Class: Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint

Inherits:

Object

• Object
• Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint

Extended by:

Protobuf::MessageExts::ClassMethods

Includes:

Protobuf::MessageExts

Defined in:

proto_docs/google/cloud/asset/v1/asset_service.rb

Overview

The organization policy constraint definition.

Defined Under Namespace

Classes: Constraint, CustomConstraint

Instance Attribute Summary

• #custom_constraint ⇒ ::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint

  The definition of the custom constraint.

• #google_defined_constraint ⇒ ::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint

  The definition of the canned constraint defined by Google.

Instance Attribute Details

#custom_constraint ⇒ ::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint

Returns The definition of the custom constraint.

Returns:

• (::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint) —

  The definition of the custom constraint.

# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 2022

class AnalyzerOrgPolicyConstraint
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # The definition of a constraint.
  # @!attribute [rw] name
  #   @return [::String]
  #     The unique name of the constraint. Format of the name should be
  #     * `constraints/{constraint_name}`
  #
  #     For example, `constraints/compute.disableSerialPortAccess`.
  # @!attribute [rw] display_name
  #   @return [::String]
  #     The human readable name of the constraint.
  # @!attribute [rw] description
  #   @return [::String]
  #     Detailed description of what this `Constraint` controls as well as how
  #     and where it is enforced.
  # @!attribute [rw] constraint_default
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint::ConstraintDefault]
  #     The evaluation behavior of this constraint in the absence of 'Policy'.
  # @!attribute [rw] list_constraint
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint::ListConstraint]
  #     Defines this constraint as being a ListConstraint.
  # @!attribute [rw] boolean_constraint
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint::BooleanConstraint]
  #     Defines this constraint as being a BooleanConstraint.
  class Constraint
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # A `Constraint` that allows or disallows a list of string values, which
    # are configured by an organization's policy administrator with a `Policy`.
    # @!attribute [rw] supports_in
    #   @return [::Boolean]
    #     Indicates whether values grouped into categories can be used in
    #     `Policy.allowed_values` and `Policy.denied_values`. For example,
    #     `"in:Python"` would match any value in the 'Python' group.
    # @!attribute [rw] supports_under
    #   @return [::Boolean]
    #     Indicates whether subtrees of Cloud Resource Manager resource hierarchy
    #     can be used in `Policy.allowed_values` and `Policy.denied_values`. For
    #     example, `"under:folders/123"` would match any resource under the
    #     'folders/123' folder.
    class ListConstraint
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # A `Constraint` that is either enforced or not.
    #
    # For example a constraint `constraints/compute.disableSerialPortAccess`.
    # If it is enforced on a VM instance, serial port connections will not be
    # opened to that instance.
    class BooleanConstraint
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Specifies the default behavior in the absence of any `Policy` for the
    # `Constraint`. This must not be `CONSTRAINT_DEFAULT_UNSPECIFIED`.
    module ConstraintDefault
      # This is only used for distinguishing unset values and should never be
      # used.
      CONSTRAINT_DEFAULT_UNSPECIFIED = 0

      # Indicate that all values are allowed for list constraints.
      # Indicate that enforcement is off for boolean constraints.
      ALLOW = 1

      # Indicate that all values are denied for list constraints.
      # Indicate that enforcement is on for boolean constraints.
      DENY = 2
    end
  end

  # The definition of a custom constraint.
  # @!attribute [rw] name
  #   @return [::String]
  #     Name of the constraint. This is unique within the organization. Format of
  #     the name should be
  #     * `organizations/{organization_id}/customConstraints/{custom_constraint_id}`
  #
  #     Example :
  #     "organizations/123/customConstraints/custom.createOnlyE2TypeVms"
  # @!attribute [rw] resource_types
  #   @return [::Array<::String>]
  #     The Resource Instance type on which this policy applies to. Format will
  #     be of the form : "<canonical service name>/<type>" Example:
  #      * `compute.googleapis.com/Instance`.
  # @!attribute [rw] method_types
  #   @return [::Array<::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint::MethodType>]
  #     All the operations being applied for this constraint.
  # @!attribute [rw] condition
  #   @return [::String]
  #     Organization Policy condition/expression. For example:
  #     `resource.instanceName.matches("[production|test]_.*_(\d)+")'` or,
  #     `resource.management.auto_upgrade == true`
  # @!attribute [rw] action_type
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint::ActionType]
  #     Allow or deny type.
  # @!attribute [rw] display_name
  #   @return [::String]
  #     One line display name for the UI.
  # @!attribute [rw] description
  #   @return [::String]
  #     Detailed information about this custom policy constraint.
  class CustomConstraint
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # The operation in which this constraint will be applied. For example:
    # If the constraint applies only when create VMs, the method_types will be
    # "CREATE" only. If the constraint applied when create or delete VMs, the
    # method_types will be "CREATE" and "DELETE".
    module MethodType
      # Unspecified. Will results in user error.
      METHOD_TYPE_UNSPECIFIED = 0

      # Constraint applied when creating the resource.
      CREATE = 1

      # Constraint applied when updating the resource.
      UPDATE = 2

      # Constraint applied when deleting the resource.
      DELETE = 3
    end

    # Allow or deny type.
    module ActionType
      # Unspecified. Will results in user error.
      ACTION_TYPE_UNSPECIFIED = 0

      # Allowed action type.
      ALLOW = 1

      # Deny action type.
      DENY = 2
    end
  end
end

#google_defined_constraint ⇒ ::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint

Returns The definition of the canned constraint defined by Google.

