Package cloud.google.com/go/policytroubleshooter/iam/apiv3/iampb (v1.9.0)

Version 1.9.0

• 1.10.5 (latest)
• 1.10.4
• 1.9.0
• 1.8.0
• 1.7.1
• 1.6.1
• 1.5.0
• 1.4.0
• 1.3.0
• 1.2.0
• 1.1.0
• 1.0.0

Note: To get more information about this package, such as access to older versions, view this package on pkg.go.dev.

Variables

AllowAccessState_name, AllowAccessState_value

var (
	AllowAccessState_name = map[int32]string{
		0: "ALLOW_ACCESS_STATE_UNSPECIFIED",
		1: "ALLOW_ACCESS_STATE_GRANTED",
		2: "ALLOW_ACCESS_STATE_NOT_GRANTED",
		3: "ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL",
		4: "ALLOW_ACCESS_STATE_UNKNOWN_INFO",
	}
	AllowAccessState_value = map[string]int32{
		"ALLOW_ACCESS_STATE_UNSPECIFIED":         0,
		"ALLOW_ACCESS_STATE_GRANTED":             1,
		"ALLOW_ACCESS_STATE_NOT_GRANTED":         2,
		"ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL": 3,
		"ALLOW_ACCESS_STATE_UNKNOWN_INFO":        4,
	}
)

Enum value maps for AllowAccessState.

DenyAccessState_name, DenyAccessState_value

var (
	DenyAccessState_name = map[int32]string{
		0: "DENY_ACCESS_STATE_UNSPECIFIED",
		1: "DENY_ACCESS_STATE_DENIED",
		2: "DENY_ACCESS_STATE_NOT_DENIED",
		3: "DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL",
		4: "DENY_ACCESS_STATE_UNKNOWN_INFO",
	}
	DenyAccessState_value = map[string]int32{
		"DENY_ACCESS_STATE_UNSPECIFIED":         0,
		"DENY_ACCESS_STATE_DENIED":              1,
		"DENY_ACCESS_STATE_NOT_DENIED":          2,
		"DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL": 3,
		"DENY_ACCESS_STATE_UNKNOWN_INFO":        4,
	}
)

Enum value maps for DenyAccessState.

RolePermissionInclusionState_name, RolePermissionInclusionState_value

var (
	RolePermissionInclusionState_name = map[int32]string{
		0: "ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED",
		1: "ROLE_PERMISSION_INCLUDED",
		2: "ROLE_PERMISSION_NOT_INCLUDED",
		3: "ROLE_PERMISSION_UNKNOWN_INFO",
	}
	RolePermissionInclusionState_value = map[string]int32{
		"ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED": 0,
		"ROLE_PERMISSION_INCLUDED":                    1,
		"ROLE_PERMISSION_NOT_INCLUDED":                2,
		"ROLE_PERMISSION_UNKNOWN_INFO":                3,
	}
)

Enum value maps for RolePermissionInclusionState.

PermissionPatternMatchingState_name, PermissionPatternMatchingState_value

var (
	PermissionPatternMatchingState_name = map[int32]string{
		0: "PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED",
		1: "PERMISSION_PATTERN_MATCHED",
		2: "PERMISSION_PATTERN_NOT_MATCHED",
	}
	PermissionPatternMatchingState_value = map[string]int32{
		"PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED": 0,
		"PERMISSION_PATTERN_MATCHED":                    1,
		"PERMISSION_PATTERN_NOT_MATCHED":                2,
	}
)

Enum value maps for PermissionPatternMatchingState.

MembershipMatchingState_name, MembershipMatchingState_value

var (
	MembershipMatchingState_name = map[int32]string{
		0: "MEMBERSHIP_MATCHING_STATE_UNSPECIFIED",
		1: "MEMBERSHIP_MATCHED",
		2: "MEMBERSHIP_NOT_MATCHED",
		3: "MEMBERSHIP_UNKNOWN_INFO",
		4: "MEMBERSHIP_UNKNOWN_UNSUPPORTED",
	}
	MembershipMatchingState_value = map[string]int32{
		"MEMBERSHIP_MATCHING_STATE_UNSPECIFIED": 0,
		"MEMBERSHIP_MATCHED":                    1,
		"MEMBERSHIP_NOT_MATCHED":                2,
		"MEMBERSHIP_UNKNOWN_INFO":               3,
		"MEMBERSHIP_UNKNOWN_UNSUPPORTED":        4,
	}
)

Enum value maps for MembershipMatchingState.

HeuristicRelevance_name, HeuristicRelevance_value

var (
	HeuristicRelevance_name = map[int32]string{
		0: "HEURISTIC_RELEVANCE_UNSPECIFIED",
		1: "HEURISTIC_RELEVANCE_NORMAL",
		2: "HEURISTIC_RELEVANCE_HIGH",
	}
	HeuristicRelevance_value = map[string]int32{
		"HEURISTIC_RELEVANCE_UNSPECIFIED": 0,
		"HEURISTIC_RELEVANCE_NORMAL":      1,
		"HEURISTIC_RELEVANCE_HIGH":        2,
	}
)

Enum value maps for HeuristicRelevance.

TroubleshootIamPolicyResponse_OverallAccessState_name, TroubleshootIamPolicyResponse_OverallAccessState_value

var (
	TroubleshootIamPolicyResponse_OverallAccessState_name = map[int32]string{
		0: "OVERALL_ACCESS_STATE_UNSPECIFIED",
		1: "CAN_ACCESS",
		2: "CANNOT_ACCESS",
		3: "UNKNOWN_INFO",
		4: "UNKNOWN_CONDITIONAL",
	}
	TroubleshootIamPolicyResponse_OverallAccessState_value = map[string]int32{
		"OVERALL_ACCESS_STATE_UNSPECIFIED": 0,
		"CAN_ACCESS":                       1,
		"CANNOT_ACCESS":                    2,
		"UNKNOWN_INFO":                     3,
		"UNKNOWN_CONDITIONAL":              4,
	}
)

Enum value maps for TroubleshootIamPolicyResponse_OverallAccessState.

File_google_cloud_policytroubleshooter_iam_v3_troubleshooter_proto

var File_google_cloud_policytroubleshooter_iam_v3_troubleshooter_proto protoreflect.FileDescriptor

Functions

func RegisterPolicyTroubleshooterServer

func RegisterPolicyTroubleshooterServer(s *grpc.Server, srv PolicyTroubleshooterServer)

AccessTuple

type AccessTuple struct {

	// Required. The email address of the principal whose access you want to
	// check. For example, `[e-mail]` or
	// `[e-mail]`.
	//
	// The principal must be a Google Account or a service account. Other types of
	// principals are not supported.
	Principal string `protobuf:"bytes,1,opt,name=principal,proto3" json:"principal,omitempty"`
	// Required. The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// Required. The IAM permission to check for, either in the `v1` permission
	// format or the `v2` permission format.
	//
	// For a complete list of IAM permissions in the `v1` format, see
	// https://cloud.google.com/iam/help/permissions/reference.
	//
	// For a list of IAM permissions in the `v2` format, see
	// https://cloud.google.com/iam/help/deny/supported-permissions.
	//
	// For a complete list of predefined IAM roles and the permissions in each
	// role, see https://cloud.google.com/iam/help/roles/reference.
	Permission string `protobuf:"bytes,3,opt,name=permission,proto3" json:"permission,omitempty"`
	// Output only. The permission that Policy Troubleshooter checked for, in
	// the `v2` format.
	PermissionFqdn string `protobuf:"bytes,4,opt,name=permission_fqdn,json=permissionFqdn,proto3" json:"permission_fqdn,omitempty"`
	// Optional. Additional context for the request, such as the request time or
	// IP address. This context allows Policy Troubleshooter to troubleshoot
	// conditional role bindings and deny rules.
	ConditionContext *ConditionContext `protobuf:"bytes,5,opt,name=condition_context,json=conditionContext,proto3" json:"condition_context,omitempty"`
	// contains filtered or unexported fields
}

