Skip to content

Commit 2433bd5

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
cloudasset: add SearchAllResources and SearchAllIamPolicies RPCs
PiperOrigin-RevId: 311601348
1 parent 123873d commit 2433bd5

3 files changed

Lines changed: 378 additions & 21 deletions

File tree

‎google/cloud/asset/v1/asset_service.proto‎

Lines changed: 193 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,14 @@ option php_namespace = "Google\\Cloud\\Asset\\V1";
3737
// Asset service definition.
3838
service AssetService {
3939
option (google.api.default_host) = "cloudasset.googleapis.com";
40-
option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
40+
option (google.api.oauth_scopes) =
41+
"https://www.googleapis.com/auth/cloud-platform";
4142

4243
// Exports assets with time and resource types to a given Cloud Storage
4344
// location. The output format is newline-delimited JSON.
44-
// This API implements the [google.longrunning.Operation][google.longrunning.Operation] API allowing you
45-
// to keep track of the export.
45+
// This API implements the
46+
// [google.longrunning.Operation][google.longrunning.Operation] API allowing
47+
// you to keep track of the export.
4648
rpc ExportAssets(ExportAssetsRequest) returns (google.longrunning.Operation) {
4749
option (google.api.http) = {
4850
post: "/v1/{parent=*/*}:exportAssets"
@@ -61,7 +63,8 @@ service AssetService {
6163
// attached IAM POLICY both exist. This can create gaps in the output history.
6264
// If a specified asset does not exist, this API returns an INVALID_ARGUMENT
6365
// error.
64-
rpc BatchGetAssetsHistory(BatchGetAssetsHistoryRequest) returns (BatchGetAssetsHistoryResponse) {
66+
rpc BatchGetAssetsHistory(BatchGetAssetsHistoryRequest)
67+
returns (BatchGetAssetsHistoryResponse) {
6568
option (google.api.http) = {
6669
get: "/v1/{parent=*/*}:batchGetAssetsHistory"
6770
};
@@ -109,6 +112,30 @@ service AssetService {
109112
};
110113
option (google.api.method_signature) = "name";
111114
}
115+
116+
// Searches all the resources within the given accessible scope (e.g., a
117+
// project, a folder or an organization). Callers should have
118+
// cloud.assets.SearchAllResources permission upon the requested scope,
119+
// otherwise the request will be rejected.
120+
rpc SearchAllResources(SearchAllResourcesRequest)
121+
returns (SearchAllResourcesResponse) {
122+
option (google.api.http) = {
123+
get: "/v1/{scope=*/*}:searchAllResources"
124+
};
125+
option (google.api.method_signature) = "scope,query,asset_types";
126+
}
127+
128+
// Searches all the IAM policies within the given accessible scope (e.g., a
129+
// project, a folder or an organization). Callers should have
130+
// cloud.assets.SearchAllIamPolicies permission upon the requested scope,
131+
// otherwise the request will be rejected.
132+
rpc SearchAllIamPolicies(SearchAllIamPoliciesRequest)
133+
returns (SearchAllIamPoliciesResponse) {
134+
option (google.api.http) = {
135+
get: "/v1/{scope=*/*}:searchAllIamPolicies"
136+
};
137+
option (google.api.method_signature) = "scope,query";
138+
}
112139
}
113140

114141
// Export asset request.
@@ -148,8 +175,10 @@ message ExportAssetsRequest {
148175
}
149176

150177
// The export asset response. This message is returned by the
151-
// [google.longrunning.Operations.GetOperation][google.longrunning.Operations.GetOperation] method in the returned
152-
// [google.longrunning.Operation.response][google.longrunning.Operation.response] field.
178+
// [google.longrunning.Operations.GetOperation][google.longrunning.Operations.GetOperation]
179+
// method in the returned
180+
// [google.longrunning.Operation.response][google.longrunning.Operation.response]
181+
// field.
153182
message ExportAssetsResponse {
154183
// Time the snapshot was taken.
155184
google.protobuf.Timestamp read_time = 1;
@@ -214,9 +243,8 @@ message CreateFeedRequest {
214243
// be unique under a specific parent project/folder/organization.
215244
string feed_id = 2 [(google.api.field_behavior) = REQUIRED];
216245

217-
// Required. The feed details. The field `name` must be empty and it will be generated
218-
// in the format of:
219-
// projects/project_number/feeds/feed_id
246+
// Required. The feed details. The field `name` must be empty and it will be
247+
// generated in the format of: projects/project_number/feeds/feed_id
220248
// folders/folder_number/feeds/feed_id
221249
// organizations/organization_number/feeds/feed_id
222250
Feed feed = 3 [(google.api.field_behavior) = REQUIRED];
@@ -230,9 +258,7 @@ message GetFeedRequest {
230258
// organizations/organization_number/feeds/feed_id
231259
string name = 1 [
232260
(google.api.field_behavior) = REQUIRED,
233-
(google.api.resource_reference) = {
234-
type: "cloudasset.googleapis.com/Feed"
235-
}
261+
(google.api.resource_reference) = { type: "cloudasset.googleapis.com/Feed" }
236262
];
237263
}
238264