Returns:

• (::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint) —

  The definition of the canned constraint defined by Google.

# File 'proto_docs/google/cloud/asset/v1/asset_service.rb', line 2022

class AnalyzerOrgPolicyConstraint
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # The definition of a constraint.
  # @!attribute [rw] name
  #   @return [::String]
  #     The unique name of the constraint. Format of the name should be
  #     * `constraints/{constraint_name}`
  #
  #     For example, `constraints/compute.disableSerialPortAccess`.
  # @!attribute [rw] display_name
  #   @return [::String]
  #     The human readable name of the constraint.
  # @!attribute [rw] description
  #   @return [::String]
  #     Detailed description of what this `Constraint` controls as well as how
  #     and where it is enforced.
  # @!attribute [rw] constraint_default
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint::ConstraintDefault]
  #     The evaluation behavior of this constraint in the absence of 'Policy'.
  # @!attribute [rw] list_constraint
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint::ListConstraint]
  #     Defines this constraint as being a ListConstraint.
  # @!attribute [rw] boolean_constraint
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::Constraint::BooleanConstraint]
  #     Defines this constraint as being a BooleanConstraint.
  class Constraint
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # A `Constraint` that allows or disallows a list of string values, which
    # are configured by an organization's policy administrator with a `Policy`.
    # @!attribute [rw] supports_in
    #   @return [::Boolean]
    #     Indicates whether values grouped into categories can be used in
    #     `Policy.allowed_values` and `Policy.denied_values`. For example,
    #     `"in:Python"` would match any value in the 'Python' group.
    # @!attribute [rw] supports_under
    #   @return [::Boolean]
    #     Indicates whether subtrees of Cloud Resource Manager resource hierarchy
    #     can be used in `Policy.allowed_values` and `Policy.denied_values`. For
    #     example, `"under:folders/123"` would match any resource under the
    #     'folders/123' folder.
    class ListConstraint
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # A `Constraint` that is either enforced or not.
    #
    # For example a constraint `constraints/compute.disableSerialPortAccess`.
    # If it is enforced on a VM instance, serial port connections will not be
    # opened to that instance.
    class BooleanConstraint
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # Specifies the default behavior in the absence of any `Policy` for the
    # `Constraint`. This must not be `CONSTRAINT_DEFAULT_UNSPECIFIED`.
    module ConstraintDefault
      # This is only used for distinguishing unset values and should never be
      # used.
      CONSTRAINT_DEFAULT_UNSPECIFIED = 0

      # Indicate that all values are allowed for list constraints.
      # Indicate that enforcement is off for boolean constraints.
      ALLOW = 1

      # Indicate that all values are denied for list constraints.
      # Indicate that enforcement is on for boolean constraints.
      DENY = 2
    end
  end

  # The definition of a custom constraint.
  # @!attribute [rw] name
  #   @return [::String]
  #     Name of the constraint. This is unique within the organization. Format of
  #     the name should be
  #     * `organizations/{organization_id}/customConstraints/{custom_constraint_id}`
  #
  #     Example :
  #     "organizations/123/customConstraints/custom.createOnlyE2TypeVms"
  # @!attribute [rw] resource_types
  #   @return [::Array<::String>]
  #     The Resource Instance type on which this policy applies to. Format will
  #     be of the form : "<canonical service name>/<type>" Example:
  #      * `compute.googleapis.com/Instance`.
  # @!attribute [rw] method_types
  #   @return [::Array<::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint::MethodType>]
  #     All the operations being applied for this constraint.
  # @!attribute [rw] condition
  #   @return [::String]
  #     Organization Policy condition/expression. For example:
  #     `resource.instanceName.matches("[production|test]_.*_(\d)+")'` or,
  #     `resource.management.auto_upgrade == true`
  # @!attribute [rw] action_type
  #   @return [::Google::Cloud::Asset::V1::AnalyzerOrgPolicyConstraint::CustomConstraint::ActionType]
  #     Allow or deny type.
  # @!attribute [rw] display_name
  #   @return [::String]
  #     One line display name for the UI.
  # @!attribute [rw] description
  #   @return [::String]
  #     Detailed information about this custom policy constraint.
  class CustomConstraint
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # The operation in which this constraint will be applied. For example:
    # If the constraint applies only when create VMs, the method_types will be
    # "CREATE" only. If the constraint applied when create or delete VMs, the
    # method_types will be "CREATE" and "DELETE".
    module MethodType
      # Unspecified. Will results in user error.
      METHOD_TYPE_UNSPECIFIED = 0

      # Constraint applied when creating the resource.
      CREATE = 1

      # Constraint applied when updating the resource.
      UPDATE = 2

      # Constraint applied when deleting the resource.
      DELETE = 3
    end

    # Allow or deny type.
    module ActionType
      # Unspecified. Will results in user error.
      ACTION_TYPE_UNSPECIFIED = 0

      # Allowed action type.
      ALLOW = 1

      # Deny action type.
      DENY = 2
    end
  end
end