{ "baseUrl": "https://assuredworkloads.googleapis.com/", "description": "", "ownerName": "Google", "canonicalName": "Assuredworkloads", "version_module": true, "batchPath": "batch", "ownerDomain": "google.com", "kind": "discovery#restDescription", "rootUrl": "https://assuredworkloads.googleapis.com/", "revision": "20261026", "version": "v1beta1", "title": "Assured Workloads API", "name": "assuredworkloads", "documentationLink": "https://cloud.google.com/learnmoreurl", "resources": { "projects": { "resources": { "locations": { "resources": { "dbFrameworkComplianceSummaries": { "methods": { "list": { "parameters": { "view": { "location": "query", "description": "Optional. The level of detail to return for each summary. If not specified, `FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_BASIC` is used.", "enum": [ "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_UNSPECIFIED", "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_BASIC", "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_FULL" ], "type": "string", "enumDescriptions": [ "The default / unset value. The API will default to the BASIC view.", "Includes basic compliance metadata, but omits trend data.", "Includes all information, including finding_count and controls_passing_trend. Trend data is provided for the last 30 days." ] }, "parent": { "description": "Required. The parent scope to list framework compliance summaries for. Formats: * `organizations/{organization}/locations/{location}` * `folders/{folder}/locations/{location}` * `projects/{project}/locations/{location}`", "type": "string", "required": true, "pattern": "^projects/[^/]+/locations/[^/]+$", "location": "path" }, "filter": { "type": "string", "description": "Optional. A filter expression that restricts the results. Reserved for future use.", "location": "query" }, "pageSize": { "format": "int32", "location": "query", "type": "integer", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the default page size is 50. The maximum value is 1000." }, "pageToken": { "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "location": "query", "type": "string" } }, "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/dbFrameworkComplianceSummaries", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbFrameworkComplianceSummariesResponse" }, "path": "v1beta1/{+parent}/dbFrameworkComplianceSummaries", "httpMethod": "GET", "parameterOrder": [ "parent" ], "description": "Lists the compliance summaries of the frameworks that are deployed in a Data Boundary scope (an organization, folder, or project).", "id": "assuredworkloads.projects.locations.dbFrameworkComplianceSummaries.list" } } }, "dbFindingSummaries": { "methods": { "list": { "description": "Lists summaries of the active findings in a Data Boundary scope (an organization, folder, or project), with one summary for each finding category.", "parameters": { "parent": { "pattern": "^projects/[^/]+/locations/[^/]+$", "description": "Required. The parent scope to list finding summaries for. Formats: * `organizations/{organization}/locations/{location}` * `folders/{folder}/locations/{location}` * `projects/{project}/locations/{location}`", "location": "path", "required": true, "type": "string" }, "pageToken": { "location": "query", "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "type": "string" }, "pageSize": { "type": "integer", "location": "query", "format": "int32", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the server picks an appropriate default." }, "filter": { "location": "query", "description": "Optional. A filter expression that restricts the framework deployments whose findings are summarized. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, and `framework_revision` (the major revision ID of the framework).", "type": "string" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v1beta1/{+parent}/dbFindingSummaries", "parameterOrder": [ "parent" ], "httpMethod": "GET", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbFindingSummariesResponse" }, "id": "assuredworkloads.projects.locations.dbFindingSummaries.list", "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/dbFindingSummaries" } } }, "dbFrameworkComplianceReports": { "resources": { "dbControlComplianceSummaries": { "methods": { "list": { "description": "Lists the compliance summaries of the controls in a framework compliance report.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbControlComplianceSummariesResponse" }, "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}/dbControlComplianceSummaries", "id": "assuredworkloads.projects.locations.dbFrameworkComplianceReports.dbControlComplianceSummaries.list", "parameterOrder": [ "parent" ], "httpMethod": "GET", "parameters": { "pageToken": { "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "location": "query", "type": "string" }, "parent": { "required": true, "type": "string", "location": "path", "pattern": "^projects/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "description": "Required. The framework compliance report to list control compliance summaries for. Formats: * `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `folders/{folder}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `projects/{project}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`" }, "filter": { "location": "query", "description": "Optional. A filter expression that restricts the results. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, `framework_revision` (the major revision ID of the framework), and `end_time`. The `end_time` field accepts a single equality comparison with an [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) timestamp, for example `end_time = \"2026-01-01T00:00:00Z\"`. Only findings that were updated at or after this time are counted.", "type": "string" }, "pageSize": { "type": "integer", "format": "int32", "location": "query", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the default page size is 50. The maximum value is 1000." } }, "path": "v1beta1/{+parent}/dbControlComplianceSummaries" } } } }, "methods": { "fetch": { "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1FetchDbFrameworkComplianceReportResponse" }, "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}:fetch", "httpMethod": "GET", "description": "Fetches the current compliance report for a framework that's deployed in a Data Boundary scope (an organization, folder, or project). The report includes the number of passing, failing, and not assessed controls in the framework.", "parameters": { "filter": { "description": "Optional. A filter expression that restricts the results. Reserved for future use.", "location": "query", "type": "string" }, "endTime": { "type": "string", "description": "Optional. The end time of the report. Reserved for future use. Currently, the report always reflects the current compliance state.", "format": "google-datetime", "location": "query" }, "name": { "description": "Required. The name of the framework compliance report to retrieve. The report ID is the ID of the compliance framework, for example `builtin-fedramp-high`. Formats: * `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `folders/{folder}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `projects/{project}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "pattern": "^projects/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "type": "string", "required": true, "location": "path" } }, "parameterOrder": [ "name" ], "path": "v1beta1/{+name}:fetch", "id": "assuredworkloads.projects.locations.dbFrameworkComplianceReports.fetch", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "aggregate": { "httpMethod": "GET", "flatPath": "v1beta1/projects/{projectsId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}:aggregate", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AggregateDbFrameworkComplianceReportResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameters": { "interval.endTime": { "location": "query", "type": "string", "format": "google-datetime", "description": "Optional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end." }, "interval.startTime": { "location": "query", "description": "Optional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.", "format": "google-datetime", "type": "string" }, "name": { "type": "string", "description": "Required. The name of the framework compliance report to aggregate over time. The report ID is the ID of the compliance framework, for example `builtin-fedramp-high`. Format: `organizations/{organization_id}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "location": "path", "pattern": "^projects/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "required": true }, "filter": { "location": "query", "description": "Optional. A filter expression that restricts the framework deployments that are included in the report. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, and `framework_revision` (the major revision ID of the framework).", "type": "string" } }, "path": "v1beta1/{+name}:aggregate", "description": "Gets daily compliance reports over a time range for a framework that's deployed in a Data Boundary scope.", "id": "assuredworkloads.projects.locations.dbFrameworkComplianceReports.aggregate", "parameterOrder": [ "name" ] } } } } } } }, "folders": { "resources": { "locations": { "resources": { "dbFrameworkComplianceReports": { "resources": { "dbControlComplianceSummaries": { "methods": { "list": { "id": "assuredworkloads.folders.locations.dbFrameworkComplianceReports.dbControlComplianceSummaries.list", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameters": { "pageToken": { "location": "query", "type": "string", "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result." }, "filter": { "description": "Optional. A filter expression that restricts the results. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, `framework_revision` (the major revision ID of the framework), and `end_time`. The `end_time` field accepts a single equality comparison with an [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) timestamp, for example `end_time = \"2026-01-01T00:00:00Z\"`. Only findings that were updated at or after this time are counted.", "location": "query", "type": "string" }, "parent": { "pattern": "^folders/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "description": "Required. The framework compliance report to list control compliance summaries for. Formats: * `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `folders/{folder}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `projects/{project}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "required": true, "location": "path", "type": "string" }, "pageSize": { "type": "integer", "location": "query", "format": "int32", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the default page size is 50. The maximum value is 1000." } }, "httpMethod": "GET", "path": "v1beta1/{+parent}/dbControlComplianceSummaries", "flatPath": "v1beta1/folders/{foldersId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}/dbControlComplianceSummaries", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbControlComplianceSummariesResponse" }, "parameterOrder": [ "parent" ], "description": "Lists the compliance summaries of the controls in a framework compliance report." } } } }, "methods": { "fetch": { "httpMethod": "GET", "parameterOrder": [ "name" ], "description": "Fetches the current compliance report for a framework that's deployed in a Data Boundary scope (an organization, folder, or project). The report includes the number of passing, failing, and not assessed controls in the framework.", "path": "v1beta1/{+name}:fetch", "id": "assuredworkloads.folders.locations.dbFrameworkComplianceReports.fetch", "parameters": { "name": { "required": true, "pattern": "^folders/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "description": "Required. The name of the framework compliance report to retrieve. The report ID is the ID of the compliance framework, for example `builtin-fedramp-high`. Formats: * `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `folders/{folder}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `projects/{project}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "location": "path", "type": "string" }, "filter": { "location": "query", "description": "Optional. A filter expression that restricts the results. Reserved for future use.", "type": "string" }, "endTime": { "format": "google-datetime", "type": "string", "description": "Optional. The end time of the report. Reserved for future use. Currently, the report always reflects the current compliance state.", "location": "query" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1FetchDbFrameworkComplianceReportResponse" }, "flatPath": "v1beta1/folders/{foldersId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}:fetch" }, "aggregate": { "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AggregateDbFrameworkComplianceReportResponse" }, "flatPath": "v1beta1/folders/{foldersId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}:aggregate", "parameterOrder": [ "name" ], "httpMethod": "GET", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v1beta1/{+name}:aggregate", "description": "Gets daily compliance reports over a time range for a framework that's deployed in a Data Boundary scope.", "id": "assuredworkloads.folders.locations.dbFrameworkComplianceReports.aggregate", "parameters": { "name": { "description": "Required. The name of the framework compliance report to aggregate over time. The report ID is the ID of the compliance framework, for example `builtin-fedramp-high`. Format: `organizations/{organization_id}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "type": "string", "required": true, "pattern": "^folders/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "location": "path" }, "interval.endTime": { "description": "Optional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.", "location": "query", "format": "google-datetime", "type": "string" }, "filter": { "type": "string", "description": "Optional. A filter expression that restricts the framework deployments that are included in the report. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, and `framework_revision` (the major revision ID of the framework).", "location": "query" }, "interval.startTime": { "type": "string", "format": "google-datetime", "location": "query", "description": "Optional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start." } } } } }, "dbFindingSummaries": { "methods": { "list": { "parameterOrder": [ "parent" ], "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.folders.locations.dbFindingSummaries.list", "description": "Lists summaries of the active findings in a Data Boundary scope (an organization, folder, or project), with one summary for each finding category.", "httpMethod": "GET", "parameters": { "pageSize": { "type": "integer", "format": "int32", "location": "query", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the server picks an appropriate default." }, "filter": { "location": "query", "type": "string", "description": "Optional. A filter expression that restricts the framework deployments whose findings are summarized. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, and `framework_revision` (the major revision ID of the framework)." }, "parent": { "location": "path", "description": "Required. The parent scope to list finding summaries for. Formats: * `organizations/{organization}/locations/{location}` * `folders/{folder}/locations/{location}` * `projects/{project}/locations/{location}`", "required": true, "type": "string", "pattern": "^folders/[^/]+/locations/[^/]+$" }, "pageToken": { "location": "query", "type": "string", "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result." } }, "path": "v1beta1/{+parent}/dbFindingSummaries", "flatPath": "v1beta1/folders/{foldersId}/locations/{locationsId}/dbFindingSummaries", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbFindingSummariesResponse" } } } }, "dbFrameworkComplianceSummaries": { "methods": { "list": { "id": "assuredworkloads.folders.locations.dbFrameworkComplianceSummaries.list", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "parent" ], "flatPath": "v1beta1/folders/{foldersId}/locations/{locationsId}/dbFrameworkComplianceSummaries", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbFrameworkComplianceSummariesResponse" }, "httpMethod": "GET", "path": "v1beta1/{+parent}/dbFrameworkComplianceSummaries", "parameters": { "pageToken": { "type": "string", "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "location": "query" }, "view": { "type": "string", "enum": [ "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_UNSPECIFIED", "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_BASIC", "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_FULL" ], "enumDescriptions": [ "The default / unset value. The API will default to the BASIC view.", "Includes basic compliance metadata, but omits trend data.", "Includes all information, including finding_count and controls_passing_trend. Trend data is provided for the last 30 days." ], "description": "Optional. The level of detail to return for each summary. If not specified, `FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_BASIC` is used.", "location": "query" }, "pageSize": { "location": "query", "type": "integer", "format": "int32", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the default page size is 50. The maximum value is 1000." }, "filter": { "location": "query", "description": "Optional. A filter expression that restricts the results. Reserved for future use.", "type": "string" }, "parent": { "pattern": "^folders/[^/]+/locations/[^/]+$", "required": true, "description": "Required. The parent scope to list framework compliance summaries for. Formats: * `organizations/{organization}/locations/{location}` * `folders/{folder}/locations/{location}` * `projects/{project}/locations/{location}`", "type": "string", "location": "path" } }, "description": "Lists the compliance summaries of the frameworks that are deployed in a Data Boundary scope (an organization, folder, or project)." } } } } } } }, "organizations": { "resources": { "locations": { "resources": { "dbFindingSummaries": { "methods": { "list": { "id": "assuredworkloads.organizations.locations.dbFindingSummaries.list", "parameters": { "filter": { "type": "string", "location": "query", "description": "Optional. A filter expression that restricts the framework deployments whose findings are summarized. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, and `framework_revision` (the major revision ID of the framework)." }, "pageSize": { "format": "int32", "type": "integer", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the server picks an appropriate default.", "location": "query" }, "pageToken": { "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "type": "string", "location": "query" }, "parent": { "location": "path", "description": "Required. The parent scope to list finding summaries for. Formats: * `organizations/{organization}/locations/{location}` * `folders/{folder}/locations/{location}` * `projects/{project}/locations/{location}`", "type": "string", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+$" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "path": "v1beta1/{+parent}/dbFindingSummaries", "description": "Lists summaries of the active findings in a Data Boundary scope (an organization, folder, or project), with one summary for each finding category.", "parameterOrder": [ "parent" ], "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/dbFindingSummaries", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbFindingSummariesResponse" } } } }, "operations": { "methods": { "list": { "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/operations", "response": { "$ref": "GoogleLongrunningListOperationsResponse" }, "parameterOrder": [ "name" ], "id": "assuredworkloads.organizations.locations.operations.list", "path": "v1beta1/{+name}/operations", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`.", "parameters": { "pageToken": { "location": "query", "type": "string", "description": "The standard list page token." }, "name": { "type": "string", "pattern": "^organizations/[^/]+/locations/[^/]+$", "description": "The name of the operation's parent resource.", "required": true, "location": "path" }, "pageSize": { "type": "integer", "format": "int32", "location": "query", "description": "The standard list page size." }, "returnPartialSuccess": { "location": "query", "description": "When set to `true`, operations that are reachable are returned as normal, and those that are unreachable are returned in the ListOperationsResponse.unreachable field. This can only be `true` when reading across collections. For example, when `parent` is set to `\"projects/example/locations/-\"`. This field is not supported by default and will result in an `UNIMPLEMENTED` error if set unless explicitly documented otherwise in service or product specific documentation.", "type": "boolean" }, "filter": { "description": "The standard list filter.", "type": "string", "location": "query" } }, "httpMethod": "GET" }, "get": { "description": "Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.", "parameters": { "name": { "pattern": "^organizations/[^/]+/locations/[^/]+/operations/[^/]+$", "type": "string", "required": true, "description": "The name of the operation resource.", "location": "path" } }, "httpMethod": "GET", "parameterOrder": [ "name" ], "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/operations/{operationsId}", "response": { "$ref": "GoogleLongrunningOperation" }, "path": "v1beta1/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.operations.get" } } }, "workloads": { "methods": { "list": { "parameters": { "filter": { "type": "string", "location": "query", "description": "Optional. A custom filter for filtering by properties of a workload. At this time, only filtering by labels is supported." }, "pageSize": { "type": "integer", "location": "query", "description": "Optional. Page size.", "format": "int32" }, "parent": { "pattern": "^organizations/[^/]+/locations/[^/]+$", "type": "string", "description": "Required. Parent Resource to list workloads from. Must be of the form `organizations/{org_id}/locations/{location}`.", "required": true, "location": "path" }, "pageToken": { "location": "query", "type": "string", "description": "Optional. Page token returned from previous request. Page token contains context from previous request. Page token needs to be passed in the second and following requests." } }, "id": "assuredworkloads.organizations.locations.workloads.list", "httpMethod": "GET", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Lists Assured Workloads under a CRM Node.", "path": "v1beta1/{+parent}/workloads", "parameterOrder": [ "parent" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListWorkloadsResponse" }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads" }, "get": { "parameters": { "name": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "location": "path", "description": "Required. The resource name of the Workload to fetch. This is the workloads's relative path in the API, formatted as \"organizations/{organization_id}/locations/{location_id}/workloads/{workload_id}\". For example, \"organizations/123/locations/us-east1/workloads/assured-workload-1\".", "type": "string" } }, "httpMethod": "GET", "description": "Gets Assured Workload associated with a CRM Node", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.workloads.get", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Workload" }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}", "path": "v1beta1/{+name}", "parameterOrder": [ "name" ] }, "restrictAllowedResources": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.workloads.restrictAllowedResources", "parameterOrder": [ "name" ], "request": { "$ref": "GoogleCloudAssuredworkloadsV1beta1RestrictAllowedResourcesRequest" }, "path": "v1beta1/{+name}:restrictAllowedResources", "httpMethod": "POST", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}:restrictAllowedResources", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1RestrictAllowedResourcesResponse" }, "parameters": { "name": { "required": true, "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "description": "Required. The resource name of the Workload. This is the workloads's relative path in the API, formatted as \"organizations/{organization_id}/locations/{location_id}/workloads/{workload_id}\". For example, \"organizations/123/locations/us-east1/workloads/assured-workload-1\".", "type": "string" } }, "description": "Restrict the list of resources allowed in the Workload environment. The current list of allowed products can be found at https://cloud.google.com/assured-workloads/docs/supported-products In addition to assuredworkloads.workload.update permission, the user should also have orgpolicy.policy.set permission on the folder resource to use this functionality." }, "create": { "path": "v1beta1/{+parent}/workloads", "response": { "$ref": "GoogleLongrunningOperation" }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads", "request": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Workload" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Creates Assured Workload.", "parameters": { "externalId": { "location": "query", "description": "Optional. A identifier associated with the workload and underlying projects which allows for the break down of billing costs for a workload. The value provided for the identifier will add a label to the workload and contained projects with the identifier as the value.", "type": "string" }, "parent": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+$", "location": "path", "type": "string", "description": "Required. The resource name of the new Workload's parent. Must be of the form `organizations/{org_id}/locations/{location_id}`." } }, "httpMethod": "POST", "id": "assuredworkloads.organizations.locations.workloads.create", "parameterOrder": [ "parent" ] }, "delete": { "httpMethod": "DELETE", "parameters": { "name": { "description": "Required. The `name` field is used to identify the workload. Format: organizations/{org_id}/locations/{location_id}/workloads/{workload_id}", "location": "path", "type": "string", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$" }, "etag": { "location": "query", "description": "Optional. The etag of the workload. If this is provided, it must match the server's etag.", "type": "string" } }, "response": { "$ref": "GoogleProtobufEmpty" }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}", "parameterOrder": [ "name" ], "path": "v1beta1/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Deletes the workload. Make sure that workload's direct children are already in a deleted state, otherwise the request will fail with a FAILED_PRECONDITION error. In addition to assuredworkloads.workload.delete permission, the user should also have orgpolicy.policy.set permission on the deleted folder to remove Assured Workloads OrgPolicies.", "id": "assuredworkloads.organizations.locations.workloads.delete" }, "analyzeWorkloadMove": { "parameterOrder": [ "target" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AnalyzeWorkloadMoveResponse" }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}:analyzeWorkloadMove", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.workloads.analyzeWorkloadMove", "parameters": { "assetTypes": { "type": "string", "repeated": true, "location": "query", "description": "Optional. List of asset types to be analyzed, including and under the source resource. If empty, all assets are analyzed. The complete list of asset types is available [here](https://cloud.google.com/asset-inventory/docs/supported-asset-types)." }, "pageToken": { "description": "Optional. The page token from the previous response. It needs to be passed in the second and following requests.", "location": "query", "type": "string" }, "project": { "description": "The source type is a project. Specify the project's relative resource name, formatted as either a project number or a project ID: \"projects/{PROJECT_NUMBER}\" or \"projects/{PROJECT_ID}\" For example: \"projects/951040570662\" when specifying a project number, or \"projects/my-project-123\" when specifying a project ID.", "type": "string", "location": "query" }, "pageSize": { "description": "Optional. Page size. If a value is not specified, the default value of 10 is used. The maximum value is 50.", "location": "query", "format": "int32", "type": "integer" }, "target": { "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "type": "string", "location": "path", "description": "Required. The resource ID of the folder-based destination workload. This workload is where the source resource will hypothetically be moved to. Specify the workload's relative resource name, formatted as: \"organizations/{ORGANIZATION_ID}/locations/{LOCATION_ID}/workloads/{WORKLOAD_ID}\" For example: \"organizations/123/locations/us-east1/workloads/assured-workload-2\"" } }, "path": "v1beta1/{+target}:analyzeWorkloadMove", "httpMethod": "GET", "description": "Analyzes a hypothetical move of a source resource to a target workload to surface compliance risks. The analysis is best effort and is not guaranteed to be exhaustive." }, "patch": { "parameters": { "updateMask": { "description": "Required. The list of fields to be updated.", "format": "google-fieldmask", "location": "query", "type": "string" }, "name": { "type": "string", "required": true, "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "description": "Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only." } }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Workload" }, "id": "assuredworkloads.organizations.locations.workloads.patch", "request": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Workload" }, "httpMethod": "PATCH", "path": "v1beta1/{+name}", "description": "Updates an existing workload. Currently allows updating of workload display_name and labels. For force updates don't set etag field in the Workload. Only one update operation per workload can be in progress.", "parameterOrder": [ "name" ] }, "enableComplianceUpdates": { "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}:enableComplianceUpdates", "description": "This endpoint enables Assured Workloads service to offer compliance updates for the folder based assured workload. It sets up an Assured Workloads Service Agent, having permissions to read compliance controls (for example: Org Policies) applied on the workload. The caller must have `resourcemanager.folders.getIamPolicy` and `resourcemanager.folders.setIamPolicy` permissions on the assured workload folder.", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1EnableComplianceUpdatesResponse" }, "parameters": { "name": { "description": "Required. The `name` field is used to identify the workload. Format: organizations/{org_id}/locations/{location_id}/workloads/{workload_id}", "location": "path", "required": true, "type": "string", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$" } }, "path": "v1beta1/{+name}:enableComplianceUpdates", "httpMethod": "PUT", "id": "assuredworkloads.organizations.locations.workloads.enableComplianceUpdates", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ] }, "enableResourceMonitoring": { "id": "assuredworkloads.organizations.locations.workloads.enableResourceMonitoring", "path": "v1beta1/{+name}:enableResourceMonitoring", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Enable resource violation monitoring for a workload.", "parameterOrder": [ "name" ], "httpMethod": "POST", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}:enableResourceMonitoring", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1EnableResourceMonitoringResponse" }, "parameters": { "name": { "type": "string", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "description": "Required. The `name` field is used to identify the workload. Format: organizations/{org_id}/locations/{location_id}/workloads/{workload_id}", "location": "path" } } } }, "resources": { "violations": { "methods": { "acknowledge": { "parameterOrder": [ "name" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AcknowledgeViolationResponse" }, "path": "v1beta1/{+name}:acknowledge", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}/violations/{violationsId}:acknowledge", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Acknowledges an existing violation. By acknowledging a violation, users acknowledge the existence of a compliance violation in their workload and decide to ignore it due to a valid business justification. Acknowledgement is a permanent operation and it cannot be reverted.", "id": "assuredworkloads.organizations.locations.workloads.violations.acknowledge", "httpMethod": "POST", "request": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AcknowledgeViolationRequest" }, "parameters": { "name": { "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+/violations/[^/]+$", "description": "Required. The resource name of the violation to acknowledge. Format: `organizations/{organization}/locations/{location}/workloads/{workload}/violations/{violation}`", "type": "string", "location": "path", "required": true } } }, "list": { "path": "v1beta1/{+parent}/violations", "parameterOrder": [ "parent" ], "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}/violations", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListViolationsResponse" }, "httpMethod": "GET", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.workloads.violations.list", "description": "Lists