Information about the principal, resource, and permission to check.

func (*AccessTuple) Descriptor

func (*AccessTuple) Descriptor() ([]byte, []int)

Deprecated: Use AccessTuple.ProtoReflect.Descriptor instead.

func (*AccessTuple) GetConditionContext

func (x *AccessTuple) GetConditionContext() *ConditionContext

func (*AccessTuple) GetFullResourceName

func (x *AccessTuple) GetFullResourceName() string

func (*AccessTuple) GetPermission

func (x *AccessTuple) GetPermission() string

func (*AccessTuple) GetPermissionFqdn

func (x *AccessTuple) GetPermissionFqdn() string

func (*AccessTuple) GetPrincipal

func (x *AccessTuple) GetPrincipal() string

func (*AccessTuple) ProtoMessage

func (*AccessTuple) ProtoMessage()

func (*AccessTuple) ProtoReflect

func (x *AccessTuple) ProtoReflect() protoreflect.Message

func (*AccessTuple) Reset

func (x *AccessTuple) Reset()

func (*AccessTuple) String

func (x *AccessTuple) String() string

AllowAccessState

type AllowAccessState int32

Whether IAM allow policies gives the principal the permission.

AllowAccessState_ALLOW_ACCESS_STATE_UNSPECIFIED, AllowAccessState_ALLOW_ACCESS_STATE_GRANTED, AllowAccessState_ALLOW_ACCESS_STATE_NOT_GRANTED, AllowAccessState_ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL, AllowAccessState_ALLOW_ACCESS_STATE_UNKNOWN_INFO

const (
	// Not specified.
	AllowAccessState_ALLOW_ACCESS_STATE_UNSPECIFIED AllowAccessState = 0
	// The allow policy gives the principal the permission.
	AllowAccessState_ALLOW_ACCESS_STATE_GRANTED AllowAccessState = 1
	// The allow policy doesn't give the principal the permission.
	AllowAccessState_ALLOW_ACCESS_STATE_NOT_GRANTED AllowAccessState = 2
	// The allow policy gives the principal the permission if a condition
	// expression evaluate to `true`. However, the sender of the request didn't
	// provide enough context for Policy Troubleshooter to evaluate the condition
	// expression.
	AllowAccessState_ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL AllowAccessState = 3
	// The sender of the request doesn't have access to all of the allow policies
	// that Policy Troubleshooter needs to evaluate the principal's access.
	AllowAccessState_ALLOW_ACCESS_STATE_UNKNOWN_INFO AllowAccessState = 4
)

func (AllowAccessState) Descriptor

func (AllowAccessState) Descriptor() protoreflect.EnumDescriptor

func (AllowAccessState) Enum

func (x AllowAccessState) Enum() *AllowAccessState

func (AllowAccessState) EnumDescriptor

func (AllowAccessState) EnumDescriptor() ([]byte, []int)

Deprecated: Use AllowAccessState.Descriptor instead.

func (AllowAccessState) Number

func (x AllowAccessState) Number() protoreflect.EnumNumber

func (AllowAccessState) String

func (x AllowAccessState) String() string

func (AllowAccessState) Type

func (AllowAccessState) Type() protoreflect.EnumType

AllowBindingExplanation

type AllowBindingExplanation struct {
	AllowAccessState AllowAccessState "" /* 175 byte string literal not displayed */

	Role string `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`

	RolePermission RolePermissionInclusionState "" /* 179 byte string literal not displayed */

	RolePermissionRelevance HeuristicRelevance "" /* 198 byte string literal not displayed */

	CombinedMembership *AllowBindingExplanation_AnnotatedAllowMembership `protobuf:"bytes,5,opt,name=combined_membership,json=combinedMembership,proto3" json:"combined_membership,omitempty"`

	Memberships map[string]*AllowBindingExplanation_AnnotatedAllowMembership "" /* 163 byte string literal not displayed */

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

	Condition *expr.Expr `protobuf:"bytes,8,opt,name=condition,proto3" json:"condition,omitempty"`

	ConditionExplanation *ConditionExplanation `protobuf:"bytes,9,opt,name=condition_explanation,json=conditionExplanation,proto3" json:"condition_explanation,omitempty"`

}

Details about how a role binding in an allow policy affects a principal's ability to use a permission.

func (*AllowBindingExplanation) Descriptor

func (*AllowBindingExplanation) Descriptor() ([]byte, []int)

Deprecated: Use AllowBindingExplanation.ProtoReflect.Descriptor instead.

func (*AllowBindingExplanation) GetAllowAccessState

func (x *AllowBindingExplanation) GetAllowAccessState() AllowAccessState

func (*AllowBindingExplanation) GetCombinedMembership

func (x *AllowBindingExplanation) GetCombinedMembership() *AllowBindingExplanation_AnnotatedAllowMembership

func (*AllowBindingExplanation) GetCondition

func (x *AllowBindingExplanation) GetCondition() *expr.Expr

func (*AllowBindingExplanation) GetConditionExplanation

func (x *AllowBindingExplanation) GetConditionExplanation() *ConditionExplanation

func (*AllowBindingExplanation) GetMemberships

func (x *AllowBindingExplanation) GetMemberships() map[string]*AllowBindingExplanation_AnnotatedAllowMembership

func (*AllowBindingExplanation) GetRelevance

func (x *AllowBindingExplanation) GetRelevance() HeuristicRelevance

func (*AllowBindingExplanation) GetRole

func (x *AllowBindingExplanation) GetRole() string

func (*AllowBindingExplanation) GetRolePermission

func (x *AllowBindingExplanation) GetRolePermission() RolePermissionInclusionState

func (*AllowBindingExplanation) GetRolePermissionRelevance

func (x *AllowBindingExplanation) GetRolePermissionRelevance() HeuristicRelevance

func (*AllowBindingExplanation) ProtoMessage

func (*AllowBindingExplanation) ProtoMessage()

func (*AllowBindingExplanation) ProtoReflect

func (x *AllowBindingExplanation) ProtoReflect() protoreflect.Message

func (*AllowBindingExplanation) Reset

func (x *AllowBindingExplanation) Reset()

func (*AllowBindingExplanation) String

func (x *AllowBindingExplanation) String() string

AllowBindingExplanation_AnnotatedAllowMembership

type AllowBindingExplanation_AnnotatedAllowMembership struct {
	Membership MembershipMatchingState "" /* 144 byte string literal not displayed */

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

}

Details about whether the role binding includes the principal.

func (*AllowBindingExplanation_AnnotatedAllowMembership) Descriptor

func (*AllowBindingExplanation_AnnotatedAllowMembership) Descriptor() ([]byte, []int)

Deprecated: Use AllowBindingExplanation_AnnotatedAllowMembership.ProtoReflect.Descriptor instead.

func (*AllowBindingExplanation_AnnotatedAllowMembership) GetMembership

func (x *AllowBindingExplanation_AnnotatedAllowMembership) GetMembership() MembershipMatchingState

func (*AllowBindingExplanation_AnnotatedAllowMembership) GetRelevance

func (x *AllowBindingExplanation_AnnotatedAllowMembership) GetRelevance() HeuristicRelevance

func (*AllowBindingExplanation_AnnotatedAllowMembership) ProtoMessage

func (*AllowBindingExplanation_AnnotatedAllowMembership) ProtoMessage()

func (*AllowBindingExplanation_AnnotatedAllowMembership) ProtoReflect

func (x *AllowBindingExplanation_AnnotatedAllowMembership) ProtoReflect() protoreflect.Message

func (*AllowBindingExplanation_AnnotatedAllowMembership) Reset

func (x *AllowBindingExplanation_AnnotatedAllowMembership) Reset()

func (*AllowBindingExplanation_AnnotatedAllowMembership) String

func (x *AllowBindingExplanation_AnnotatedAllowMembership) String() string

AllowPolicyExplanation

type AllowPolicyExplanation struct {
	AllowAccessState AllowAccessState "" /* 175 byte string literal not displayed */

