema for the ServicePerimeters API. ServicePerimeter describes a set of GCP resources which can freely import and export data amongst themselves, but not export outside of the ServicePerimeter.
// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,gcp}
type ServicePerimeter struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || (has(self.initProvider) && has(self.initProvider.name))",message="spec.forProvider.name is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.parent) || (has(self.initProvider) && has(self.initProvider.parent))",message="spec.forProvider.parent is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.title) || (has(self.initProvider) && has(self.initProvider.title))",message="spec.forProvider.title is a required parameter"
	Spec   ServicePerimeterSpec   `json:"spec"`
	Status ServicePerimeterStatus `json:"status,omitempty"`
}

// +kubebuilder:object:root=true

// ServicePerimeterList contains a list of ServicePerimeters
type ServicePerimeterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ServicePerimeter `json:"items"`
}

// Repository type metadata.
var (
	ServicePerimeter_Kind             = "ServicePerimeter"
	ServicePerimeter_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: ServicePerimeter_Kind}.String()
	ServicePerimeter_KindAPIVersion   = ServicePerimeter_Kind + "." + CRDGroupVersion.String()
	ServicePerimeter_GroupVersionKind = CRDGroupVersion.WithKind(ServicePerimeter_Kind)
)

func init() {
	SchemeBuilder.Register(&ServicePerimeter{}, &ServicePerimeterList{})
}