the Violations in the AssuredWorkload Environment. Callers may also choose to read across multiple Workloads as per [AIP-159](https://google.aip.dev/159) by using '-' (the hyphen or dash character) as a wildcard character instead of workload-id in the parent. Format `organizations/{org_id}/locations/{location}/workloads/-`", "parameters": { "pageToken": { "description": "Optional. A page token, received from a previous `ListViolations` call. Provide this token to retrieve the subsequent page. When paginating, all other parameters that are provided to `ListViolations` must match the call that provided the page token.", "location": "query", "type": "string" }, "view": { "enum": [ "VIOLATION_VIEW_UNSPECIFIED", "VIOLATION_VIEW_ASSURED_WORKLOADS", "VIOLATION_VIEW_DATA_BOUNDARY" ], "type": "string", "description": "Optional. The violation view (`VIOLATION_VIEW_ASSURED_WORKLOADS` or `VIOLATION_VIEW_DATA_BOUNDARY`) to list violations for. If not specified, `VIOLATION_VIEW_ASSURED_WORKLOADS` is used.", "enumDescriptions": [ "Defaults to the ASSURED_WORKLOADS view.", "Includes the basic metadata about the violation.", "Includes all information about the violation, including details about the data boundary." ], "location": "query" }, "pageSize": { "format": "int32", "description": "Optional. The maximum number of violations to return. The service might return fewer violations than this value. If unspecified, at most 100 violations are returned. The maximum value is 1000; values above 1000 are coerced to 1000.", "type": "integer", "location": "query" }, "orderBy": { "description": "Optional. A comma-separated list of fields to sort the results by. The default sort order is ascending; to sort in descending order, append ` desc` to the field name. For example, `update_time desc,category`. When `view` is `VIOLATION_VIEW_DATA_BOUNDARY`, the following fields are supported: `begin_time`, `update_time`, `resource_type`, `state`, and `category`. If not specified, results are sorted by `begin_time` in descending order.", "location": "query", "type": "string" }, "interval.startTime": { "format": "google-datetime", "description": "The start of the time window.", "type": "string", "location": "query" }, "interval.endTime": { "location": "query", "description": "The end of the time window.", "format": "google-datetime", "type": "string" }, "parent": { "location": "path", "required": true, "description": "Required. The workload to list violations for. To list violations across all workloads in an organization, use `-` as the workload ID. When `view` is `VIOLATION_VIEW_DATA_BOUNDARY`, violations are listed for the entire organization and location, and the workload ID is ignored. Format: `organizations/{organization}/locations/{location}/workloads/{workload}`", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "type": "string" }, "filter": { "location": "query", "description": "Optional. A filter expression that restricts the violations that are returned. The syntax follows [AIP-160](https://google.aip.dev/160). Only the equality operator (`=`) is supported, and expressions can be combined with `AND`, `OR`, and `NOT`. When `view` is `VIOLATION_VIEW_DATA_BOUNDARY`, the following fields are supported: `violationId`, `category`, `state` (`UNRESOLVED`, `RESOLVED`, or `EXCEPTION`), `violationType` (`ORG_POLICY` or `RESOURCE`), `resourceType`, `resourceName`, `project`, `associatedOrgPolicyViolationId`, `cloudControlName`, `workloadDisplayName`, and `complianceType` (a framework ID). Example: `state = \"UNRESOLVED\" AND complianceType = \"builtin-fedramp-high\"`", "type": "string" } } }, "get": { "description": "Retrieves an Assured Workloads violation by its resource name.", "parameters": { "name": { "location": "path", "required": true, "type": "string", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+/violations/[^/]+$", "description": "Required. The resource name of the violation to retrieve (that is, the value of `Violation.name`). Format: `organizations/{organization}/locations/{location}/workloads/{workload}/violations/{violation}`" }, "view": { "location": "query", "enumDescriptions": [ "Defaults to the ASSURED_WORKLOADS view.", "Includes the basic metadata about the violation.", "Includes all information about the violation, including details about the data boundary." ], "description": "Optional. The violation view (`VIOLATION_VIEW_ASSURED_WORKLOADS` or `VIOLATION_VIEW_DATA_BOUNDARY`) that the violation belongs to. If not specified, `VIOLATION_VIEW_ASSURED_WORKLOADS` is used.", "enum": [ "VIOLATION_VIEW_UNSPECIFIED", "VIOLATION_VIEW_ASSURED_WORKLOADS", "VIOLATION_VIEW_DATA_BOUNDARY" ], "type": "string" } }, "httpMethod": "GET", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v1beta1/{+name}", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}/violations/{violationsId}", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Violation" }, "parameterOrder": [ "name" ], "id": "assuredworkloads.organizations.locations.workloads.violations.get" } } }, "updates": { "methods": { "apply": { "description": "This endpoint creates a new operation to apply the given update.", "parameters": { "name": { "description": "Required. The resource name of the update. Format: organizations/{org_id}/locations/{location_id}/workloads/{workload_id}/updates/{update_id}", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+/updates/[^/]+$", "type": "string", "location": "path", "required": true } }, "httpMethod": "POST", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}/updates/{updatesId}:apply", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "GoogleLongrunningOperation" }, "request": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateRequest" }, "id": "assuredworkloads.organizations.locations.workloads.updates.apply", "path": "v1beta1/{+name}:apply", "parameterOrder": [ "name" ] }, "list": { "path": "v1beta1/{+parent}/updates", "description": "This endpoint lists all updates for the given workload.", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListWorkloadUpdatesResponse" }, "parameters": { "pageSize": { "description": "Page size. The default value is 20 and the max allowed value is 100.", "type": "integer", "location": "query", "format": "int32" }, "pageToken": { "description": "Page token returned from previous request.", "type": "string", "location": "query" }, "parent": { "type": "string", "description": "Required. organizations/{org_id}/locations/{location_id}/workloads/{workload_id}", "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+/workloads/[^/]+$", "required": true } }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/workloads/{workloadsId}/updates", "parameterOrder": [ "parent" ], "id": "assuredworkloads.organizations.locations.workloads.updates.list", "httpMethod": "GET", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] } } } } }, "dbFrameworkComplianceSummaries": { "methods": { "list": { "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbFrameworkComplianceSummariesResponse" }, "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/dbFrameworkComplianceSummaries", "path": "v1beta1/{+parent}/dbFrameworkComplianceSummaries", "parameterOrder": [ "parent" ], "description": "Lists the compliance summaries of the frameworks that are deployed in a Data Boundary scope (an organization, folder, or project).", "httpMethod": "GET", "parameters": { "pageSize": { "format": "int32", "location": "query", "type": "integer", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the default page size is 50. The maximum value is 1000." }, "parent": { "description": "Required. The parent scope to list framework compliance summaries for. Formats: * `organizations/{organization}/locations/{location}` * `folders/{folder}/locations/{location}` * `projects/{project}/locations/{location}`", "type": "string", "location": "path", "pattern": "^organizations/[^/]+/locations/[^/]+$", "required": true }, "view": { "enumDescriptions": [ "The default / unset value. The API will default to the BASIC view.", "Includes basic compliance metadata, but omits trend data.", "Includes all information, including finding_count and controls_passing_trend. Trend data is provided for the last 30 days." ], "description": "Optional. The level of detail to return for each summary. If not specified, `FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_BASIC` is used.", "type": "string", "enum": [ "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_UNSPECIFIED", "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_BASIC", "FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_FULL" ], "location": "query" }, "pageToken": { "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "location": "query", "type": "string" }, "filter": { "location": "query", "type": "string", "description": "Optional. A filter expression that restricts the results. Reserved for future use." } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.dbFrameworkComplianceSummaries.list" } } }, "dbFrameworkComplianceReports": { "resources": { "dbControlComplianceSummaries": { "methods": { "list": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "parent" ], "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ListDbControlComplianceSummariesResponse" }, "path": "v1beta1/{+parent}/dbControlComplianceSummaries", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}/dbControlComplianceSummaries", "parameters": { "filter": { "location": "query", "description": "Optional. A filter expression that restricts the results. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, `framework_revision` (the major revision ID of the framework), and `end_time`. The `end_time` field accepts a single equality comparison with an [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) timestamp, for example `end_time = \"2026-01-01T00:00:00Z\"`. Only findings that were updated at or after this time are counted.", "type": "string" }, "parent": { "pattern": "^organizations/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "type": "string", "location": "path", "description": "Required. The framework compliance report to list control compliance summaries for. Formats: * `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `folders/{folder}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `projects/{project}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "required": true }, "pageToken": { "location": "query", "description": "Optional. A token that identifies the page of results that the server should return. Pass the `next_page_token` value from a previous result.", "type": "string" }, "pageSize": { "format": "int32", "type": "integer", "description": "Optional. The requested page size. The server might return fewer items than requested. If unspecified, the default page size is 50. The maximum value is 1000.", "location": "query" } }, "id": "assuredworkloads.organizations.locations.dbFrameworkComplianceReports.dbControlComplianceSummaries.list", "httpMethod": "GET", "description": "Lists the compliance summaries of the controls in a framework compliance report." } } } }, "methods": { "fetch": { "path": "v1beta1/{+name}:fetch", "parameterOrder": [ "name" ], "httpMethod": "GET", "description": "Fetches the current compliance report for a framework that's deployed in a Data Boundary scope (an organization, folder, or project). The report includes the number of passing, failing, and not assessed controls in the framework.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameters": { "filter": { "location": "query", "type": "string", "description": "Optional. A filter expression that restricts the results. Reserved for future use." }, "name": { "type": "string", "location": "path", "description": "Required. The name of the framework compliance report to retrieve. The report ID is the ID of the compliance framework, for example `builtin-fedramp-high`. Formats: * `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `folders/{folder}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}` * `projects/{project}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "required": true, "pattern": "^organizations/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$" }, "endTime": { "location": "query", "description": "Optional. The end time of the report. Reserved for future use. Currently, the report always reflects the current compliance state.", "format": "google-datetime", "type": "string" } }, "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1FetchDbFrameworkComplianceReportResponse" }, "id": "assuredworkloads.organizations.locations.dbFrameworkComplianceReports.fetch", "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}:fetch" }, "aggregate": { "httpMethod": "GET", "description": "Gets daily compliance reports over a time range for a framework that's deployed in a Data Boundary scope.", "path": "v1beta1/{+name}:aggregate", "parameters": { "interval.endTime": { "description": "Optional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.", "format": "google-datetime", "location": "query", "type": "string" }, "interval.startTime": { "type": "string", "location": "query", "format": "google-datetime", "description": "Optional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start." }, "filter": { "type": "string", "description": "Optional. A filter expression that restricts the framework deployments that are included in the report. The syntax follows [AIP-160](https://google.aip.dev/160). Supported fields are `framework_deployment`, `framework_name`, and `framework_revision` (the major revision ID of the framework).", "location": "query" }, "name": { "pattern": "^organizations/[^/]+/locations/[^/]+/dbFrameworkComplianceReports/[^/]+$", "type": "string", "description": "Required. The name of the framework compliance report to aggregate over time. The report ID is the ID of the compliance framework, for example `builtin-fedramp-high`. Format: `organizations/{organization_id}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}`", "required": true, "location": "path" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "assuredworkloads.organizations.locations.dbFrameworkComplianceReports.aggregate", "parameterOrder": [ "name" ], "flatPath": "v1beta1/organizations/{organizationsId}/locations/{locationsId}/dbFrameworkComplianceReports/{dbFrameworkComplianceReportsId}:aggregate", "response": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AggregateDbFrameworkComplianceReportResponse" } } } } } } } } }, "id": "assuredworkloads:v1beta1", "protocol": "rest", "icons": { "x16": "http://www.google.com/images/icons/product/search-16.gif", "x32": "http://www.google.com/images/icons/product/search-32.gif" }, "fullyEncodeReservedExpansion": true, "basePath": "", "schemas": { "GoogleCloudAssuredworkloadsV1beta1EnableResourceMonitoringResponse": { "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1EnableResourceMonitoringResponse", "description": "Response for EnableResourceMonitoring endpoint.", "properties": {} }, "GoogleCloudAssuredworkloadsV1beta1MoveImpact": { "properties": { "detail": { "description": "Explanation of the impact.", "type": "string" } }, "id": "GoogleCloudAssuredworkloadsV1beta1MoveImpact", "description": "Represents the impact of moving the asset to the target.", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadPartnerPermissions": { "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadPartnerPermissions", "type": "object", "properties": { "assuredWorkloadsMonitoring": { "type": "boolean", "description": "Optional. Allow partner to view violation alerts." }, "accessTransparencyLogsSupportCaseViewer": { "type": "boolean", "description": "Optional. Allow partner to view support case details for an AXT log" }, "serviceAccessApprover": { "type": "boolean", "description": "Optional. Allow partner to view access approval logs." }, "dataLogsViewer": { "type": "boolean", "description": "Optional. Allow the partner to view inspectability logs and monitoring violations." } }, "description": "Permissions granted to the AW Partner SA account for the customer workload" }, "GoogleCloudAssuredworkloadsV1beta1OrgPolicyUpdate": { "id": "GoogleCloudAssuredworkloadsV1beta1OrgPolicyUpdate", "type": "object", "properties": { "appliedPolicy": { "description": "The org policy currently applied on the assured workload resource.", "$ref": "GoogleCloudAssuredworkloadsV1beta1OrgPolicy" }, "suggestedPolicy": { "$ref": "GoogleCloudAssuredworkloadsV1beta1OrgPolicy", "description": "The suggested org policy that replaces the applied policy." } }, "description": "Represents an update for an org policy control applied on an Assured Workload resource. The inherited org policy is not considered." }, "GoogleCloudAssuredworkloadsV1beta1FetchDbFrameworkComplianceReportResponse": { "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1FetchDbFrameworkComplianceReportResponse", "description": "The response message for FetchDbFrameworkComplianceReport.", "properties": { "framework": { "description": "The resource name of the compliance framework. For example, `organizations/{organization}/locations/{location}/frameworks/{framework_id}`.", "type": "string" }, "updateTime": { "format": "google-datetime", "type": "string", "readOnly": true, "description": "Output only. The time when the report was last updated." }, "frameworkCategories": { "items": { "type": "string", "enum": [ "FRAMEWORK_CATEGORY_UNSPECIFIED", "INDUSTRY_DEFINED_STANDARD", "ASSURED_WORKLOADS", "DATA_SECURITY", "GOOGLE_BEST_PRACTICES", "CUSTOM_FRAMEWORK" ], "enumDescriptions": [ "Default value. This value is unused.", "An industry-defined framework.", "An Assured Workloads framework.", "A data security posture framework.", "A Google's best practices framework.", "A user-created framework." ] }, "type": "array", "description": "The categories of the framework." }, "name": { "type": "string", "description": "The resource name of the framework compliance report." }, "frameworkType": { "enumDescriptions": [ "Default value. This value is unused.", "A framework that's provided and managed by Google.", "A framework that's created and managed by you." ], "description": "The type of the framework.", "enum": [ "FRAMEWORK_TYPE_UNSPECIFIED", "BUILT_IN", "CUSTOM" ], "type": "string" }, "supportedCloudProviders": { "type": "array", "description": "The cloud providers that are supported by the framework.", "items": { "type": "string", "enumDescriptions": [ "Default value. This value is unused.", "Amazon Web Services (AWS).", "Microsoft Azure.", "Google Cloud." ], "enum": [ "CLOUD_PROVIDER_UNSPECIFIED", "AWS", "AZURE", "GCP" ] } }, "controlAssessmentDetails": { "description": "The number of passing, failing, and not assessed controls in the framework.", "$ref": "GoogleCloudAssuredworkloadsV1beta1ControlAssessmentDetails" }, "targetResourceDetails": { "description": "The details of the target resources (organizations, folders, or projects) that the framework is deployed on.