	ExplainedPolicies []*ExplainedAllowPolicy `protobuf:"bytes,2,rep,name=explained_policies,json=explainedPolicies,proto3" json:"explained_policies,omitempty"`

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

}

Details about how the relevant IAM allow policies affect the final access state.

func (*AllowPolicyExplanation) Descriptor

func (*AllowPolicyExplanation) Descriptor() ([]byte, []int)

Deprecated: Use AllowPolicyExplanation.ProtoReflect.Descriptor instead.

func (*AllowPolicyExplanation) GetAllowAccessState

func (x *AllowPolicyExplanation) GetAllowAccessState() AllowAccessState

func (*AllowPolicyExplanation) GetExplainedPolicies

func (x *AllowPolicyExplanation) GetExplainedPolicies() []*ExplainedAllowPolicy

func (*AllowPolicyExplanation) GetRelevance

func (x *AllowPolicyExplanation) GetRelevance() HeuristicRelevance

func (*AllowPolicyExplanation) ProtoMessage

func (*AllowPolicyExplanation) ProtoMessage()

func (*AllowPolicyExplanation) ProtoReflect

func (x *AllowPolicyExplanation) ProtoReflect() protoreflect.Message

func (*AllowPolicyExplanation) Reset

func (x *AllowPolicyExplanation) Reset()

func (*AllowPolicyExplanation) String

func (x *AllowPolicyExplanation) String() string

ConditionContext

type ConditionContext struct {

	// Represents a target resource that is involved with a network activity.
	// If multiple resources are involved with an activity, this must be the
	// primary one.
	Resource *ConditionContext_Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// The destination of a network activity, such as accepting a TCP connection.
	// In a multi-hop network activity, the destination represents the receiver of
	// the last hop.
	Destination *ConditionContext_Peer `protobuf:"bytes,2,opt,name=destination,proto3" json:"destination,omitempty"`
	// Represents a network request, such as an HTTP request.
	Request *ConditionContext_Request `protobuf:"bytes,3,opt,name=request,proto3" json:"request,omitempty"`
	// Output only. The effective tags on the resource. The effective tags are
	// fetched during troubleshooting.
	EffectiveTags []*ConditionContext_EffectiveTag `protobuf:"bytes,4,rep,name=effective_tags,json=effectiveTags,proto3" json:"effective_tags,omitempty"`
	// contains filtered or unexported fields
}

Additional context for troubleshooting conditional role bindings and deny rules.

func (*ConditionContext) Descriptor

func (*ConditionContext) Descriptor() ([]byte, []int)

Deprecated: Use ConditionContext.ProtoReflect.Descriptor instead.

func (*ConditionContext) GetDestination

func (x *ConditionContext) GetDestination() *ConditionContext_Peer

func (*ConditionContext) GetEffectiveTags

func (x *ConditionContext) GetEffectiveTags() []*ConditionContext_EffectiveTag

func (*ConditionContext) GetRequest

func (x *ConditionContext) GetRequest() *ConditionContext_Request

func (*ConditionContext) GetResource

func (x *ConditionContext) GetResource() *ConditionContext_Resource

func (*ConditionContext) ProtoMessage

func (*ConditionContext) ProtoMessage()

func (*ConditionContext) ProtoReflect

func (x *ConditionContext) ProtoReflect() protoreflect.Message

func (*ConditionContext) Reset

func (x *ConditionContext) Reset()

func (*ConditionContext) String

func (x *ConditionContext) String() string

ConditionContext_EffectiveTag

type ConditionContext_EffectiveTag struct {

	// Output only. Resource name for TagValue in the format `tagValues/456`.
	TagValue string `protobuf:"bytes,1,opt,name=tag_value,json=tagValue,proto3" json:"tag_value,omitempty"`
	// Output only. The namespaced name of the TagValue. Can be in the form
	// `{organization_id}/{tag_key_short_name}/{tag_value_short_name}` or
	// `{project_id}/{tag_key_short_name}/{tag_value_short_name}` or
	// `{project_number}/{tag_key_short_name}/{tag_value_short_name}`.
	NamespacedTagValue string `protobuf:"bytes,2,opt,name=namespaced_tag_value,json=namespacedTagValue,proto3" json:"namespaced_tag_value,omitempty"`
	// Output only. The name of the TagKey, in the format `tagKeys/{id}`, such
	// as `tagKeys/123`.
	TagKey string `protobuf:"bytes,3,opt,name=tag_key,json=tagKey,proto3" json:"tag_key,omitempty"`
	// Output only. The namespaced name of the TagKey. Can be in the form
	// `{organization_id}/{tag_key_short_name}` or
	// `{project_id}/{tag_key_short_name}` or
	// `{project_number}/{tag_key_short_name}`.
	NamespacedTagKey string `protobuf:"bytes,4,opt,name=namespaced_tag_key,json=namespacedTagKey,proto3" json:"namespaced_tag_key,omitempty"`
	// The parent name of the tag key.
	// Must be in the format `organizations/{organization_id}` or
	// `projects/{project_number}`
	TagKeyParentName string `protobuf:"bytes,6,opt,name=tag_key_parent_name,json=tagKeyParentName,proto3" json:"tag_key_parent_name,omitempty"`
	// Output only. Indicates the inheritance status of a tag value
	// attached to the given resource. If the tag value is inherited from one of
	// the resource's ancestors, inherited will be true. If false, then the tag
	// value is directly attached to the resource, inherited will be false.
	Inherited bool `protobuf:"varint,5,opt,name=inherited,proto3" json:"inherited,omitempty"`
	// contains filtered or unexported fields
}

A tag that applies to a resource during policy evaluation. Tags can be either directly bound to a resource or inherited from its ancestor. EffectiveTag contains the name and namespaced_name of the tag value and tag key, with additional fields of inherited to indicate the inheritance status of the effective tag.

func (*ConditionContext_EffectiveTag) Descriptor

func (*ConditionContext_EffectiveTag) Descriptor() ([]byte, []int)

Deprecated: Use ConditionContext_EffectiveTag.ProtoReflect.Descriptor instead.

func (*ConditionContext_EffectiveTag) GetInherited

func (x *ConditionContext_EffectiveTag) GetInherited() bool

func (*ConditionContext_EffectiveTag) GetNamespacedTagKey

func (x *ConditionContext_EffectiveTag) GetNamespacedTagKey() string

func (*ConditionContext_EffectiveTag) GetNamespacedTagValue

func (x *ConditionContext_EffectiveTag) GetNamespacedTagValue() string

func (*ConditionContext_EffectiveTag) GetTagKey

func (x *ConditionContext_EffectiveTag) GetTagKey() string

func (*ConditionContext_EffectiveTag) GetTagKeyParentName

func (x *ConditionContext_EffectiveTag) GetTagKeyParentName() string

func (*ConditionContext_EffectiveTag) GetTagValue

func (x *ConditionContext_EffectiveTag) GetTagValue() string

func (*ConditionContext_EffectiveTag) ProtoMessage

func (*ConditionContext_EffectiveTag) ProtoMessage()

func (*ConditionContext_EffectiveTag) ProtoReflect

func (x *ConditionContext_EffectiveTag) ProtoReflect() protoreflect.Message

func (*ConditionContext_EffectiveTag) Reset

func (x *ConditionContext_EffectiveTag) Reset()

func (*ConditionContext_EffectiveTag) String

func (x *ConditionContext_EffectiveTag) String() string

ConditionContext_Peer

type ConditionContext_Peer struct {

	// The IPv4 or IPv6 address of the peer.
	Ip string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
	// The network port of the peer.
	Port int64 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

This message defines attributes for a node that handles a network request. The node can be either a service or an application that sends, forwards, or receives the request. Service peers should fill in principal and labels as appropriate.

func (*ConditionContext_Peer) Descriptor

func (*ConditionContext_Peer) Descriptor() ([]byte, []int)

Deprecated: Use ConditionContext_Peer.ProtoReflect.Descriptor instead.