@@ -251,8 +277,8 @@ message ListFeedsResponse {
251277

252278
// Update asset feed request.
253279
message UpdateFeedRequest {
254-
// Required. The new values of feed details. It must match an existing feed and the
255-
// field `name` must be in the format of:
280+
// Required. The new values of feed details. It must match an existing feed
281+
// and the field `name` must be in the format of:
256282
// projects/project_number/feeds/feed_id or
257283
// folders/folder_number/feeds/feed_id or
258284
// organizations/organization_number/feeds/feed_id.
@@ -261,7 +287,8 @@ message UpdateFeedRequest {
261287
// Required. Only updates the `feed` fields indicated by this mask.
262288
// The field mask must not be empty, and it must not contain fields that
263289
// are immutable or only set by the server.
264-
google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
290+
google.protobuf.FieldMask update_mask = 2
291+
[(google.api.field_behavior) = REQUIRED];
265292
}
266293

267294
message DeleteFeedRequest {
@@ -271,9 +298,7 @@ message DeleteFeedRequest {
271298
// organizations/organization_number/feeds/feed_id
272299
string name = 1 [
273300
(google.api.field_behavior) = REQUIRED,
274-
(google.api.resource_reference) = {
275-
type: "cloudasset.googleapis.com/Feed"
276-
}
301+
(google.api.resource_reference) = { type: "cloudasset.googleapis.com/Feed" }
277302
];
278303
}
279304