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1TargetResourceDetails" }, "type": "array" }, "frameworkDisplayName": { "type": "string", "description": "Optional. The display name of the framework." }, "majorRevisionId": { "description": "The latest major revision ID of the framework.", "format": "int64", "type": "string" }, "frameworkDescription": { "description": "The description of the framework.", "type": "string" }, "minorRevisionId": { "description": "The latest minor revision ID of the latest major revision of the framework.", "type": "string", "format": "int64" } } }, "GoogleRpcStatus": { "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).", "id": "GoogleRpcStatus", "properties": { "code": { "format": "int32", "type": "integer", "description": "The status code, which should be an enum value of google.rpc.Code." }, "message": { "type": "string", "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client." }, "details": { "type": "array", "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.", "items": { "type": "object", "additionalProperties": { "type": "any", "description": "Properties of the object. Contains field @type with type URL." } } } }, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructionsConsole": { "description": "Instructions to remediate a violation by using the Google Cloud console.", "type": "object", "properties": { "additionalLinks": { "description": "Additional URLs with more information about the steps.", "items": { "type": "string" }, "type": "array" }, "consoleUris": { "items": { "type": "string" }, "description": "Links to the Google Cloud console pages where the violation can be resolved.", "type": "array" }, "steps": { "type": "array", "description": "The steps to resolve the violation by using the Google Cloud console.", "items": { "type": "string" } } }, "id": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructionsConsole" }, "GoogleCloudAssuredworkloadsV1beta1MoveAnalysisGroup": { "type": "object", "properties": { "error": { "$ref": "GoogleRpcStatus", "description": "Error details for a failed analysis." }, "displayName": { "type": "string", "description": "Name of the analysis group." }, "analysisResult": { "description": "Result of a successful analysis.", "$ref": "GoogleCloudAssuredworkloadsV1beta1MoveAnalysisResult" } }, "description": "Represents a logical group of checks performed for an asset. If successful, the group contains the analysis result, otherwise it contains an error with the failure reason.", "id": "GoogleCloudAssuredworkloadsV1beta1MoveAnalysisGroup" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings": { "type": "object", "deprecated": true, "properties": { "nextRotationTime": { "description": "Required. Input only. Immutable. The time at which the Key Management Service will automatically create a new version of the crypto key and mark it as the primary.", "format": "google-datetime", "type": "string" }, "rotationPeriod": { "type": "string", "format": "google-duration", "description": "Required. Input only. Immutable. [next_rotation_time] will be advanced by this period when the Key Management Service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours." } }, "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings", "description": "Settings specific to the Key Management Service." }, "GoogleCloudAssuredworkloadsV1beta1WorkloadWorkloadOptions": { "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadWorkloadOptions", "properties": { "kajEnrollmentType": { "enumDescriptions": [ "KAJ Enrollment type is unspecified", "KAT sets External, Hardware, and Software key feature logging only to TRUE." ], "description": "Optional. Specifies type of KAJ Enrollment if provided.", "type": "string", "enum": [ "KAJ_ENROLLMENT_TYPE_UNSPECIFIED", "KEY_ACCESS_TRANSPARENCY_OFF" ] } }, "type": "object", "description": "Options to be set for the given created workload." }, "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructionsGcloud": { "id": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructionsGcloud", "description": "Instructions to remediate a violation by using the Google Cloud CLI.", "properties": { "gcloudCommands": { "description": "The gcloud CLI commands that resolve the violation.", "type": "array", "items": { "type": "string" } }, "steps": { "items": { "type": "string" }, "description": "The steps to resolve the violation by using the gcloud CLI.", "type": "array" }, "additionalLinks": { "items": { "type": "string" }, "type": "array", "description": "Additional URLs with more information about the steps." } }, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1AssetMoveAnalysis": { "type": "object", "properties": { "assetType": { "description": "Type of the asset being analyzed. Possible values will be among the ones listed [here](https://cloud.google.com/asset-inventory/docs/supported-asset-types).", "type": "string" }, "asset": { "description": "The full resource name of the asset being analyzed. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1", "type": "string" }, "analysisGroups": { "description": "List of eligible analyses performed for the asset.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1MoveAnalysisGroup" } } }, "description": "Represents move analysis results for an asset.", "id": "GoogleCloudAssuredworkloadsV1beta1AssetMoveAnalysis" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadIL4Settings": { "deprecated": true, "description": "Settings specific to resources needed for IL4.", "type": "object", "properties": { "kmsSettings": { "description": "Input only. Immutable. Settings used to create a CMEK crypto key.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings" } }, "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadIL4Settings" }, "GoogleCloudAssuredworkloadsV1beta1EnableComplianceUpdatesResponse": { "description": "Response for EnableComplianceUpdates endpoint.", "id": "GoogleCloudAssuredworkloadsV1beta1EnableComplianceUpdatesResponse", "properties": {}, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1AggregatedComplianceReport": { "description": "A point-in-time compliance report for a framework.", "id": "GoogleCloudAssuredworkloadsV1beta1AggregatedComplianceReport", "properties": { "controlAssessmentDetails": { "description": "The number of passing, failing, and not assessed controls in the framework at `report_time`.", "$ref": "GoogleCloudAssuredworkloadsV1beta1ControlAssessmentDetails" }, "reportTime": { "format": "google-datetime", "type": "string", "description": "The time that the compliance report represents." } }, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1ListDbFrameworkComplianceSummariesResponse": { "properties": { "dbFrameworkComplianceSummaries": { "type": "array", "description": "The list of framework compliance summaries.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1DbFrameworkComplianceSummary" } }, "nextPageToken": { "readOnly": true, "type": "string", "description": "Output only. A token that can be sent as `page_token` to retrieve the next page. If this field is empty, there are no subsequent pages." } }, "id": "GoogleCloudAssuredworkloadsV1beta1ListDbFrameworkComplianceSummariesResponse", "description": "The response message for ListDbFrameworkComplianceSummaries.", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1RestrictAllowedResourcesResponse": { "id": "GoogleCloudAssuredworkloadsV1beta1RestrictAllowedResourcesResponse", "type": "object", "properties": {}, "description": "Response for restricting the list of allowed resources." }, "GoogleCloudAssuredworkloadsV1beta1ControlAssessmentDetails": { "description": "The details for a control assessment.", "id": "GoogleCloudAssuredworkloadsV1beta1ControlAssessmentDetails", "properties": { "passingControlIds": { "type": "array", "items": { "type": "string" }, "description": "The list of controls that are passing or not assessed." }, "notAssessedControlIds": { "items": { "type": "string" }, "type": "array", "description": "The list of controls that aren't assessed because they require manual review." }, "passingControls": { "description": "The number of controls that are passing or not assessed.", "format": "int32", "type": "integer" }, "failingControlIds": { "type": "array", "items": { "type": "string" }, "description": "The list of controls that are failing." }, "assessedPassingControls": { "type": "integer", "description": "The number of controls that were assessed and are passing.", "format": "int32" }, "notAssessedControls": { "type": "integer", "format": "int32", "description": "The number of controls that aren't assessed because they require manual review." }, "assessedPassingControlIds": { "items": { "type": "string" }, "description": "The list of controls that were assessed and are passing.", "type": "array" }, "failingControls": { "format": "int32", "description": "The number of controls that are failing.", "type": "integer" } }, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1UpdateDetails": { "description": "The details of the update.", "id": "GoogleCloudAssuredworkloadsV1beta1UpdateDetails", "type": "object", "properties": { "orgPolicyUpdate": { "description": "Update to one org policy, e.g. gcp.resourceLocation.", "$ref": "GoogleCloudAssuredworkloadsV1beta1OrgPolicyUpdate" } } }, "GoogleCloudAssuredworkloadsV1beta1ListDbControlComplianceSummariesResponse": { "properties": { "dbControlComplianceSummaries": { "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1DbControlComplianceSummary" }, "type": "array", "description": "The list of control compliance summaries." }, "nextPageToken": { "description": "Output only. A token that can be sent as `page_token` to retrieve the next page. If this field is empty, there are no subsequent pages.", "readOnly": true, "type": "string" } }, "description": "The response message for ListDbControlComplianceSummaries.", "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1ListDbControlComplianceSummariesResponse" }, "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateRequest": { "type": "object", "description": "Request to apply update to a workload.", "properties": { "action": { "type": "string", "enumDescriptions": [ "Unspecified value.", "The update is applied." ], "enum": [ "WORKLOAD_UPDATE_ACTION_UNSPECIFIED", "APPLY" ], "description": "The action to be performed on the update." } }, "id": "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateRequest" }, "GoogleProtobufEmpty": { "id": "GoogleProtobufEmpty", "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }", "type": "object", "properties": {} }, "GoogleCloudAssuredworkloadsV1beta1ListWorkloadUpdatesResponse": { "type": "object", "properties": { "workloadUpdates": { "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadUpdate" }, "description": "The list of workload updates for a given workload.", "type": "array" }, "nextPageToken": { "type": "string", "description": "The next page token. Return empty if reached the last page." } }, "description": "Response of listing the compliance updates per workload with pagination.", "id": "GoogleCloudAssuredworkloadsV1beta1ListWorkloadUpdatesResponse" }, "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateOperationMetadata": { "id": "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateOperationMetadata", "properties": { "updateName": { "type": "string", "description": "Required. The resource name of the update" }, "createTime": { "readOnly": true, "type": "string", "description": "Optional. Output only. The time the operation was created.", "format": "google-datetime" }, "action": { "enum": [ "WORKLOAD_UPDATE_ACTION_UNSPECIFIED", "APPLY" ], "enumDescriptions": [ "Unspecified value.", "The update is applied." ], "type": "string", "description": "Optional. The time the operation was created." } }, "type": "object", "description": "Operation metadata to give request details of ApplyWorkloadUpdate." }, "GoogleCloudAssuredworkloadsV1beta1ListViolationsResponse": { "properties": { "totalSize": { "description": "The total number of violations that match the request, across all pages. This field might not be populated for all requests; when it's not populated, its value is `0`.", "format": "int32", "type": "integer" }, "nextPageToken": { "description": "A token that can be sent as `page_token` to retrieve the next page. If this field is empty, there are no subsequent pages.", "type": "string" }, "violations": { "description": "The list of violations.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Violation" } } }, "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1ListViolationsResponse", "description": "Response message for the `ListViolations` method." }, "GoogleCloudAssuredworkloadsV1beta1DbControlComplianceSummary": { "type": "object", "properties": { "name": { "type": "string", "description": "Identifier. The resource name of the control compliance summary. Format: `organizations/{organization}/locations/{location}/dbFrameworkComplianceReports/{db_framework_compliance_report}/dbControlComplianceSummaries/{db_control_compliance_summary}`" }, "control": { "description": "The name of the control.", "type": "string" }, "totalFindingsCount": { "type": "integer", "format": "int32", "description": "The total number of findings for the control." }, "cloudControlReports": { "type": "array", "description": "The list of cloud control reports.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1CloudControlReport" } }, "resourceFindingCount": { "format": "int64", "type": "string", "description": "Output only. Number of resource findings for this control.", "readOnly": true }, "overallEvaluationState": { "description": "Output only. The overall evaluation status of the control.", "enumDescriptions": [ "Default value. This value is unused.", "The control is passing.", "The control is failing.", "The control is not assessed." ], "enum": [ "EVALUATION_STATE_UNSPECIFIED", "EVALUATION_STATE_PASSED", "EVALUATION_STATE_FAILED", "EVALUATION_STATE_NOT_ASSESSED" ], "readOnly": true, "type": "string" }, "displayName": { "type": "string", "description": "The display name of the control." }, "description": { "description": "The description of the control.", "type": "string" }, "complianceFrameworks": { "type": "array", "items": { "type": "string" }, "description": "The list of compliance frameworks that the control belongs to." }, "orgPolicyFindingCount": { "description": "Output only. Number of organization policy findings for this control.", "type": "string", "format": "int64", "readOnly": true }, "similarControls": { "description": "The list of similar controls.