func (*ConditionContext_Peer) GetIp

func (x *ConditionContext_Peer) GetIp() string

func (*ConditionContext_Peer) GetPort

func (x *ConditionContext_Peer) GetPort() int64

func (*ConditionContext_Peer) ProtoMessage

func (*ConditionContext_Peer) ProtoMessage()

func (*ConditionContext_Peer) ProtoReflect

func (x *ConditionContext_Peer) ProtoReflect() protoreflect.Message

func (*ConditionContext_Peer) Reset

func (x *ConditionContext_Peer) Reset()

func (*ConditionContext_Peer) String

func (x *ConditionContext_Peer) String() string

ConditionContext_Request

type ConditionContext_Request struct {

	// Optional. The timestamp when the destination service receives the first
	// byte of the request.
	ReceiveTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=receive_time,json=receiveTime,proto3" json:"receive_time,omitempty"`
	// contains filtered or unexported fields
}

This message defines attributes for an HTTP request. If the actual request is not an HTTP request, the runtime system should try to map the actual request to an equivalent HTTP request.

func (*ConditionContext_Request) Descriptor

func (*ConditionContext_Request) Descriptor() ([]byte, []int)

Deprecated: Use ConditionContext_Request.ProtoReflect.Descriptor instead.

func (*ConditionContext_Request) GetReceiveTime

func (x *ConditionContext_Request) GetReceiveTime() *timestamppb.Timestamp

func (*ConditionContext_Request) ProtoMessage

func (*ConditionContext_Request) ProtoMessage()

func (*ConditionContext_Request) ProtoReflect

func (x *ConditionContext_Request) ProtoReflect() protoreflect.Message

func (*ConditionContext_Request) Reset

func (x *ConditionContext_Request) Reset()

func (*ConditionContext_Request) String

func (x *ConditionContext_Request) String() string

ConditionContext_Resource

type ConditionContext_Resource struct {

	// The name of the service that this resource belongs to, such as
	// `compute.googleapis.com`. The service name might not match the DNS
	// hostname that actually serves the request.
	//
	// For a full list of resource service values, see
	// https://cloud.google.com/iam/help/conditions/resource-services
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// The stable identifier (name) of a resource on the `service`. A resource
	// can be logically identified as `//{resource.service}/{resource.name}`.
	// Unlike the resource URI, the resource name doesn't contain any protocol
	// and version information.
	//
	// For a list of full resource name formats, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// The type of the resource, in the format `{service}/{kind}`.
	//
	// For a full list of resource type values, see
	// https://cloud.google.com/iam/help/conditions/resource-types
	Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
	// contains filtered or unexported fields
}

Core attributes for a resource. A resource is an addressable (named) entity provided by the destination service. For example, a Compute Engine instance.

func (*ConditionContext_Resource) Descriptor

func (*ConditionContext_Resource) Descriptor() ([]byte, []int)

Deprecated: Use ConditionContext_Resource.ProtoReflect.Descriptor instead.

func (*ConditionContext_Resource) GetName

func (x *ConditionContext_Resource) GetName() string

func (*ConditionContext_Resource) GetService

func (x *ConditionContext_Resource) GetService() string

func (*ConditionContext_Resource) GetType

func (x *ConditionContext_Resource) GetType() string

func (*ConditionContext_Resource) ProtoMessage

func (*ConditionContext_Resource) ProtoMessage()

func (*ConditionContext_Resource) ProtoReflect

func (x *ConditionContext_Resource) ProtoReflect() protoreflect.Message

func (*ConditionContext_Resource) Reset

func (x *ConditionContext_Resource) Reset()

func (*ConditionContext_Resource) String

func (x *ConditionContext_Resource) String() string

ConditionExplanation

type ConditionExplanation struct {

	// Value of the condition.
	Value *structpb.Value `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
	// Any errors that prevented complete evaluation of the condition expression.
	Errors []*status.Status `protobuf:"bytes,3,rep,name=errors,proto3" json:"errors,omitempty"`
	// The value of each statement of the condition expression. The value can be
	// `true`, `false`, or `null`. The value is `null` if the statement can't be
	// evaluated.
	EvaluationStates []*ConditionExplanation_EvaluationState `protobuf:"bytes,2,rep,name=evaluation_states,json=evaluationStates,proto3" json:"evaluation_states,omitempty"`
	// contains filtered or unexported fields
}

Explanation for how a condition affects a principal's access

func (*ConditionExplanation) Descriptor

func (*ConditionExplanation) Descriptor() ([]byte, []int)

Deprecated: Use ConditionExplanation.ProtoReflect.Descriptor instead.

func (*ConditionExplanation) GetErrors

func (x *ConditionExplanation) GetErrors() []*status.Status

func (*ConditionExplanation) GetEvaluationStates

func (x *ConditionExplanation) GetEvaluationStates() []*ConditionExplanation_EvaluationState

func (*ConditionExplanation) GetValue

func (x *ConditionExplanation) GetValue() *structpb.Value

func (*ConditionExplanation) ProtoMessage

func (*ConditionExplanation) ProtoMessage()

func (*ConditionExplanation) ProtoReflect

func (x *ConditionExplanation) ProtoReflect() protoreflect.Message

func (*ConditionExplanation) Reset

func (x *ConditionExplanation) Reset()

func (*ConditionExplanation) String

func (x *ConditionExplanation) String() string

ConditionExplanation_EvaluationState

type ConditionExplanation_EvaluationState struct {

	// Start position of an expression in the condition, by character.
	Start int32 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
	// End position of an expression in the condition, by character,
	// end included, for example: the end position of the first part of
	// `a==b || c==d` would be 4.
	End int32 `protobuf:"varint,2,opt,name=end,proto3" json:"end,omitempty"`
	// Value of this expression.
	Value *structpb.Value `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
	// Any errors that prevented complete evaluation of the condition
	// expression.
	Errors []*status.Status `protobuf:"bytes,4,rep,name=errors,proto3" json:"errors,omitempty"`
	// contains filtered or unexported fields
}

Evaluated state of a condition expression.

func (*ConditionExplanation_EvaluationState) Descriptor

func (*ConditionExplanation_EvaluationState) Descriptor() ([]byte, []int)

Deprecated: Use ConditionExplanation_EvaluationState.ProtoReflect.Descriptor instead.

func (*ConditionExplanation_EvaluationState) GetEnd

func (x *ConditionExplanation_EvaluationState) GetEnd() int32

func (*ConditionExplanation_EvaluationState) GetErrors

func (x *ConditionExplanation_EvaluationState) GetErrors() []*status.Status

func (*ConditionExplanation_EvaluationState) GetStart

func (x *ConditionExplanation_EvaluationState) GetStart() int32

func (*ConditionExplanation_EvaluationState) GetValue

func (x *ConditionExplanation_EvaluationState) GetValue() *structpb.Value

func (*ConditionExplanation_EvaluationState) ProtoMessage

func (*ConditionExplanation_EvaluationState) ProtoMessage()

func (*ConditionExplanation_EvaluationState) ProtoReflect

func (x *ConditionExplanation_EvaluationState) ProtoReflect() protoreflect.Message

func (*ConditionExplanation_EvaluationState) Reset

func (x *ConditionExplanation_EvaluationState) Reset()

func (*ConditionExplanation_EvaluationState) String

func (x *ConditionExplanation_EvaluationState) String() string

DenyAccessState

type DenyAccessState int32

Whether IAM deny policies deny the principal the permission.