@@ -401,7 +426,156 @@ message Feed {
401426

402427
// Required. Feed output configuration defining where the asset updates are
403428
// published to.
404-
FeedOutputConfig feed_output_config = 5 [(google.api.field_behavior) = REQUIRED];
429+
FeedOutputConfig feed_output_config = 5
430+
[(google.api.field_behavior) = REQUIRED];
431+
}
432+
433+
// Search all resources request.
434+
message SearchAllResourcesRequest {
435+
// Required. A scope can be a project, a folder or an organization. The search
436+
// is limited to the resources within the `scope`.
437+
//
438+
// The allowed values are:
439+
//
440+
// * projects/{PROJECT_ID}
441+
// * projects/{PROJECT_NUMBER}
442+
// * folders/{FOLDER_NUMBER}
443+
// * organizations/{ORGANIZATION_NUMBER}
444+
string scope = 1 [(google.api.field_behavior) = REQUIRED];
445+
446+
// Optional. The query statement. An empty query can be specified to search
447+
// all the resources of certain `asset_types` within the given `scope`.
448+
//
449+
// Examples:
450+
//
451+
// * `name : "Important"` to find Cloud resources whose name contains
452+
// "Important" as a word.
453+
// * `displayName : "Impor*"` to find Cloud resources whose display name
454+
// contains "Impor" as a word prefix.
455+
// * `description : "*por*"` to find Cloud resources whose description
456+
// contains "por" as a substring.
457+
// * `location : "us-west*"` to find Cloud resources whose location is
458+
// prefixed with "us-west".
459+
// * `labels : "prod"` to find Cloud resources whose labels contain "prod" as
460+
// a key or value.
461+
// * `labels.env : "prod"` to find Cloud resources which have a label "env"
462+
// and its value is "prod".
463+
// * `labels.env : *` to find Cloud resources which have a label "env".
464+
// * `"Important"` to find Cloud resources which contain "Important" as a word
465+
// in any of the searchable fields.
466+
// * `"Impor*"` to find Cloud resources which contain "Impor" as a word prefix
467+
// in any of the searchable fields.
468+
// * `"*por*"` to find Cloud resources which contain "por" as a substring in
469+
// any of the searchable fields.
470+
// * `("Important" AND location : ("us-west1" OR "global"))` to find Cloud
471+
// resources which contain "Important" as a word in any of the searchable
472+
// fields and are also located in the "us-west1" region or the "global"
473+
// location.
474+
//
475+
// See [how to construct a
476+
// query](https://cloud.google.com/asset-inventory/docs/searching-resources#how_to_construct_a_query)
477+
// for more details.
478+
string query = 2 [(google.api.field_behavior) = OPTIONAL];
479+
480+
// Optional. A list of asset types that this request searches for. If empty,
481+
// it will search all the [searchable asset
482+
// types](https://cloud.google.com/asset-inventory/docs/supported-asset-types#searchable_asset_types).
483+
repeated string asset_types = 3 [(google.api.field_behavior) = OPTIONAL];
484+
485+
// Optional. The page size for search result pagination. Page size is capped
486+
// at 500 even if a larger value is given. If set to zero, server will pick an
487+
// appropriate default. Returned results may be fewer than requested. When
488+
// this happens, there could be more results as long as `next_page_token` is
489+
// returned.
490+
int32 page_size = 4 [(google.api.field_behavior) = OPTIONAL];
491+
492+
// Optional. If present, then retrieve the next batch of results from the
493+
// preceding call to this method. `page_token` must be the value of
494+
// `next_page_token` from the previous response. The values of all other
495+
// method parameters, must be identical to those in the previous call.
496+
string page_token = 5 [(google.api.field_behavior) = OPTIONAL];
497+
498+
// Optional. A comma separated list of fields specifying the sorting order of
499+
// the results. The default order is ascending. Add " DESC" after the field
500+
// name to indicate descending order. Redundant space characters are ignored.
501+
// Example: "location DESC, name". See [supported resource metadata
502+
// fields](https://cloud.google.com/asset-inventory/docs/searching-resources#query_on_resource_metadata_fields)
503+
// for more details.
504+
string order_by = 6 [(google.api.field_behavior) = OPTIONAL];
505+
}
506+
507+
// Search all resources response.
508+
message SearchAllResourcesResponse {
509+
// A list of Resources that match the search query. It contains the resource
510+
// standard metadata information.
511+
repeated ResourceSearchResult results = 1;
512+
513+
// If there are more results than those appearing in this response, then
514+
// `next_page_token` is included. To get the next set of results, call this
515+
// method again using the value of `next_page_token` as `page_token`.
516+
string next_page_token = 2;
517+
}
518+
519+
// Search all IAM policies request.
520+
message SearchAllIamPoliciesRequest {
521+
// Required. A scope can be a project, a folder or an organization. The search
522+
// is limited to the IAM policies within the `scope`.
523+
//
524+
// The allowed values are:
525+
//
526+
// * projects/{PROJECT_ID}
527+
// * projects/{PROJECT_NUMBER}
528+
// * folders/{FOLDER_NUMBER}
529+
// * organizations/{ORGANIZATION_NUMBER}
530+
string scope = 1 [(google.api.field_behavior) = REQUIRED];
531+
532+
// Optional. The query statement. An empty query can be specified to search
533+
// all the IAM policies within the given `scope`.
534+
//
535+
// Examples:
536+
//
537+
// * `policy : "[email protected]"` to find Cloud IAM policy bindings that
538+
// specify user "[email protected]".
539+
// * `policy : "roles/compute.admin"` to find Cloud IAM policy bindings that
540+
// specify the Compute Admin role.
541+
// * `policy.role.permissions : "storage.buckets.update"` to find Cloud IAM
542+
// policy bindings that specify a role containing "storage.buckets.update"
543+
// permission.
544+
// * `resource : "organizations/123"` to find Cloud IAM policy bindings that
545+
// are set on "organizations/123".
546+
// * `(resource : ("organizations/123" OR "folders/1234") AND policy : "amy")`
547+
// to find Cloud IAM policy bindings that are set on "organizations/123" or
548+
// "folders/1234", and also specify user "amy".
549+
//
550+
// See [how to construct a
551+
// query](https://cloud.google.com/asset-inventory/docs/searching-iam-policies#how_to_construct_a_query)
552+
// for more details.
553+
string query = 2 [(google.api.field_behavior) = OPTIONAL];
554+
555+
// Optional. The page size for search result pagination. Page size is capped
556+
// at 500 even if a larger value is given. If set to zero, server will pick an
557+
// appropriate default. Returned results may be fewer than requested. When
558+
// this happens, there could be more results as long as `next_page_token` is
559+
// returned.
560+
int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];
561+
562+
// Optional. If present, retrieve the next batch of results from the preceding
563+
// call to this method. `page_token` must be the value of `next_page_token`
564+
// from the previous response. The values of all other method parameters must
565+
// be identical to those in the previous call.
566+
string page_token = 4 [(google.api.field_behavior) = OPTIONAL];
567+
}
568+
569+
// Search all IAM policies response.
570+
message SearchAllIamPoliciesResponse {
571+
// A list of IamPolicy that match the search query. Related information such
572+
// as the associated resource is returned along with the policy.
573+
repeated IamPolicySearchResult results = 1;
574+
575+
// Set if there are more results than those appearing in this response; to get
576+
// the next set of results, call this method again, using this value as the
577+
// `page_token`.
578+
string next_page_token = 2;
405579
}
406580

407581
// Asset content type.

0 commit comments

Comments
 (0)