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1SimilarControls" }, "type": "array" }, "controlResponsibilityType": { "enum": [ "REGULATORY_CONTROL_RESPONSIBILITY_TYPE_UNSPECIFIED", "GOOGLE", "CUSTOMER", "SHARED" ], "type": "string", "enumDescriptions": [ "Default value. This value is unused.", "Google's responsibility.", "Your responsibility.", "Shared responsibility." ], "description": "The responsibility type for the control." }, "isFakeControl": { "type": "boolean", "description": "Whether the control is a fake control. Fake controls are created and mapped to cloud controls that don't belong to a control group." } }, "id": "GoogleCloudAssuredworkloadsV1beta1DbControlComplianceSummary", "description": "A summary of the compliance status of a control in a framework compliance report." }, "GoogleCloudAssuredworkloadsV1beta1AcknowledgeViolationResponse": { "description": "Response message for acknowledging a violation. This message is empty.", "id": "GoogleCloudAssuredworkloadsV1beta1AcknowledgeViolationResponse", "properties": {}, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1Workload": { "properties": { "labels": { "description": "Optional. Labels applied to the workload.", "additionalProperties": { "type": "string" }, "type": "object" }, "provisionedResourcesParent": { "type": "string", "description": "Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}" }, "il4Settings": { "deprecated": true, "description": "Input only. Immutable. Settings specific to resources needed for IL4.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadIL4Settings" }, "ekmProvisioningResponse": { "description": "Output only. Represents the Ekm Provisioning State of the given workload.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadEkmProvisioningResponse", "readOnly": true }, "resourceSettings": { "description": "Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceSettings" } }, "createTime": { "description": "Output only. Immutable. The Workload creation timestamp.", "type": "string", "format": "google-datetime", "readOnly": true }, "compliantButDisallowedServices": { "readOnly": true, "description": "Output only. Urls for services which are compliant for this Assured Workload, but which are currently disallowed by the ResourceUsageRestriction org policy. Invoke RestrictAllowedResources endpoint to allow your project developers to use these services in their environment.", "items": { "type": "string" }, "type": "array" }, "saaEnrollmentResponse": { "description": "Output only. Represents the SAA enrollment response of the given workload. SAA enrollment response is queried during GetWorkload call. In failure cases, user friendly error message is shown in SAA details page.", "readOnly": true, "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadSaaEnrollmentResponse" }, "fedrampModerateSettings": { "deprecated": true, "description": "Input only. Immutable. Settings specific to resources needed for FedRAMP Moderate.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadFedrampModerateSettings" }, "displayName": { "type": "string", "description": "Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload" }, "kajEnrollmentState": { "readOnly": true, "description": "Output only. Represents the KAJ enrollment state of the given workload.", "enumDescriptions": [ "Default State for KAJ Enrollment.", "Pending State for KAJ Enrollment.", "Complete State for KAJ Enrollment." ], "enum": [ "KAJ_ENROLLMENT_STATE_UNSPECIFIED", "KAJ_ENROLLMENT_STATE_PENDING", "KAJ_ENROLLMENT_STATE_COMPLETE" ], "type": "string" }, "partnerServicesBillingAccount": { "type": "string", "description": "Optional. Billing account necessary for purchasing services from Sovereign Partners. This field is required for creating SIA/PSN/CNTXT/Telefonica partner workloads. The caller should have 'billing.resourceAssociations.create' IAM permission on this billing-account. The format of this string is billingAccounts/AAAAAA-BBBBBB-CCCCCC" }, "partnerPermissions": { "description": "Optional. Permissions granted to the AW Partner SA account for the customer workload", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadPartnerPermissions" }, "fedrampHighSettings": { "description": "Input only. Immutable. Settings specific to resources needed for FedRAMP High.", "deprecated": true, "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadFedrampHighSettings" }, "name": { "type": "string", "description": "Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only." }, "enableSovereignControls": { "type": "boolean", "description": "Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers." }, "resources": { "description": "Output only. The resources associated with this workload. These resources will be created when creating the workload. If any of the projects already exist, the workload creation will fail. Always read only.", "readOnly": true, "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceInfo" } }, "billingAccount": { "type": "string", "description": "Optional. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, `billingAccounts/012345-567890-ABCDEF`." }, "resourceMonitoringEnabled": { "description": "Output only. Indicates whether resource monitoring is enabled for workload or not. It is true when Resource feed is subscribed to AWM topic and AWM Service Agent Role is binded to AW Service Account for resource Assured workload.", "type": "boolean", "readOnly": true }, "kmsSettings": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings", "deprecated": true, "description": "Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field." }, "etag": { "type": "string", "description": "Optional. ETag of the workload, it is calculated on the basis of the Workload contents. It will be used in Update & Delete operations." }, "complianceRegime": { "enum": [ "COMPLIANCE_REGIME_UNSPECIFIED", "ASSURED_WORKLOADS_FOR_PARTNERS", "AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT", "CANADA_DATA_BOUNDARY_AND_SUPPORT", "DATA_BOUNDARY_FOR_CANADA_CONTROLLED_GOODS", "DATA_BOUNDARY_FOR_CANADA_PROTECTED_B", "DATA_BOUNDARY_FOR_CJIS", "DATA_BOUNDARY_FOR_FEDRAMP_HIGH", "DATA_BOUNDARY_FOR_FEDRAMP_MODERATE", "DATA_BOUNDARY_FOR_IL2", "DATA_BOUNDARY_FOR_IL4", "DATA_BOUNDARY_FOR_IL5", "DATA_BOUNDARY_FOR_IRS_PUBLICATION_1075", "DATA_BOUNDARY_FOR_ITAR", "EU_DATA_BOUNDARY_AND_SUPPORT", "ISRAEL_DATA_BOUNDARY_AND_SUPPORT", "JAPAN_DATA_BOUNDARY", "SWITZERLAND_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS", "KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS", "REGIONAL_DATA_BOUNDARY", "US_DATA_BOUNDARY_AND_SUPPORT", "US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES", "US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT", "AU_REGIONS_AND_US_SUPPORT", "CA_PROTECTED_B", "CA_REGIONS_AND_SUPPORT", "CANADA_CONTROLLED_GOODS", "CJIS", "EU_REGIONS_AND_SUPPORT", "FEDRAMP_HIGH", "FEDRAMP_MODERATE", "HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS", "HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT", "HIPAA", "HITRUST", "IL2", "IL4", "IL5", "IRS_1075", "ISR_REGIONS", "ISR_REGIONS_AND_SUPPORT", "ITAR", "JP_REGIONS_AND_SUPPORT", "KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS", "REGIONAL_CONTROLS", "US_REGIONAL_ACCESS" ], "enumDeprecated": [ false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, true, true, false, false, false, false, false, false, false, false, false, false, false ], "enumDescriptions": [ "The default value. This value is used if the control package is omitted or unknown.", "Specifies a [Sovereign Controls by Partners](https://cloud.google.com/sovereign-controls-by-partners/docs/overview) control package. To use this control package, you must also specify the partner field from the list of Sovereign Controls by Partners.", "Australia Data Boundary and Support", "Canada Data Boundary and Support", "Data Boundary for Canada Controlled Goods", "Data Boundary for Canada Protected B", "Data Boundary for Criminal Justice Information Systems (CJIS)", "Data Boundary for FedRAMP High", "Data Boundary for FedRAMP Moderate", "Data Boundary for Impact Level 2 (IL2)", "Data Boundary for Impact Level 4 (IL4)", "Data Boundary for Impact Level 5 (IL5)", "Data Boundary for IRS Publication 1075", "Data Boundary for International Traffic in Arms Regulations (ITAR)", "European Union (EU) Data Boundary and Support", "Israel Data Boundary and Support", "Japan Data Boundary", "Switzerland Data Boundary with Access Justifications", "Kingdom of Saudi Arabia (KSA) Data Boundary with Access Justifications", "Data boundary for one of Assured Workloads' *Free tier* control packages. Determines the region by specifying the data location during workload creation.", "United States (US) Data Boundary and Support", "United States (US) Data Boundary for Healthcare and Life Sciences", "United States (US) Data Boundary for Healthcare and Life Sciences with Support", "Use the AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_CANADA_PROTECTED_B enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the CANADA_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_CANADA_CONTROLLED_GOODS enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_CJIS enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the EU_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_FEDRAMP_HIGH enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_FEDRAMP_MODERATE enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Deprecated: Consider using the Data Boundary for US Healthcare and Life Sciences control package instead.", "Deprecated: Consider using the Data Boundary for US Healthcare and Life Sciences control package instead.", "Use the DATA_BOUNDARY_FOR_IL2 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_IL4 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_IL5 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_IRS_PUBLICATION_1075 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the ISRAEL_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the ISRAEL_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_ITAR enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the JAPAN_DATA_BOUNDARY enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the REGIONAL_DATA_BOUNDARY enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the US_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed." ], "type": "string", "description": "Required. Immutable. Compliance Regime associated with this workload." }, "workloadOptions": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadWorkloadOptions", "description": "Optional. Options to be set for the given created workload." }, "cjisSettings": { "deprecated": true, "description": "Input only. Immutable. Settings specific to resources needed for CJIS.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadCJISSettings" }, "violationNotificationsEnabled": { "type": "boolean", "description": "Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload." }, "complianceUpdatesEnabled": { "description": "Output only. Indicates whether the compliance updates feature is enabled for a workload. The compliance updates feature can be enabled via the EnableComplianceUpdates endpoint.", "readOnly": true, "type": "boolean" }, "complianceStatus": { "readOnly": true, "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadComplianceStatus", "description": "Output only. Count of active Violations in the Workload." }, "availableUpdates": { "description": "Output only. The number of updates available for the workload.", "format": "int32", "readOnly": true, "type": "integer" }, "partner": { "enum": [ "PARTNER_UNSPECIFIED", "LOCAL_CONTROLS_BY_S3NS", "SOVEREIGN_CONTROLS_BY_T_SYSTEMS", "SOVEREIGN_CONTROLS_BY_SIA_MINSAIT", "SOVEREIGN_CONTROLS_BY_PSN", "SOVEREIGN_CONTROLS_BY_CNTXT", "SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM", "SPAIN_DATA_BOUNDARY_BY_TELEFONICA" ], "enumDescriptions": [ "", "Enum representing S3NS (Thales) partner.", "Enum representing T_SYSTEM (TSI) partner.", "Enum representing SIA_MINSAIT (Indra) partner.", "Enum representing PSN (TIM) partner.", "Enum representing CNTXT (Kingdom of Saudi Arabia) partner.", "Enum representing CNTXT (Kingdom of Saudi Arabia) partner offering without EKM.", "Enum representing Telefonica (Spain) partner." ], "type": "string", "description": "Optional. Partner regime associated with this workload." } }, "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1Workload", "description": "A Workload object for managing highly regulated workloads of cloud customers." }, "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructions": { "properties": { "consoleInstructions": { "description": "Instructions to resolve the violation by using the Google Cloud console.", "$ref": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructionsConsole" }, "gcloudInstructions": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructionsGcloud", "description": "Instructions to resolve the violation by using the gcloud CLI." } }, "type": "object", "description": "Instructions to remediate a violation.", "id": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructions" }, "GoogleCloudAssuredworkloadsV1beta1CloudControlAssessmentDetails": { "type": "object", "description": "The cloud control assessment details for non-manual cloud controls.", "id": "GoogleCloudAssuredworkloadsV1beta1CloudControlAssessmentDetails", "properties": { "orgPolicyFindingCount": { "description": "Output only. Number of organization policy findings for the cloud control.", "readOnly": true, "format": "int64", "type": "string" }, "evaluationState": { "description": "Output only. The evaluation status of the cloud control.", "type": "string", "enum": [ "EVALUATION_STATE_UNSPECIFIED", "EVALUATION_STATE_PASSED", "EVALUATION_STATE_FAILED", "EVALUATION_STATE_NOT_ASSESSED" ], "enumDescriptions": [ "Default value. This value is unused.", "The control is passing.", "The control is failing.", "The control is not assessed." ], "readOnly": true }, "findingsCount": { "description": "The number of findings for the cloud control.", "format": "int32", "type": "integer" }, "resourceFindingCount": { "description": "Output only. Number of resource findings for the cloud control.", "type": "string", "format": "int64", "readOnly": true } } }, "GoogleCloudAssuredworkloadsV1beta1CreateWorkloadOperationMetadata": { "description": "Operation metadata to give request details of CreateWorkload.", "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1CreateWorkloadOperationMetadata", "properties": { "displayName": { "type": "string", "description": "Optional. The display name of the workload." }, "parent": { "type": "string", "description": "Optional. The parent of the workload." }, "complianceRegime": { "description": "Optional. Compliance controls that should be applied to the resources managed by the workload.", "enumDescriptions": [ "The default value. This value is used if the control package is omitted or unknown.", "Specifies a [Sovereign Controls by Partners](https://cloud.google.com/sovereign-controls-by-partners/docs/overview) control package. To use this control package, you must also specify the partner field from the list of Sovereign Controls by Partners.", "Australia Data Boundary and Support", "Canada Data Boundary and Support", "Data Boundary for Canada Controlled Goods", "Data Boundary for Canada Protected B", "Data Boundary for Criminal Justice Information Systems (CJIS)", "Data Boundary for FedRAMP High", "Data Boundary for FedRAMP Moderate", "Data Boundary for Impact Level 2 (IL2)", "Data Boundary for Impact Level 4 (IL4)", "Data Boundary for Impact Level 5 (IL5)", "Data Boundary for IRS Publication 1075", "Data Boundary for International Traffic in Arms Regulations (ITAR)", "European Union (EU) Data Boundary and Support", "Israel Data Boundary and Support", "Japan Data Boundary", "Switzerland Data Boundary with Access Justifications", "Kingdom of Saudi Arabia (KSA) Data Boundary with Access Justifications", "Data boundary for one of Assured Workloads' *Free tier* control packages. Determines the region by specifying the data location during workload creation.", "United States (US) Data Boundary and Support", "United States (US) Data Boundary for Healthcare and Life Sciences", "United States (US) Data Boundary for Healthcare and Life Sciences with Support", "Use the AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_CANADA_PROTECTED_B enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the CANADA_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_CANADA_CONTROLLED_GOODS enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_CJIS enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the EU_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_FEDRAMP_HIGH enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_FEDRAMP_MODERATE enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Deprecated: Consider using