DenyAccessState_DENY_ACCESS_STATE_UNSPECIFIED, DenyAccessState_DENY_ACCESS_STATE_DENIED, DenyAccessState_DENY_ACCESS_STATE_NOT_DENIED, DenyAccessState_DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL, DenyAccessState_DENY_ACCESS_STATE_UNKNOWN_INFO

const (
	// Not specified.
	DenyAccessState_DENY_ACCESS_STATE_UNSPECIFIED DenyAccessState = 0
	// The deny policy denies the principal the permission.
	DenyAccessState_DENY_ACCESS_STATE_DENIED DenyAccessState = 1
	// The deny policy doesn't deny the principal the permission.
	DenyAccessState_DENY_ACCESS_STATE_NOT_DENIED DenyAccessState = 2
	// The deny policy denies the principal the permission if a condition
	// expression evaluates to `true`. However, the sender of the request didn't
	// provide enough context for Policy Troubleshooter to evaluate the condition
	// expression.
	DenyAccessState_DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL DenyAccessState = 3
	// The sender of the request does not have access to all of the deny policies
	// that Policy Troubleshooter needs to evaluate the principal's access.
	DenyAccessState_DENY_ACCESS_STATE_UNKNOWN_INFO DenyAccessState = 4
)

func (DenyAccessState) Descriptor

func (DenyAccessState) Descriptor() protoreflect.EnumDescriptor

func (DenyAccessState) Enum

func (x DenyAccessState) Enum() *DenyAccessState

func (DenyAccessState) EnumDescriptor

func (DenyAccessState) EnumDescriptor() ([]byte, []int)

Deprecated: Use DenyAccessState.Descriptor instead.

func (DenyAccessState) Number

func (x DenyAccessState) Number() protoreflect.EnumNumber

func (DenyAccessState) String

func (x DenyAccessState) String() string

func (DenyAccessState) Type

func (DenyAccessState) Type() protoreflect.EnumType

DenyPolicyExplanation

type DenyPolicyExplanation struct {
	DenyAccessState DenyAccessState "" /* 171 byte string literal not displayed */

	ExplainedResources []*ExplainedDenyResource `protobuf:"bytes,2,rep,name=explained_resources,json=explainedResources,proto3" json:"explained_resources,omitempty"`

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

	PermissionDeniable bool `protobuf:"varint,4,opt,name=permission_deniable,json=permissionDeniable,proto3" json:"permission_deniable,omitempty"`

}

Details about how the relevant IAM deny policies affect the final access state.

func (*DenyPolicyExplanation) Descriptor

func (*DenyPolicyExplanation) Descriptor() ([]byte, []int)

Deprecated: Use DenyPolicyExplanation.ProtoReflect.Descriptor instead.

func (*DenyPolicyExplanation) GetDenyAccessState

func (x *DenyPolicyExplanation) GetDenyAccessState() DenyAccessState

func (*DenyPolicyExplanation) GetExplainedResources

func (x *DenyPolicyExplanation) GetExplainedResources() []*ExplainedDenyResource

func (*DenyPolicyExplanation) GetPermissionDeniable

func (x *DenyPolicyExplanation) GetPermissionDeniable() bool

func (*DenyPolicyExplanation) GetRelevance

func (x *DenyPolicyExplanation) GetRelevance() HeuristicRelevance

func (*DenyPolicyExplanation) ProtoMessage

func (*DenyPolicyExplanation) ProtoMessage()

func (*DenyPolicyExplanation) ProtoReflect

func (x *DenyPolicyExplanation) ProtoReflect() protoreflect.Message

func (*DenyPolicyExplanation) Reset

func (x *DenyPolicyExplanation) Reset()

func (*DenyPolicyExplanation) String

func (x *DenyPolicyExplanation) String() string

DenyRuleExplanation

type DenyRuleExplanation struct {
	DenyAccessState DenyAccessState "" /* 171 byte string literal not displayed */

	CombinedDeniedPermission *DenyRuleExplanation_AnnotatedPermissionMatching "" /* 135 byte string literal not displayed */

	DeniedPermissions map[string]*DenyRuleExplanation_AnnotatedPermissionMatching "" /* 200 byte string literal not displayed */

	CombinedExceptionPermission *DenyRuleExplanation_AnnotatedPermissionMatching "" /* 144 byte string literal not displayed */

	ExceptionPermissions map[string]*DenyRuleExplanation_AnnotatedPermissionMatching "" /* 209 byte string literal not displayed */

	CombinedDeniedPrincipal *DenyRuleExplanation_AnnotatedDenyPrincipalMatching "" /* 132 byte string literal not displayed */

	DeniedPrincipals map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching "" /* 197 byte string literal not displayed */

	CombinedExceptionPrincipal *DenyRuleExplanation_AnnotatedDenyPrincipalMatching "" /* 141 byte string literal not displayed */

	ExceptionPrincipals map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching "" /* 206 byte string literal not displayed */

	Relevance HeuristicRelevance "" /* 138 byte string literal not displayed */

	Condition *expr.Expr `protobuf:"bytes,11,opt,name=condition,proto3" json:"condition,omitempty"`

	ConditionExplanation *ConditionExplanation `protobuf:"bytes,12,opt,name=condition_explanation,json=conditionExplanation,proto3" json:"condition_explanation,omitempty"`

}

Details about how a deny rule in a deny policy affects a principal's ability to use a permission.

func (*DenyRuleExplanation) Descriptor

func (*DenyRuleExplanation) Descriptor() ([]byte, []int)

Deprecated: Use DenyRuleExplanation.ProtoReflect.Descriptor instead.

func (*DenyRuleExplanation) GetCombinedDeniedPermission

func (x *DenyRuleExplanation) GetCombinedDeniedPermission() *DenyRuleExplanation_AnnotatedPermissionMatching

func (*DenyRuleExplanation) GetCombinedDeniedPrincipal

func (x *DenyRuleExplanation) GetCombinedDeniedPrincipal() *DenyRuleExplanation_AnnotatedDenyPrincipalMatching

func (*DenyRuleExplanation) GetCombinedExceptionPermission

func (x *DenyRuleExplanation) GetCombinedExceptionPermission() *DenyRuleExplanation_AnnotatedPermissionMatching

func (*DenyRuleExplanation) GetCombinedExceptionPrincipal

func (x *DenyRuleExplanation) GetCombinedExceptionPrincipal() *DenyRuleExplanation_AnnotatedDenyPrincipalMatching

func (*DenyRuleExplanation) GetCondition

func (x *DenyRuleExplanation) GetCondition() *expr.Expr

func (*DenyRuleExplanation) GetConditionExplanation

func (x *DenyRuleExplanation) GetConditionExplanation() *ConditionExplanation

func (*DenyRuleExplanation) GetDeniedPermissions

func (x *DenyRuleExplanation) GetDeniedPermissions() map[string]*DenyRuleExplanation_AnnotatedPermissionMatching

func (*DenyRuleExplanation) GetDeniedPrincipals

func (x *DenyRuleExplanation) GetDeniedPrincipals() map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching

func (*DenyRuleExplanation) GetDenyAccessState

func (x *DenyRuleExplanation) GetDenyAccessState() DenyAccessState

func (*DenyRuleExplanation) GetExceptionPermissions

func (x *DenyRuleExplanation) GetExceptionPermissions() map[string]*DenyRuleExplanation_AnnotatedPermissionMatching

func (*DenyRuleExplanation) GetExceptionPrincipals

func (x *DenyRuleExplanation) GetExceptionPrincipals() map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching

func (*DenyRuleExplanation) GetRelevance

func (x *DenyRuleExplanation) GetRelevance() HeuristicRelevance

func (*DenyRuleExplanation) ProtoMessage

func (*DenyRuleExplanation) ProtoMessage()

func (*DenyRuleExplanation) ProtoReflect

func (x *DenyRuleExplanation) ProtoReflect() protoreflect.Message

func (*DenyRuleExplanation) Reset

func (x *DenyRuleExplanation) Reset()

func (*DenyRuleExplanation) String

func (x *DenyRuleExplanation) String() string

DenyRuleExplanation_AnnotatedDenyPrincipalMatching

type DenyRuleExplanation_AnnotatedDenyPrincipalMatching struct {
	Membership MembershipMatchingState "" /* 144 byte string literal not displayed */

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

}

Details about whether the principal in the request is listed as a denied principal in the deny rule, either directly or through membership in a principal set.