the Data Boundary for US Healthcare and Life Sciences control package instead.", "Deprecated: Consider using the Data Boundary for US Healthcare and Life Sciences control package instead.", "Use the DATA_BOUNDARY_FOR_IL2 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_IL4 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_IL5 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_IRS_PUBLICATION_1075 enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the ISRAEL_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the ISRAEL_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the DATA_BOUNDARY_FOR_ITAR enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the JAPAN_DATA_BOUNDARY enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the REGIONAL_DATA_BOUNDARY enum for this control package instead, as the name of the associated Assured Workloads control package has changed.", "Use the US_DATA_BOUNDARY_AND_SUPPORT enum for this control package instead, as the name of the associated Assured Workloads control package has changed." ], "type": "string", "enumDeprecated": [ false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, true, true, false, false, false, false, false, false, false, false, false, false, false ], "enum": [ "COMPLIANCE_REGIME_UNSPECIFIED", "ASSURED_WORKLOADS_FOR_PARTNERS", "AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT", "CANADA_DATA_BOUNDARY_AND_SUPPORT", "DATA_BOUNDARY_FOR_CANADA_CONTROLLED_GOODS", "DATA_BOUNDARY_FOR_CANADA_PROTECTED_B", "DATA_BOUNDARY_FOR_CJIS", "DATA_BOUNDARY_FOR_FEDRAMP_HIGH", "DATA_BOUNDARY_FOR_FEDRAMP_MODERATE", "DATA_BOUNDARY_FOR_IL2", "DATA_BOUNDARY_FOR_IL4", "DATA_BOUNDARY_FOR_IL5", "DATA_BOUNDARY_FOR_IRS_PUBLICATION_1075", "DATA_BOUNDARY_FOR_ITAR", "EU_DATA_BOUNDARY_AND_SUPPORT", "ISRAEL_DATA_BOUNDARY_AND_SUPPORT", "JAPAN_DATA_BOUNDARY", "SWITZERLAND_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS", "KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS", "REGIONAL_DATA_BOUNDARY", "US_DATA_BOUNDARY_AND_SUPPORT", "US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES", "US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT", "AU_REGIONS_AND_US_SUPPORT", "CA_PROTECTED_B", "CA_REGIONS_AND_SUPPORT", "CANADA_CONTROLLED_GOODS", "CJIS", "EU_REGIONS_AND_SUPPORT", "FEDRAMP_HIGH", "FEDRAMP_MODERATE", "HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS", "HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT", "HIPAA", "HITRUST", "IL2", "IL4", "IL5", "IRS_1075", "ISR_REGIONS", "ISR_REGIONS_AND_SUPPORT", "ITAR", "JP_REGIONS_AND_SUPPORT", "KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS", "REGIONAL_CONTROLS", "US_REGIONAL_ACCESS" ] }, "createTime": { "type": "string", "description": "Optional. Time when the operation was created.", "format": "google-datetime" }, "resourceSettings": { "description": "Optional. Resource properties in the input that are used for creating/customizing workload resources.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceSettings" } } } }, "GoogleCloudAssuredworkloadsV1beta1Trend": { "properties": { "valuePercent": { "type": "number", "readOnly": true, "format": "double", "description": "Output only. The trend value as a percentage. The value can be positive or negative." }, "duration": { "readOnly": true, "format": "google-duration", "type": "string", "description": "Output only. The duration for the trend." } }, "description": "The trend of a compliance metric.", "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1Trend" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceSettings": { "description": "Represent the custom settings for the resources to be created.", "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceSettings", "properties": { "resourceType": { "type": "string", "enum": [ "RESOURCE_TYPE_UNSPECIFIED", "CONSUMER_PROJECT", "CONSUMER_FOLDER", "ENCRYPTION_KEYS_PROJECT", "KEYRING" ], "description": "Indicates the type of resource. This field should be specified to correspond the id to the right project type (CONSUMER_PROJECT or ENCRYPTION_KEYS_PROJECT)", "enumDeprecated": [ false, true, false, false, false ], "enumDescriptions": [ "Unknown resource type.", "Deprecated. Existing workloads will continue to support this, but new CreateWorkloadRequests should not specify this as an input value.", "Consumer Folder.", "Consumer project containing encryption keys.", "Keyring resource that hosts encryption keys." ] }, "displayName": { "description": "User-assigned resource display name. If not empty it will be used to create a resource with the specified name.", "type": "string" }, "resourceId": { "type": "string", "description": "Resource identifier. For a project this represents project_id. If the project is already taken, the workload creation will fail. For KeyRing, this represents the keyring_id. For a folder, don't set this value as folder_id is assigned by Google." } } }, "GoogleCloudAssuredworkloadsV1beta1MoveAnalysisResult": { "id": "GoogleCloudAssuredworkloadsV1beta1MoveAnalysisResult", "type": "object", "properties": { "warnings": { "type": "array", "description": "List of warnings. These are risks that may or may not result in compliance violations.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1MoveImpact" } }, "blockers": { "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1MoveImpact" }, "description": "List of blockers. If not resolved, these will result in compliance violations in the target.", "type": "array" } }, "description": "Represents the successful move analysis results for a group." }, "GoogleCloudAssuredworkloadsV1beta1AnalyzeWorkloadMoveResponse": { "id": "GoogleCloudAssuredworkloadsV1beta1AnalyzeWorkloadMoveResponse", "description": "Response containing the analysis results for the hypothetical resource move.", "type": "object", "properties": { "assetMoveAnalyses": { "description": "List of analysis results for each asset in scope.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AssetMoveAnalysis" } }, "nextPageToken": { "description": "The next page token. Is empty if the last page is reached.", "type": "string" } } }, "GoogleCloudAssuredworkloadsV1beta1AcknowledgeViolationRequest": { "properties": { "acknowledgeType": { "enum": [ "ACKNOWLEDGE_TYPE_UNSPECIFIED", "SINGLE_VIOLATION", "EXISTING_CHILD_RESOURCE_VIOLATIONS" ], "enumDescriptions": [ "Default value. The acknowledge type isn't specified.", "Acknowledges only the specified violation.", "Acknowledges the specified organization policy violation and all of its existing associated resource violations." ], "type": "string", "description": "Optional. The scope of the acknowledgement for the specified violation. If not specified, `SINGLE_VIOLATION` is used." }, "nonCompliantOrgPolicy": { "description": "Optional. Deprecated: This field is deprecated and will be removed in a future version of the API. The service identifies the violation to acknowledge by `name`, and ignores this field. Don't set this field. The name of the organization policy that was modified with a non-compliant change and resulted in this violation. Formats: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}`", "deprecated": true, "type": "string" }, "comment": { "description": "Required. The business justification for acknowledging the violation. The comment can't be empty or contain only whitespace characters.", "type": "string" }, "view": { "enum": [ "VIOLATION_VIEW_UNSPECIFIED", "VIOLATION_VIEW_ASSURED_WORKLOADS", "VIOLATION_VIEW_DATA_BOUNDARY" ], "description": "Optional. The violation view (`VIOLATION_VIEW_ASSURED_WORKLOADS` or `VIOLATION_VIEW_DATA_BOUNDARY`) that the violation belongs to. If not specified, `VIOLATION_VIEW_ASSURED_WORKLOADS` is used.", "type": "string", "enumDescriptions": [ "Defaults to the ASSURED_WORKLOADS view.", "Includes the basic metadata about the violation.", "Includes all information about the violation, including details about the data boundary." ] } }, "description": "Request message for acknowledging a violation.", "id": "GoogleCloudAssuredworkloadsV1beta1AcknowledgeViolationRequest", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1CELExpression": { "description": "A Common Expression Language (CEL) expression that's used to create a rule.", "properties": { "expression": { "description": "Required. The logical expression in CEL. The maximum length of the condition is 1000 characters. For more information, see [CEL expression](https://cloud.google.com/security-command-center/docs/compliance-manager-write-cel-expressions).", "type": "string" }, "resourceTypesValues": { "description": "The resource instance types on which this expression is defined. The format is `/`. For example: `compute.googleapis.com/Instance`", "$ref": "GoogleCloudAssuredworkloadsV1beta1StringList" } }, "id": "GoogleCloudAssuredworkloadsV1beta1CELExpression", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1CloudControlReport": { "type": "object", "properties": { "minorRevisionId": { "description": "The minor revision ID of the cloud control.", "format": "int64", "type": "string" }, "frameworkMajorRevisionIds": { "type": "array", "items": { "type": "string", "format": "int64" }, "description": "The major revision IDs of the frameworks that the cloud control belongs to." }, "cloudControlAssessmentDetails": { "description": "The details of a cloud control assessment.", "$ref": "GoogleCloudAssuredworkloadsV1beta1CloudControlAssessmentDetails" }, "displayName": { "type": "string", "description": "The display name of the cloud control." }, "description": { "description": "The description of the cloud control.", "type": "string" }, "findingCategory": { "description": "The category of the finding.", "type": "string" }, "similarControls": { "description": "The list of similar controls.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1SimilarControls" } }, "enforcementMode": { "enumDescriptions": [ "Default value. This value is unused.", "The cloud control is enforced to prevent non-compliance.", "The cloud control is enforced to detect non-compliance.", "The cloud control is enforced to audit for non-compliance." ], "enum": [ "ENFORCEMENT_MODE_UNSPECIFIED", "PREVENTIVE", "DETECTIVE", "AUDIT" ], "type": "string", "description": "The enforcement mode of the cloud control." }, "majorRevisionId": { "type": "string", "format": "int64", "description": "The major revision ID of the cloud control." }, "cloudControlType": { "enumDescriptions": [ "Default value. This value is unused.", "A cloud control that's created and managed by you.", "A cloud control that's provided and managed by Google." ], "type": "string", "enum": [ "TYPE_UNSPECIFIED", "CUSTOM", "BUILT_IN" ], "description": "The type of the cloud control." }, "cloudControl": { "type": "string", "description": "The name of the cloud control." }, "cloudControlDeployment": { "description": "The name of the cloud control deployment.", "type": "string" }, "rules": { "description": "The list of rules that correspond to the cloud control.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Rule" }, "type": "array" }, "findingSeverity": { "enumDescriptions": [ "Default value. This value is unused.", "A critical vulnerability is easily discoverable by an external actor, exploitable, and results in the direct ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. Examples include publicly accessible unprotected user data and public SSH access with weak or no passwords. A critical threat is a threat that can access, modify, or delete data or execute unauthorized code within existing resources.", "A high-risk vulnerability can be easily discovered and exploited in combination with other vulnerabilities to gain direct access and the ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. An example is a database with weak or no passwords that is only accessible internally. This database could easily be compromised by an actor that had access to the internal network. A high-risk threat is a threat that can create new computational resources in an environment but can't access data or execute code in existing resources.", "A medium-risk vulnerability can be used by an actor to gain access to resources or privileges that enable them to eventually (through multiple steps or a complex exploit) gain access and the ability to execute arbitrary code or exfiltrate data. An example is a service account with access to more projects than it should have. If an actor gains access to the service account, they could potentially use that access to manipulate a project the service account was not intended to. A medium-risk threat can cause operational impact but might not access data or execute unauthorized code.", "A low-risk vulnerability hampers a security organization's ability to detect vulnerabilities or active threats in their deployment, or prevents the root cause investigation of security issues. An example is monitoring and logs being disabled for resource configurations and access. A low-risk threat is a threat that has obtained minimal access to an environment but can't access data, execute code, or create resources." ], "description": "The severity of the finding.", "type": "string", "enum": [ "SEVERITY_UNSPECIFIED", "CRITICAL", "HIGH", "MEDIUM", "LOW" ] }, "manualCloudControlAssessmentDetails": { "description": "The details of a manual cloud control assessment.", "$ref": "GoogleCloudAssuredworkloadsV1beta1ManualCloudControlAssessmentDetails" }, "categories": { "items": { "type": "string" }, "type": "array", "description": "The list of categories for the cloud control." } }, "id": "GoogleCloudAssuredworkloadsV1beta1CloudControlReport", "description": "The cloud control report." }, "GoogleCloudAssuredworkloadsV1beta1AggregateDbFrameworkComplianceReportResponse": { "id": "GoogleCloudAssuredworkloadsV1beta1AggregateDbFrameworkComplianceReportResponse", "type": "object", "properties": { "aggregatedComplianceReports": { "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1AggregatedComplianceReport" }, "description": "The daily compliance reports for the requested time range.", "type": "array" } }, "description": "The response message for AggregateDbFrameworkComplianceReport." }, "GoogleCloudAssuredworkloadsV1beta1WorkloadCJISSettings": { "type": "object", "description": "Settings specific to resources needed for CJIS.", "properties": { "kmsSettings": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings", "description": "Input only. Immutable. Settings used to create a CMEK crypto key." } }, "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadCJISSettings", "deprecated": true }, "GoogleCloudAssuredworkloadsV1beta1WorkloadEkmProvisioningResponse": { "type": "object", "description": "External key management systems(EKM) Provisioning response", "properties": { "ekmProvisioningErrorMapping": { "description": "Detailed error message if Ekm provisioning fails", "enumDescriptions": [ "Error is unspecified.", "Service account is used is invalid.", "Iam permission monitoring.MetricsScopeAdmin wasn't applied.", "Iam permission cloudkms.ekmConnectionsAdmin wasn't applied." ], "enum": [ "EKM_PROVISIONING_ERROR_MAPPING_UNSPECIFIED", "INVALID_SERVICE_ACCOUNT", "MISSING_METRICS_SCOPE_ADMIN_PERMISSION", "MISSING_EKM_CONNECTION_ADMIN_PERMISSION" ], "type": "string" }, "ekmProvisioningState": { "enum": [ "EKM_PROVISIONING_STATE_UNSPECIFIED", "EKM_PROVISIONING_STATE_PENDING", "EKM_PROVISIONING_STATE_FAILED", "EKM_PROVISIONING_STATE_COMPLETED" ], "description": "Output only. Indicates Ekm enrollment Provisioning of a given workload.", "enumDescriptions": [ "Default State for Ekm Provisioning", "Pending State for Ekm Provisioning", "Failed State for Ekm Provisioning", "Completed State for Ekm Provisioning" ], "type": "string", "readOnly": true }, "ekmProvisioningErrorDomain": { "description": "Indicates Ekm provisioning error if any.", "enum": [ "EKM_PROVISIONING_ERROR_DOMAIN_UNSPECIFIED", "UNSPECIFIED_ERROR", "GOOGLE_SERVER_ERROR", "EXTERNAL_USER_ERROR", "EXTERNAL_PARTNER_ERROR", "TIMEOUT_ERROR" ], "type": "string", "enumDescriptions": [ "No error domain", "Error but domain is unspecified.", "Internal logic breaks within provisioning code.", "Error occurred with the customer not granting permission/creating resource.", "Error occurred within the partner's provisioning cluster.", "Resource wasn't provisioned in the required 7 day time period" ] } }, "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadEkmProvisioningResponse" }, "GoogleCloudAssuredworkloadsV1beta1StringList": { "properties": { "values": { "type": "array", "items": { "type": "string" }, "description": "Required. The strings in the list." } }, "id": "GoogleCloudAssuredworkloadsV1beta1StringList", "description": "A list of strings for the parameter