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) Descriptor

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) Descriptor() ([]byte, []int)

Deprecated: Use DenyRuleExplanation_AnnotatedDenyPrincipalMatching.ProtoReflect.Descriptor instead.

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) GetMembership

func (x *DenyRuleExplanation_AnnotatedDenyPrincipalMatching) GetMembership() MembershipMatchingState

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) GetRelevance

func (x *DenyRuleExplanation_AnnotatedDenyPrincipalMatching) GetRelevance() HeuristicRelevance

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) ProtoMessage

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) ProtoMessage()

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) ProtoReflect

func (x *DenyRuleExplanation_AnnotatedDenyPrincipalMatching) ProtoReflect() protoreflect.Message

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) Reset

func (x *DenyRuleExplanation_AnnotatedDenyPrincipalMatching) Reset()

func (*DenyRuleExplanation_AnnotatedDenyPrincipalMatching) String

func (x *DenyRuleExplanation_AnnotatedDenyPrincipalMatching) String() string

DenyRuleExplanation_AnnotatedPermissionMatching

type DenyRuleExplanation_AnnotatedPermissionMatching struct {
	PermissionMatchingState PermissionPatternMatchingState "" /* 210 byte string literal not displayed */

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

}

Details about whether the permission in the request is denied by the deny rule.

func (*DenyRuleExplanation_AnnotatedPermissionMatching) Descriptor

func (*DenyRuleExplanation_AnnotatedPermissionMatching) Descriptor() ([]byte, []int)

Deprecated: Use DenyRuleExplanation_AnnotatedPermissionMatching.ProtoReflect.Descriptor instead.

func (*DenyRuleExplanation_AnnotatedPermissionMatching) GetPermissionMatchingState

func (x *DenyRuleExplanation_AnnotatedPermissionMatching) GetPermissionMatchingState() PermissionPatternMatchingState

func (*DenyRuleExplanation_AnnotatedPermissionMatching) GetRelevance

func (x *DenyRuleExplanation_AnnotatedPermissionMatching) GetRelevance() HeuristicRelevance

func (*DenyRuleExplanation_AnnotatedPermissionMatching) ProtoMessage

func (*DenyRuleExplanation_AnnotatedPermissionMatching) ProtoMessage()

func (*DenyRuleExplanation_AnnotatedPermissionMatching) ProtoReflect

func (x *DenyRuleExplanation_AnnotatedPermissionMatching) ProtoReflect() protoreflect.Message

func (*DenyRuleExplanation_AnnotatedPermissionMatching) Reset

func (x *DenyRuleExplanation_AnnotatedPermissionMatching) Reset()

func (*DenyRuleExplanation_AnnotatedPermissionMatching) String

func (x *DenyRuleExplanation_AnnotatedPermissionMatching) String() string

ExplainedAllowPolicy

type ExplainedAllowPolicy struct {
	AllowAccessState AllowAccessState "" /* 175 byte string literal not displayed */

	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`

	BindingExplanations []*AllowBindingExplanation `protobuf:"bytes,3,rep,name=binding_explanations,json=bindingExplanations,proto3" json:"binding_explanations,omitempty"`

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

	Policy *iampb.Policy `protobuf:"bytes,5,opt,name=policy,proto3" json:"policy,omitempty"`

}

Details about how a specific IAM allow policy contributed to the final access state.

func (*ExplainedAllowPolicy) Descriptor

func (*ExplainedAllowPolicy) Descriptor() ([]byte, []int)

Deprecated: Use ExplainedAllowPolicy.ProtoReflect.Descriptor instead.

func (*ExplainedAllowPolicy) GetAllowAccessState

func (x *ExplainedAllowPolicy) GetAllowAccessState() AllowAccessState

func (*ExplainedAllowPolicy) GetBindingExplanations

func (x *ExplainedAllowPolicy) GetBindingExplanations() []*AllowBindingExplanation

func (*ExplainedAllowPolicy) GetFullResourceName

func (x *ExplainedAllowPolicy) GetFullResourceName() string

func (*ExplainedAllowPolicy) GetPolicy

func (x *ExplainedAllowPolicy) GetPolicy() *iampb.Policy

func (*ExplainedAllowPolicy) GetRelevance

func (x *ExplainedAllowPolicy) GetRelevance() HeuristicRelevance

func (*ExplainedAllowPolicy) ProtoMessage

func (*ExplainedAllowPolicy) ProtoMessage()

func (*ExplainedAllowPolicy) ProtoReflect

func (x *ExplainedAllowPolicy) ProtoReflect() protoreflect.Message

func (*ExplainedAllowPolicy) Reset

func (x *ExplainedAllowPolicy) Reset()

func (*ExplainedAllowPolicy) String

func (x *ExplainedAllowPolicy) String() string

ExplainedDenyPolicy

type ExplainedDenyPolicy struct {
	DenyAccessState DenyAccessState "" /* 171 byte string literal not displayed */

	Policy *iampb1.Policy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`

	RuleExplanations []*DenyRuleExplanation `protobuf:"bytes,3,rep,name=rule_explanations,json=ruleExplanations,proto3" json:"rule_explanations,omitempty"`

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

}

Details about how a specific IAM deny policy [Policy][google.iam.v2.Policy] contributed to the access check.

func (*ExplainedDenyPolicy) Descriptor

func (*ExplainedDenyPolicy) Descriptor() ([]byte, []int)

Deprecated: Use ExplainedDenyPolicy.ProtoReflect.Descriptor instead.

func (*ExplainedDenyPolicy) GetDenyAccessState

func (x *ExplainedDenyPolicy) GetDenyAccessState() DenyAccessState

func (*ExplainedDenyPolicy) GetPolicy

func (x *ExplainedDenyPolicy) GetPolicy() *iampb1.Policy

func (*ExplainedDenyPolicy) GetRelevance

func (x *ExplainedDenyPolicy) GetRelevance() HeuristicRelevance

func (*ExplainedDenyPolicy) GetRuleExplanations

func (x *ExplainedDenyPolicy) GetRuleExplanations() []*DenyRuleExplanation

func (*ExplainedDenyPolicy) ProtoMessage

func (*ExplainedDenyPolicy) ProtoMessage()

func (*ExplainedDenyPolicy) ProtoReflect

func (x *ExplainedDenyPolicy) ProtoReflect() protoreflect.Message

func (*ExplainedDenyPolicy) Reset

func (x *ExplainedDenyPolicy) Reset()

func (*ExplainedDenyPolicy) String

func (x *ExplainedDenyPolicy) String() string

ExplainedDenyResource

type ExplainedDenyResource struct {
	DenyAccessState DenyAccessState "" /* 171 byte string literal not displayed */

	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`

	ExplainedPolicies []*ExplainedDenyPolicy `protobuf:"bytes,3,rep,name=explained_policies,json=explainedPolicies,proto3" json:"explained_policies,omitempty"`

	Relevance HeuristicRelevance "" /* 137 byte string literal not displayed */

}

Details about how a specific resource contributed to the deny policy evaluation.

func (*ExplainedDenyResource) Descriptor

func (*ExplainedDenyResource) Descriptor() ([]byte, []int)

Deprecated: Use ExplainedDenyResource.ProtoReflect.Descriptor instead.

func (*ExplainedDenyResource) GetDenyAccessState

func (x *ExplainedDenyResource) GetDenyAccessState() DenyAccessState

func (*ExplainedDenyResource) GetExplainedPolicies

func (x *ExplainedDenyResource) GetExplainedPolicies() []*ExplainedDenyPolicy

func (*ExplainedDenyResource) GetFullResourceName

func (x *ExplainedDenyResource) GetFullResourceName() string

func (*ExplainedDenyResource) GetRelevance

func (x *ExplainedDenyResource) GetRelevance() HeuristicRelevance

func (*ExplainedDenyResource) ProtoMessage

func (*ExplainedDenyResource) ProtoMessage()

func (*ExplainedDenyResource) ProtoReflect

func (x *ExplainedDenyResource) ProtoReflect() protoreflect.Message

func (*ExplainedDenyResource) Reset

func (x *ExplainedDenyResource) Reset()

func (*ExplainedDenyResource) String

func (x *ExplainedDenyResource) String() string

HeuristicRelevance

type HeuristicRelevance int32

The extent to which a single data point contributes to an overall determination.