value.", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1ViolationRemediation": { "id": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediation", "properties": { "instructions": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediationInstructions", "description": "Required. The instructions to resolve the violation." }, "remediationType": { "enum": [ "REMEDIATION_TYPE_UNSPECIFIED", "REMEDIATION_BOOLEAN_ORG_POLICY_VIOLATION", "REMEDIATION_LIST_ALLOWED_VALUES_ORG_POLICY_VIOLATION", "REMEDIATION_LIST_DENIED_VALUES_ORG_POLICY_VIOLATION", "REMEDIATION_RESTRICT_CMEK_CRYPTO_KEY_PROJECTS_ORG_POLICY_VIOLATION", "REMEDIATION_RESOURCE_VIOLATION", "REMEDIATION_RESOURCE_VIOLATION_NON_CMEK_SERVICES" ], "type": "string", "readOnly": true, "description": "Output only. The remediation type, which is based on the type of organization policy values that were violated.", "enumDescriptions": [ "Default value. The remediation type isn't specified.", "Remediation for a boolean organization policy violation.", "Remediation for a list organization policy violation where the monitoring rule specifies allowed values.", "Remediation for a list organization policy violation where the monitoring rule specifies denied values.", "Remediation for a `gcp.restrictCmekCryptoKeyProjects` organization policy violation.", "Remediation for a resource violation.", "Remediation for a resource violation that's caused by the `gcp.restrictNonCmekServices` organization policy." ] }, "compliantValues": { "description": "The values that can resolve the violation. For example, for list organization policy violations, this field contains the list of allowed or denied values.", "items": { "type": "string" }, "type": "array" } }, "description": "Remediation guidance to resolve a compliance violation.", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadSaaEnrollmentResponse": { "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadSaaEnrollmentResponse", "description": "Signed Access Approvals (SAA) enrollment response.", "type": "object", "properties": { "setupErrors": { "items": { "enum": [ "SETUP_ERROR_UNSPECIFIED", "ERROR_INVALID_BASE_SETUP", "ERROR_MISSING_EXTERNAL_SIGNING_KEY", "ERROR_NOT_ALL_SERVICES_ENROLLED", "ERROR_SETUP_CHECK_FAILED" ], "enumDescriptions": [ "Unspecified.", "Invalid states for all customers, to be redirected to AA UI for additional details.", "Returned when there is not an EKM key configured.", "Returned when there are no enrolled services or the customer is enrolled in CAA only for a subset of services.", "Returned when exception was encountered during evaluation of other criteria." ], "type": "string" }, "type": "array", "description": "Indicates SAA enrollment setup error if any." }, "setupStatus": { "readOnly": true, "description": "Output only. Indicates SAA enrollment status of a given workload.", "enumDescriptions": [ "Unspecified.", "SAA enrollment pending.", "SAA enrollment comopleted." ], "type": "string", "enum": [ "SETUP_STATE_UNSPECIFIED", "STATUS_PENDING", "STATUS_COMPLETE" ] } } }, "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateResponse": { "type": "object", "description": "Response for ApplyWorkloadUpdate endpoint.", "properties": { "appliedUpdate": { "description": "The update that was applied.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadUpdate" } }, "id": "GoogleCloudAssuredworkloadsV1beta1ApplyWorkloadUpdateResponse" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadComplianceStatus": { "properties": { "activeViolationCount": { "description": "Number of current orgPolicy violations which are not acknowledged.", "format": "int32", "type": "integer" }, "activeResourceViolationCount": { "type": "integer", "format": "int32", "description": "Number of current resource violations which are acknowledged." }, "acknowledgedResourceViolationCount": { "format": "int32", "type": "integer", "description": "Number of current resource violations which are not acknowledged." }, "acknowledgedViolationCount": { "format": "int32", "type": "integer", "description": "Number of current orgPolicy violations which are acknowledged." } }, "description": "Represents the Compliance Status of this workload", "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadComplianceStatus" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceInfo": { "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadResourceInfo", "type": "object", "properties": { "resourceType": { "type": "string", "enum": [ "RESOURCE_TYPE_UNSPECIFIED", "CONSUMER_PROJECT", "CONSUMER_FOLDER", "ENCRYPTION_KEYS_PROJECT", "KEYRING" ], "enumDescriptions": [ "Unknown resource type.", "Deprecated. Existing workloads will continue to support this, but new CreateWorkloadRequests should not specify this as an input value.", "Consumer Folder.", "Consumer project containing encryption keys.", "Keyring resource that hosts encryption keys." ], "description": "Indicates the type of resource.", "enumDeprecated": [ false, true, false, false, false ] }, "resourceId": { "type": "string", "format": "int64", "description": "Output only. Resource identifier. For a project this represents project_number.", "readOnly": true } }, "description": "Represent the resources that are children of this Workload." }, "GoogleCloudAssuredworkloadsV1beta1ManualCloudControlAssessmentDetails": { "description": "The details for a manual cloud control assessment.", "id": "GoogleCloudAssuredworkloadsV1beta1ManualCloudControlAssessmentDetails", "properties": { "manualCloudControlGuide": { "items": { "type": "string" }, "description": "The guide for assessing a cloud control manually.", "type": "array" } }, "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadUpdate": { "type": "object", "properties": { "name": { "description": "Output only. Immutable. Identifier. Resource name of the WorkloadUpdate. Format: organizations/{organization}/locations/{location}/workloads/{workload}/updates/{update}", "readOnly": true, "type": "string" }, "state": { "type": "string", "enum": [ "STATE_UNSPECIFIED", "AVAILABLE", "APPLIED", "WITHDRAWN" ], "description": "Output only. The state of the update.", "readOnly": true, "enumDescriptions": [ "Unspecified.", "The update is available to be applied.", "The update has been applied.", "The update has been withdrawn by the service." ] }, "details": { "description": "The details of the update.", "$ref": "GoogleCloudAssuredworkloadsV1beta1UpdateDetails" }, "updateTime": { "format": "google-datetime", "description": "The time the update was last updated.", "type": "string" }, "createTime": { "type": "string", "description": "The time the update was created.", "format": "google-datetime" } }, "description": "A workload update is a change to the workload's compliance configuration.", "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadUpdate" }, "GoogleCloudAssuredworkloadsV1beta1ListDbFindingSummariesResponse": { "type": "object", "description": "The response message for ListDbFindingSummaries.", "id": "GoogleCloudAssuredworkloadsV1beta1ListDbFindingSummariesResponse", "properties": { "dbFindingSummaries": { "description": "The list of finding summaries, one for each finding category.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1DbFindingSummary" } }, "nextPageToken": { "type": "string", "description": "Output only. A token that can be sent as `page_token` to retrieve the next page. If this field is empty, there are no subsequent pages.", "readOnly": true } } }, "GoogleCloudAssuredworkloadsV1beta1OrgPolicyPolicyRuleStringValues": { "id": "GoogleCloudAssuredworkloadsV1beta1OrgPolicyPolicyRuleStringValues", "properties": { "allowedValues": { "description": "List of values allowed at this resource.", "type": "array", "items": { "type": "string" } }, "deniedValues": { "description": "List of values denied at this resource.", "type": "array", "items": { "type": "string" } } }, "type": "object", "description": "The values allowed for a ListPolicy." }, "GoogleCloudAssuredworkloadsV1beta1OrgPolicyPolicyRule": { "properties": { "values": { "description": "ListPolicy only when custom values are specified.", "$ref": "GoogleCloudAssuredworkloadsV1beta1OrgPolicyPolicyRuleStringValues" }, "enforce": { "description": "BooleanPolicy only.", "type": "boolean" }, "allowAll": { "type": "boolean", "description": "ListPolicy only when all values are allowed." }, "denyAll": { "description": "ListPolicy only when all values are denied.", "type": "boolean" } }, "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1OrgPolicyPolicyRule", "description": "A rule used to express this policy." }, "GoogleCloudAssuredworkloadsV1beta1Rule": { "properties": { "celExpression": { "description": "The rule's logic expression in Common Expression Language (CEL).", "$ref": "GoogleCloudAssuredworkloadsV1beta1CELExpression" }, "description": { "type": "string", "description": "Optional. The rule description. The maximum length is 2000 characters." }, "ruleActionTypes": { "items": { "enum": [ "RULE_ACTION_TYPE_UNSPECIFIED", "RULE_ACTION_TYPE_PREVENTIVE", "RULE_ACTION_TYPE_DETECTIVE", "RULE_ACTION_TYPE_AUDIT" ], "enumDescriptions": [ "Default value. This value is unused.", "The rule is intended to prevent non-compliance.", "The rule is intended to detect non-compliance.", "The rule is intended to audit non-compliance." ], "type": "string" }, "type": "array", "description": "Required. The functionality that's enabled by the rule." } }, "id": "GoogleCloudAssuredworkloadsV1beta1Rule", "type": "object", "description": "A rule in the cloud control." }, "GoogleCloudAssuredworkloadsV1beta1TargetResourceDetails": { "description": "The details for a target resource.", "properties": { "createTime": { "type": "string", "description": "The create time of the target resource.", "format": "google-datetime" }, "frameworkDeployment": { "type": "string", "description": "The framework deployment name for the target resource. For example, `organizations/{organization_id}/locations/{location}/frameworkDeployments/{framework_deployment_id}`" }, "majorRevisionId": { "description": "The major revision ID of the framework for the target resource.", "type": "string", "format": "int64" }, "updateTime": { "format": "google-datetime", "type": "string", "description": "The update time of the target resource." }, "targetResourceDisplayName": { "type": "string", "description": "The display name of the target resource. For example, `google.com`, `staging-project`, or `development-folder`." }, "minorRevisionId": { "format": "int64", "type": "string", "description": "The minor revision ID of the framework for the target resource." }, "targetResource": { "description": "The target resource. For example, `organizations/1234567890`, `projects/1234567890`, or `folders/1234567890`.", "type": "string" } }, "id": "GoogleCloudAssuredworkloadsV1beta1TargetResourceDetails", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1WorkloadFedrampHighSettings": { "type": "object", "properties": { "kmsSettings": { "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings", "description": "Input only. Immutable. Settings used to create a CMEK crypto key." } }, "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadFedrampHighSettings", "description": "Settings specific to resources needed for FedRAMP High.", "deprecated": true }, "GoogleLongrunningOperation": { "type": "object", "properties": { "done": { "type": "boolean", "description": "If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available." }, "metadata": { "type": "object", "additionalProperties": { "description": "Properties of the object. Contains field @type with type URL.", "type": "any" }, "description": "Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any." }, "error": { "description": "The error result of the operation in case of failure or cancellation.", "$ref": "GoogleRpcStatus" }, "response": { "type": "object", "additionalProperties": { "description": "Properties of the object. Contains field @type with type URL.", "type": "any" }, "description": "The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`." }, "name": { "type": "string", "description": "The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`." } }, "description": "This resource represents a long-running operation that is the result of a network API call.", "id": "GoogleLongrunningOperation" }, "GoogleCloudAssuredworkloadsV1beta1DbFrameworkComplianceSummary": { "description": "A summary of the compliance status of a framework that's deployed in a Data Boundary scope.", "properties": { "controlsPassingTrend": { "description": "Output only. The trend of passing controls over the trend duration. This field is only populated when using `FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_FULL`.", "readOnly": true, "$ref": "GoogleCloudAssuredworkloadsV1beta1Trend" }, "supportedCloudProviders": { "description": "The cloud providers that are supported by the framework.", "items": { "enumDescriptions": [ "Default value. This value is unused.", "Amazon Web Services (AWS).", "Microsoft Azure.", "Google Cloud." ], "type": "string", "enum": [ "CLOUD_PROVIDER_UNSPECIFIED", "AWS", "AZURE", "GCP" ] }, "type": "array" }, "targetResourceDetails": { "description": "The details of the target resources (organizations, folders, or projects) that the framework is deployed on.", "type": "array", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1TargetResourceDetails" } }, "frameworkCategories": { "type": "array", "items": { "enum": [ "FRAMEWORK_CATEGORY_UNSPECIFIED", "INDUSTRY_DEFINED_STANDARD", "ASSURED_WORKLOADS", "DATA_SECURITY", "GOOGLE_BEST_PRACTICES", "CUSTOM_FRAMEWORK" ], "enumDescriptions": [ "Default value. This value is unused.", "An industry-defined framework.", "An Assured Workloads framework.", "A data security posture framework.", "A Google's best practices framework.", "A user-created framework." ], "type": "string" }, "description": "The categories of the framework." }, "findingCount": { "description": "Output only. The number of findings that were generated against the framework. This field is only populated when using `FRAMEWORK_COMPLIANCE_SUMMARY_VIEW_FULL`.", "readOnly": true, "type": "string", "format": "int64" }, "minorRevisionId": { "type": "string", "format": "int64", "description": "The minor revision ID of the framework." }, "frameworkDisplayName": { "description": "Optional. The display name of the framework.", "type": "string" }, "majorRevisionId": { "format": "int64", "description": "The major revision ID of the framework.", "type": "string" }, "frameworkType": { "enumDescriptions": [ "Default value. This value is unused.", "A framework that's provided and managed by Google.", "A framework that's created and managed by you." ], "type": "string", "description": "The type of the framework.", "enum": [ "FRAMEWORK_TYPE_UNSPECIFIED", "BUILT_IN", "CUSTOM" ] }, "name": { "type": "string", "description": "Identifier. The resource name of the framework compliance summary." }, "controlAssessmentDetails": { "description": "The number of passing, failing, and not assessed controls in the framework.", "$ref": "GoogleCloudAssuredworkloadsV1beta1ControlAssessmentDetails" }, "framework": { "type": "string", "description": "The resource name of the compliance framework." } }, "id": "GoogleCloudAssuredworkloadsV1beta1DbFrameworkComplianceSummary", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1ViolationExceptionContext": { "id": "GoogleCloudAssuredworkloadsV1beta1ViolationExceptionContext", "properties": { "comment": { "type": "string", "description": "The business justification that was provided when the violation was acknowledged." }, "userName": { "type": "string", "description": "The name of the user (or service account) who acknowledged the violation." }, "acknowledgementTime": { "format": "google-datetime", "description": "The time when the violation was acknowledged.", "type": "string" } }, "description": "Details about an acknowledgement (exception) of a violation.", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1SimilarControls": { "description": "The similar controls.", "type": "object", "properties": { "framework": { "description": "The name of the framework.", "type": "string" }, "controlId": { "type": "string", "description": "The ID of the control." } }, "id": "GoogleCloudAssuredworkloadsV1beta1SimilarControls" }, "GoogleCloudAssuredworkloadsV1beta1RestrictAllowedResourcesRequest": { "id": "GoogleCloudAssuredworkloadsV1beta1RestrictAllowedResourcesRequest", "description": "Request for restricting list of available resources in Workload environment.", "type": "object", "properties": { "restrictionType": { "type": "string", "description": "Required. The type of restriction for using gcp products in the Workload environment.", "enum": [ "RESTRICTION_TYPE_UNSPECIFIED", "ALLOW_ALL_GCP_RESOURCES", "ALLOW_COMPLIANT_RESOURCES", "APPEND_COMPLIANT_RESOURCES" ], "enumDescriptions": [ "Unknown restriction type.", "Allow the use all of all gcp products, irrespective of the compliance posture. This effectively removes gcp.restrictServiceUsage OrgPolicy on the AssuredWorkloads Folder.", "Based on Workload's compliance regime, allowed list changes. See - https://cloud.google.com/assured-workloads/docs/supported-products for the list of supported resources.", "Similar to ALLOW_COMPLIANT_RESOURCES but adds the list of compliant resources to the existing list of compliant resources. Effective org-policy of the Folder is considered to ensure there is no disruption to the existing customer workflows." ] } } }, "GoogleCloudAssuredworkloadsV1beta1WorkloadFedrampModerateSettings": { "id": "GoogleCloudAssuredworkloadsV1beta1WorkloadFedrampModerateSettings", "properties": { "kmsSettings": { "description": "Input only. Immutable. Settings used to create a CMEK crypto key.", "$ref": "GoogleCloudAssuredworkloadsV1beta1WorkloadKMSSettings" } }, "type": "object", "description": "Settings specific to resources needed for FedRAMP Moderate.", "deprecated": true }, "GoogleCloudAssuredworkloadsV1beta1Violation": { "properties": { "childResourceViolationCount": { "readOnly": true, "type": "integer", "format": "int32", "description": "Optional. Output only. For organization policy violations, the number of resource violations that are associated with this violation. This field is `0` for resource violations." }, "exceptionAuditLogLink": { "type": "string", "readOnly": true, "description": "Output only. Immutable. A link to the Cloud Audit Logs entries that contain the business justification that was provided when the violation was acknowledged. Format: `https://console.cloud.google.com/logs/query;query={logName}{protoPayload.resourceName}{protoPayload.methodName}{timeRange}{organization}`" }, "name": { "readOnly": true, "type": "string", "description": "Output only. Immutable. The resource name of the violation. Format: `organizations/{organization}/locations/{location}/workloads/{workload_id}/violations/{violations_id}`" }, "orgPolicyConstraint": { "type": "string", "deprecated": true, "description": "Output only. Immutable. Deprecated: This field is deprecated and might be removed in a future version of the API. Use `non_compliant_org_policy` instead, which contains the full resource name of the organization policy, including the constraint name. The organization policy constraint that was changed in a non-compliant way, which resulted in this violation.", "readOnly": true }, "beginTime": { "readOnly": true, "format": "google-datetime", "type": "string", "description": "Output only. The time of the event that triggered the violation." }, "acknowledged": { "description": "Whether the violation has been acknowledged.", "type": "boolean" }, "state": { "enum": [ "STATE_UNSPECIFIED", "RESOLVED", "UNRESOLVED", "EXCEPTION" ], "readOnly": true, "type": "string", "description": "Output only. The state of the violation.", "enumDescriptions": [ "Default value. The state isn't specified.", "The violation is resolved.", "The violation is unresolved and hasn't been acknowledged.", "The violation is unresolved and has been acknowledged as an exception." ] }, "resolveTime": { "readOnly": true, "type": "string", "format": "google-datetime", "description": "Output only. The time of the event that resolved the violation. This field is empty if the violation is unresolved." }, "updateTime": { "format": "google-datetime", "type": "string", "readOnly": true, "description": "Output only. The time when the violation record was last updated." }, "resourceName": { "readOnly": true, "description": "Optional. Output only. For resource violations, the full resource name of the non-compliant resource. For example, `//storage.googleapis.com/myprojectxyz-testbucket`. This field is empty for organization policy violations.", "type": "string" }, "resourceType": { "type": "string", "description": "Optional. Output only. For resource violations, the type of the non-compliant resource. For example, `compute.googleapis.com/Disk`. This field is empty for organization policy violations.", "readOnly": true }, "remediationMarkdown": { "description": "Output only. The remediation instructions for the violation, in Markdown format. This field is only populated by `GetViolation` when using `VIOLATION_VIEW_DATA_BOUNDARY`. When this field isn't populated, see `remediation` instead.", "readOnly": true, "type": "string" }, "auditLogLink": { "type": "string", "description": "Output only. Immutable. A link to the Cloud Audit Logs entries for the violated resource. Format: `https://console.cloud.google.com/logs/query;query={logName}{protoPayload.resourceName}{timeRange}{folder}`", "readOnly": true }, "acknowledgementTime": { "format": "google-datetime", "type": "string", "description": "Optional. The time when the violation was first acknowledged. To find the most recent time that the violation was acknowledged, check `exception_contexts`. This field is absent when `acknowledged` is `false`." }, "affectedFrameworks": { "readOnly": true, "description": "Output only. The IDs of the compliance frameworks that are affected by this violation. For example, `builtin-fedramp-high`. This field is only populated when using `VIOLATION_VIEW_DATA_BOUNDARY`.", "items": { "type": "string" }, "type": "array" }, "associatedOrgPolicyViolationId": { "readOnly": true, "description": "Optional. Output only. For resource violations, the ID of the organization policy violation that caused this resource violation. This field is empty for organization policy violations.", "type": "string" }, "nonCompliantOrgPolicy": { "type": "string", "description": "Output only. Immutable. The name of the organization policy that was modified with a non-compliant change and resulted in this violation. Formats: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}`", "readOnly": true }, "violationType": { "enum": [ "VIOLATION_TYPE_UNSPECIFIED", "ORG_POLICY", "RESOURCE" ], "enumDescriptions": [ "Default value. The violation type isn't specified.", "A violation that's caused by a non-compliant change to an organization policy.", "A violation that's caused by a non-compliant resource." ], "type": "string", "description": "Output only. The type of the violation.", "readOnly": true }, "remediation": { "readOnly": true, "description": "Output only. The remediation guidance for the violation.", "$ref": "GoogleCloudAssuredworkloadsV1beta1ViolationRemediation" }, "category": { "type": "string", "readOnly": true, "description": "Output only. The category that the violation is mapped to. For example, `Location`, `Service Usage`, `Access`, or `Encryption`." }, "description": { "readOnly": true, "description": "Output only. A description of the violation. For example, `OrgPolicy gcp.resourceLocations has non compliant value.`", "type": "string" }, "exceptionContexts": { "readOnly": true, "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1ViolationExceptionContext" }, "description": "Output only. The details of all of the acknowledgements (exceptions) for the violation.", "type": "array" }, "parentProjectNumber": { "readOnly": true, "description": "Optional. Output only. For resource violations, the number of the project that contains the non-compliant resource. This field is empty for organization policy violations.", "type": "string" } }, "description": "A compliance violation that's detected by Assured Workloads monitoring. A violation is created when an organization policy or a resource in a workload (or a Data Boundary scope) changes in a way that doesn't comply with the controls of the applicable compliance regime or framework.", "id": "GoogleCloudAssuredworkloadsV1beta1Violation", "type": "object" }, "GoogleCloudAssuredworkloadsV1beta1DbFindingSummary": { "properties": { "updateTime": { "description": "Output only. The time when the findings in the category were last updated.", "readOnly": true, "type": "string", "format": "google-datetime" }, "resourceFindingCount": { "readOnly": true, "format": "int64", "description": "Output only. The number of active resource findings in the category.", "type": "string" }, "findingCount": { "type": "string", "format": "int64", "description": "Output only. The total number of active findings in the category.", "readOnly": true }, "relatedFrameworks": { "items": { "type": "string" }, "type": "array", "description": "Optional. The display names of the compliance frameworks that the findings are related to." }, "severity": { "description": "Output only. The severity of the findings.", "enumDescriptions": [ "Default value. This value is unused.", "A critical vulnerability is easily discoverable by an external actor, exploitable, and results in the direct ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. Examples include publicly accessible unprotected user data and public SSH access with weak or no passwords. A critical threat is a threat that can access, modify, or delete data or execute unauthorized code within existing resources.", "A high-risk vulnerability can be easily discovered and exploited in combination with other vulnerabilities to gain direct access and the ability to execute arbitrary code, exfiltrate data, and otherwise gain additional access and privileges to cloud resources and workloads. An example is a database with weak or no passwords that is only accessible internally. This database could easily be compromised by an actor that had access to the internal network. A high-risk threat is a threat that can create new computational resources in an environment but can't access data or execute code in existing resources.", "A medium-risk vulnerability can be used by an actor to gain access to resources or privileges that enable them to eventually (through multiple steps or a complex exploit) gain access and the ability to execute arbitrary code or exfiltrate data. An example is a service account with access to more projects than it should have. If an actor gains access to the service account, they could potentially use that access to manipulate a project the service account was not intended to. A medium-risk threat can cause operational impact but might not access data or execute unauthorized code.", "A low-risk vulnerability hampers a security organization's ability to detect vulnerabilities or active threats in their deployment, or prevents the root cause investigation of security issues. An example is monitoring and logs being disabled for resource configurations and access. A low-risk threat is a threat that has obtained minimal access to an environment but can't access data, execute code, or create resources." ], "readOnly": true, "type": "string", "enum": [ "SEVERITY_UNSPECIFIED", "CRITICAL", "HIGH", "MEDIUM", "LOW" ] }, "organizationPolicyFindingCount": { "format": "int64", "type": "string", "readOnly": true, "description": "Output only. The number of active organization policy findings in the category." }, "name": { "description": "Identifier. The resource name of the finding summary.", "type": "string" }, "findingClass": { "description": "Output only. The class of the findings.", "readOnly": true, "enum": [ "FINDING_CLASS_UNSPECIFIED", "THREAT", "VULNERABILITY", "MISCONFIGURATION", "OBSERVATION", "SCC_ERROR", "POSTURE_VIOLATION", "TOXIC_COMBINATION", "SENSITIVE_DATA_RISK", "CHOKEPOINT" ], "enumDescriptions": [ "Default value. This value is unused.", "The activity is unwanted or malicious.", "A potential weakness in software that increases risk to confidentiality, integrity, and availability.", "A potential weakness in a cloud resource or asset configuration that increases risk.", "A security observation that is for informational purposes.", "An error that prevents Security Command Center from functioning properly.", "A potential security risk that's due to a change in the security posture.", "A combination of security issues that represent a more severe security problem when taken together.", "A potential security risk to data assets that contain sensitive data.", "A resource or resource group where high risk attack paths converge, based on attack path simulations (APS)." ], "type": "string" }, "findingCategory": { "readOnly": true, "type": "string", "description": "Output only. The category of the findings that are summarized." } }, "description": "A summary of the active findings for a finding category in a Data Boundary scope.", "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1DbFindingSummary" }, "GoogleCloudAssuredworkloadsV1beta1ListWorkloadsResponse": { "description": "Response of ListWorkloads endpoint.", "properties": { "workloads": { "type": "array", "description": "List of Workloads under a given parent.", "items": { "$ref": "GoogleCloudAssuredworkloadsV1beta1Workload" } }, "nextPageToken": { "type": "string", "description": "The next page token. Return empty if reached the last page." } }, "type": "object", "id": "GoogleCloudAssuredworkloadsV1beta1ListWorkloadsResponse" }, "GoogleCloudAssuredworkloadsV1beta1OrgPolicy": { "id": "GoogleCloudAssuredworkloadsV1beta1OrgPolicy", "description": "This assured workload service object is used to represent the org policy attached to a resource. It servces the same purpose as the orgpolicy.v2.Policy object but with functionality that is limited to what is supported by Assured Workloads(e.g. only one rule under one OrgPolicy object, no conditions, etc).", "type": "object", "properties": { "reset": { "description": "Ignores policies set above this resource and restores to the `constraint_default` value. `reset` can only be true when `rules` is empty and `inherit` is false.", "type": "boolean" }, "resource": { "description": "Resource that the OrgPolicy attaches to. Format: folders/123\" projects/123\".", "type": "string" }, "inherit": { "description": "If `inherit` is true, policy rules of the lowest ancestor in the resource hierarchy chain are inherited. If it is false, policy rules are not inherited.", "type": "boolean" }, "rule": { "$ref": "GoogleCloudAssuredworkloadsV1beta1OrgPolicyPolicyRule", "description": "The rule of the OrgPolicy." }, "constraint": { "type": "string", "description": "The constraint name of the OrgPolicy. e.g. \"constraints/gcp.resourceLocations\"." } } }, "GoogleLongrunningListOperationsResponse": { "description": "The response message for Operations.ListOperations.", "properties": { "unreachable": { "type": "array", "items": { "type": "string" }, "description": "Unordered list. Unreachable resources. Populated when the request sets `ListOperationsRequest.return_partial_success` and reads across collections. For example, when attempting to list all resources across all supported locations." }, "nextPageToken": { "type": "string", "description": "The standard List next-page token." }, "operations": { "items": { "$ref": "GoogleLongrunningOperation" }, "type": "array", "description": "A list of operations that matches the specified filter in the request." } }, "type": "object", "id": "GoogleLongrunningListOperationsResponse" } }, "servicePath": "", "mtlsRootUrl": "https://assuredworkloads.mtls.googleapis.com/", "auth": { "oauth2": { "scopes": { "https://www.googleapis.com/auth/cloud-platform": { "description": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account." } } } }, "parameters": { "key": { "type": "string", "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.", "location": "query" }, "alt": { "default": "json", "enumDescriptions": [ "Responses with Content-Type of application/json", "Media download with context-dependent Content-Type", "Responses with Content-Type of application/x-protobuf" ], "location": "query", "type": "string", "description": "Data format for response.", "enum": [ "json", "media", "proto" ] }, "callback": { "type": "string", "description": "JSONP", "location": "query" }, "fields": { "description": "Selector specifying which fields to include in a partial response.", "type": "string", "location": "query" }, "$.xgafv": { "enum": [ "1", "2" ], "description": "V1 error format.", "enumDescriptions": [ "v1 error format", "v2 error format" ], "location": "query", "type": "string" }, "access_token": { "type": "string", "description": "OAuth access token.", "location": "query" }, "oauth_token": { "description": "OAuth 2.0 token for the current user.", "location": "query", "type": "string" }, "prettyPrint": { "location": "query", "description": "Returns response with indentations and line breaks.", "type": "boolean", "default": "true" }, "quotaUser": { "location": "query", "type": "string", "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters." }, "upload_protocol": { "location": "query", "type": "string", "description": "Upload protocol for media (e.g. \"raw\", \"multipart\")." }, "uploadType": { "type": "string", "location": "query", "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\")." } }, "discoveryVersion": "v1" }