HeuristicRelevance_HEURISTIC_RELEVANCE_UNSPECIFIED, HeuristicRelevance_HEURISTIC_RELEVANCE_NORMAL, HeuristicRelevance_HEURISTIC_RELEVANCE_HIGH

const (
	// Not specified.
	HeuristicRelevance_HEURISTIC_RELEVANCE_UNSPECIFIED HeuristicRelevance = 0
	// The data point has a limited effect on the result. Changing the data point
	// is unlikely to affect the overall determination.
	HeuristicRelevance_HEURISTIC_RELEVANCE_NORMAL HeuristicRelevance = 1
	// The data point has a strong effect on the result. Changing the data point
	// is likely to affect the overall determination.
	HeuristicRelevance_HEURISTIC_RELEVANCE_HIGH HeuristicRelevance = 2
)

func (HeuristicRelevance) Descriptor

func (HeuristicRelevance) Descriptor() protoreflect.EnumDescriptor

func (HeuristicRelevance) Enum

func (x HeuristicRelevance) Enum() *HeuristicRelevance

func (HeuristicRelevance) EnumDescriptor

func (HeuristicRelevance) EnumDescriptor() ([]byte, []int)

Deprecated: Use HeuristicRelevance.Descriptor instead.

func (HeuristicRelevance) Number

func (x HeuristicRelevance) Number() protoreflect.EnumNumber

func (HeuristicRelevance) String

func (x HeuristicRelevance) String() string

func (HeuristicRelevance) Type

func (HeuristicRelevance) Type() protoreflect.EnumType

MembershipMatchingState

type MembershipMatchingState int32

Whether the principal in the request matches the principal in the policy.

MembershipMatchingState_MEMBERSHIP_MATCHING_STATE_UNSPECIFIED, MembershipMatchingState_MEMBERSHIP_MATCHED, MembershipMatchingState_MEMBERSHIP_NOT_MATCHED, MembershipMatchingState_MEMBERSHIP_UNKNOWN_INFO, MembershipMatchingState_MEMBERSHIP_UNKNOWN_UNSUPPORTED

const (
	// Not specified.
	MembershipMatchingState_MEMBERSHIP_MATCHING_STATE_UNSPECIFIED MembershipMatchingState = 0
	// The principal in the request matches the principal in the policy. The
	// principal can be included directly or indirectly:
	//
	// * A principal is included directly if that principal is listed in the
	//   role binding.
	// * A principal is included indirectly if that principal is in a Google
	//   group, Google Workspace account, or Cloud Identity domain that is listed
	//   in the policy.
	MembershipMatchingState_MEMBERSHIP_MATCHED MembershipMatchingState = 1
	// The principal in the request doesn't match the principal in the policy.
	MembershipMatchingState_MEMBERSHIP_NOT_MATCHED MembershipMatchingState = 2
	// The principal in the policy is a group or domain, and the sender of the
	// request doesn't have permission to view whether the principal in the
	// request is a member of the group or domain.
	MembershipMatchingState_MEMBERSHIP_UNKNOWN_INFO MembershipMatchingState = 3
	// The principal is an unsupported type.
	MembershipMatchingState_MEMBERSHIP_UNKNOWN_UNSUPPORTED MembershipMatchingState = 4
)

func (MembershipMatchingState) Descriptor

func (MembershipMatchingState) Descriptor() protoreflect.EnumDescriptor

func (MembershipMatchingState) Enum

func (x MembershipMatchingState) Enum() *MembershipMatchingState

func (MembershipMatchingState) EnumDescriptor

func (MembershipMatchingState) EnumDescriptor() ([]byte, []int)

Deprecated: Use MembershipMatchingState.Descriptor instead.

func (MembershipMatchingState) Number

func (x MembershipMatchingState) Number() protoreflect.EnumNumber

func (MembershipMatchingState) String

func (x MembershipMatchingState) String() string

func (MembershipMatchingState) Type

func (MembershipMatchingState) Type() protoreflect.EnumType

PermissionPatternMatchingState

type PermissionPatternMatchingState int32

Whether the permission in the request matches the permission in the policy.

PermissionPatternMatchingState_PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED, PermissionPatternMatchingState_PERMISSION_PATTERN_MATCHED, PermissionPatternMatchingState_PERMISSION_PATTERN_NOT_MATCHED

const (
	// Not specified.
	PermissionPatternMatchingState_PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED PermissionPatternMatchingState = 0
	// The permission in the request matches the permission in the policy.
	PermissionPatternMatchingState_PERMISSION_PATTERN_MATCHED PermissionPatternMatchingState = 1
	// The permission in the request matches the permission in the policy.
	PermissionPatternMatchingState_PERMISSION_PATTERN_NOT_MATCHED PermissionPatternMatchingState = 2
)

func (PermissionPatternMatchingState) Descriptor

func (PermissionPatternMatchingState) Descriptor() protoreflect.EnumDescriptor

func (PermissionPatternMatchingState) Enum

func (x PermissionPatternMatchingState) Enum() *PermissionPatternMatchingState

func (PermissionPatternMatchingState) EnumDescriptor

func (PermissionPatternMatchingState) EnumDescriptor() ([]byte, []int)

Deprecated: Use PermissionPatternMatchingState.Descriptor instead.

func (PermissionPatternMatchingState) Number

func (x PermissionPatternMatchingState) Number() protoreflect.EnumNumber

func (PermissionPatternMatchingState) String

func (x PermissionPatternMatchingState) String() string

func (PermissionPatternMatchingState) Type

func (PermissionPatternMatchingState) Type() protoreflect.EnumType

PolicyTroubleshooterClient

type PolicyTroubleshooterClient interface {
	// Checks whether a principal has a specific permission for a specific
	// resource, and explains why the principal does or doesn't have that
	// permission.
	TroubleshootIamPolicy(ctx context.Context, in *TroubleshootIamPolicyRequest, opts ...grpc.CallOption) (*TroubleshootIamPolicyResponse, error)
}

PolicyTroubleshooterClient is the client API for PolicyTroubleshooter service.

For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.

func NewPolicyTroubleshooterClient

func NewPolicyTroubleshooterClient(cc grpc.ClientConnInterface) PolicyTroubleshooterClient

PolicyTroubleshooterServer

type PolicyTroubleshooterServer interface {
	// Checks whether a principal has a specific permission for a specific
	// resource, and explains why the principal does or doesn't have that
	// permission.
	TroubleshootIamPolicy(context.Context, *TroubleshootIamPolicyRequest) (*TroubleshootIamPolicyResponse, error)
}

PolicyTroubleshooterServer is the server API for PolicyTroubleshooter service.

RolePermissionInclusionState

type RolePermissionInclusionState int32

Whether a role includes a specific permission.

RolePermissionInclusionState_ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED, RolePermissionInclusionState_ROLE_PERMISSION_INCLUDED, RolePermissionInclusionState_ROLE_PERMISSION_NOT_INCLUDED, RolePermissionInclusionState_ROLE_PERMISSION_UNKNOWN_INFO

const (
	// Not specified.
	RolePermissionInclusionState_ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED RolePermissionInclusionState = 0
	// The permission is included in the role.
	RolePermissionInclusionState_ROLE_PERMISSION_INCLUDED RolePermissionInclusionState = 1
	// The permission is not included in the role.
	RolePermissionInclusionState_ROLE_PERMISSION_NOT_INCLUDED RolePermissionInclusionState = 2
	// The sender of the request is not allowed to access the role definition.
	RolePermissionInclusionState_ROLE_PERMISSION_UNKNOWN_INFO RolePermissionInclusionState = 3
)

func (RolePermissionInclusionState) Descriptor

func (RolePermissionInclusionState) Descriptor() protoreflect.EnumDescriptor

func (RolePermissionInclusionState) Enum

func (x RolePermissionInclusionState) Enum() *RolePermissionInclusionState

func (RolePermissionInclusionState) EnumDescriptor

func (RolePermissionInclusionState) EnumDescriptor() ([]byte, []int)

Deprecated: Use RolePermissionInclusionState.Descriptor instead.

func (RolePermissionInclusionState) Number

func (x RolePermissionInclusionState) Number() protoreflect.EnumNumber

func (RolePermissionInclusionState) String

func (x RolePermissionInclusionState) String() string

func (RolePermissionInclusionState) Type

func (RolePermissionInclusionState) Type() protoreflect.EnumType

TroubleshootIamPolicyRequest

type TroubleshootIamPolicyRequest struct {

	// The information to use for checking whether a principal has a permission
	// for a resource.
	AccessTuple *AccessTuple `protobuf:"bytes,1,opt,name=access_tuple,json=accessTuple,proto3" json:"access_tuple,omitempty"`
	// contains filtered or unexported fields
}

Request for [TroubleshootIamPolicy][google.cloud.policytroubleshooter.iam.v3.PolicyTroubleshooter.TroubleshootIamPolicy].

func (*TroubleshootIamPolicyRequest) Descriptor

func (*TroubleshootIamPolicyRequest) Descriptor() ([]byte, []int)

Deprecated: Use TroubleshootIamPolicyRequest.ProtoReflect.Descriptor instead.

func (*TroubleshootIamPolicyRequest) GetAccessTuple

func (x *TroubleshootIamPolicyRequest) GetAccessTuple() *AccessTuple

func (*TroubleshootIamPolicyRequest) ProtoMessage

func (*TroubleshootIamPolicyRequest) ProtoMessage()

func (*TroubleshootIamPolicyRequest) ProtoReflect

func (x *TroubleshootIamPolicyRequest) ProtoReflect() protoreflect.Message

func (*TroubleshootIamPolicyRequest) Reset

func (x *TroubleshootIamPolicyRequest) Reset()

func (*TroubleshootIamPolicyRequest) String

func (x *TroubleshootIamPolicyRequest) String() string

TroubleshootIamPolicyResponse

type TroubleshootIamPolicyResponse struct {
	OverallAccessState TroubleshootIamPolicyResponse_OverallAccessState "" /* 213 byte string literal not displayed */

	AccessTuple *AccessTuple `protobuf:"bytes,2,opt,name=access_tuple,json=accessTuple,proto3" json:"access_tuple,omitempty"`

	AllowPolicyExplanation *AllowPolicyExplanation "" /* 129 byte string literal not displayed */

	DenyPolicyExplanation *DenyPolicyExplanation `protobuf:"bytes,4,opt,name=deny_policy_explanation,json=denyPolicyExplanation,proto3" json:"deny_policy_explanation,omitempty"`

}

Response for [TroubleshootIamPolicy][google.cloud.policytroubleshooter.iam.v3.PolicyTroubleshooter.TroubleshootIamPolicy].

func (*TroubleshootIamPolicyResponse) Descriptor

func (*TroubleshootIamPolicyResponse) Descriptor() ([]byte, []int)

Deprecated: Use TroubleshootIamPolicyResponse.ProtoReflect.Descriptor instead.

func (*TroubleshootIamPolicyResponse) GetAccessTuple

func (x *TroubleshootIamPolicyResponse) GetAccessTuple() *AccessTuple

func (*TroubleshootIamPolicyResponse) GetAllowPolicyExplanation

func (x *TroubleshootIamPolicyResponse) GetAllowPolicyExplanation() *AllowPolicyExplanation

func (*TroubleshootIamPolicyResponse) GetDenyPolicyExplanation

func (x *TroubleshootIamPolicyResponse) GetDenyPolicyExplanation() *DenyPolicyExplanation

func (*TroubleshootIamPolicyResponse) GetOverallAccessState

func (x *TroubleshootIamPolicyResponse) GetOverallAccessState() TroubleshootIamPolicyResponse_OverallAccessState

func (*TroubleshootIamPolicyResponse) ProtoMessage

func (*TroubleshootIamPolicyResponse) ProtoMessage()

func (*TroubleshootIamPolicyResponse) ProtoReflect

func (x *TroubleshootIamPolicyResponse) ProtoReflect() protoreflect.Message

func (*TroubleshootIamPolicyResponse) Reset

func (x *TroubleshootIamPolicyResponse) Reset()

func (*TroubleshootIamPolicyResponse) String

func (x *TroubleshootIamPolicyResponse) String() string

TroubleshootIamPolicyResponse_OverallAccessState

type TroubleshootIamPolicyResponse_OverallAccessState int32

Whether the principal has the permission on the resource.

TroubleshootIamPolicyResponse_OVERALL_ACCESS_STATE_UNSPECIFIED, TroubleshootIamPolicyResponse_CAN_ACCESS, TroubleshootIamPolicyResponse_CANNOT_ACCESS, TroubleshootIamPolicyResponse_UNKNOWN_INFO, TroubleshootIamPolicyResponse_UNKNOWN_CONDITIONAL

const (
	// Not specified.
	TroubleshootIamPolicyResponse_OVERALL_ACCESS_STATE_UNSPECIFIED TroubleshootIamPolicyResponse_OverallAccessState = 0
	// The principal has the permission.
	TroubleshootIamPolicyResponse_CAN_ACCESS TroubleshootIamPolicyResponse_OverallAccessState = 1
	// The principal doesn't have the permission.
	TroubleshootIamPolicyResponse_CANNOT_ACCESS TroubleshootIamPolicyResponse_OverallAccessState = 2
	// The principal might have the permission, but the sender can't access all
	// of the information needed to fully evaluate the principal's access.
	TroubleshootIamPolicyResponse_UNKNOWN_INFO TroubleshootIamPolicyResponse_OverallAccessState = 3
	// The principal might have the permission, but Policy Troubleshooter can't
	// fully evaluate the principal's access because the sender didn't provide
	// the required context to evaluate the condition.
	TroubleshootIamPolicyResponse_UNKNOWN_CONDITIONAL TroubleshootIamPolicyResponse_OverallAccessState = 4
)

func (TroubleshootIamPolicyResponse_OverallAccessState) Descriptor

func (TroubleshootIamPolicyResponse_OverallAccessState) Descriptor() protoreflect.EnumDescriptor

func (TroubleshootIamPolicyResponse_OverallAccessState) Enum

func (x TroubleshootIamPolicyResponse_OverallAccessState) Enum() *TroubleshootIamPolicyResponse_OverallAccessState

func (TroubleshootIamPolicyResponse_OverallAccessState) EnumDescriptor

func (TroubleshootIamPolicyResponse_OverallAccessState) EnumDescriptor() ([]byte, []int)

Deprecated: Use TroubleshootIamPolicyResponse_OverallAccessState.Descriptor instead.

func (TroubleshootIamPolicyResponse_OverallAccessState) Number

func (x TroubleshootIamPolicyResponse_OverallAccessState) Number() protoreflect.EnumNumber

func (TroubleshootIamPolicyResponse_OverallAccessState) String

func (x TroubleshootIamPolicyResponse_OverallAccessState) String() string

func (TroubleshootIamPolicyResponse_OverallAccessState) Type

func (TroubleshootIamPolicyResponse_OverallAccessState) Type() protoreflect.EnumType

UnimplementedPolicyTroubleshooterServer

type UnimplementedPolicyTroubleshooterServer struct {
}

UnimplementedPolicyTroubleshooterServer can be embedded to have forward compatible implementations.

func (*UnimplementedPolicyTroubleshooterServer) TroubleshootIamPolicy

func (*UnimplementedPolicyTroubleshooterServer) TroubleshootIamPolicy(context.Context, *TroubleshootIamPolicyRequest) (*TroubleshootIamPolicyResponse, error)