Skip to content

Commit fc5be6f

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add PolicyViolation to the AuditLog proto, this will only be present when access is denied due to Organization Policy. It describes why access is denied
feat: Add FirstPartyAppMetadata to the BigQueryAuditMetadata proto, it contains metadata about requests originating from Google apps, such as Google Sheets feat: Added new events to BigQueryAuditMetadata such as UnlinkDataset and RowAccessPolicyCreation docs: Updated multiple comments PiperOrigin-RevId: 480349286
1 parent b37db60 commit fc5be6f

3 files changed

Lines changed: 524 additions & 298 deletions

File tree

‎google/cloud/audit/BUILD.bazel‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
# This file was automatically generated by BuildFileGenerator
2+
# https://github.com/googleapis/rules_gapic/tree/master/bazel
3+
4+
# Most of the manual changes to this file will be overwritten.
5+
# It's **only** allowed to change the following rule attribute values:
6+
# - names of *_gapic_assembly_* rules
7+
# - certain parameters of *_gapic_library rules, including but not limited to:
8+
# * extra_protoc_parameters
9+
# * extra_protoc_file_parameters
10+
# The complete list of preserved parameters can be found in the source code.
211

312
# This is an API workspace, having public visibility by default makes perfect sense.
413
package(default_visibility = ["//visibility:public"])
@@ -7,30 +16,31 @@ package(default_visibility = ["//visibility:public"])
716
# Common
817
##############################################################################
918
load("@rules_proto//proto:defs.bzl", "proto_library")
19+
load("@com_google_googleapis_imports//:imports.bzl", "proto_library_with_info")
1020

1121
proto_library(
1222
name = "audit_proto",
1323
srcs = [
1424
"audit_log.proto",
25+
"bigquery_audit_metadata.proto",
1526
],
1627
deps = [
28+
"//google/api:field_behavior_proto",
29+
"//google/iam/v1:policy_proto",
1730
"//google/rpc:status_proto",
1831
"//google/rpc/context:attribute_context_proto",
1932
"@com_google_protobuf//:any_proto",
33+
"@com_google_protobuf//:duration_proto",
2034
"@com_google_protobuf//:struct_proto",
35+
"@com_google_protobuf//:timestamp_proto",
2136
],
2237
)
2338

24-
proto_library(
25-
name = "bigquery_audit_metadata_proto",
26-
srcs = [
27-
"bigquery_audit_metadata.proto",
28-
],
39+
proto_library_with_info(
40+
name = "audit_proto_with_info",
2941
deps = [
30-
"//google/iam/v1:policy_proto",
31-
"//google/rpc:status_proto",
32-
"@com_google_protobuf//:duration_proto",
33-
"@com_google_protobuf//:timestamp_proto",
42+
":audit_proto",
43+
"//google/cloud:common_resources_proto",
3444
],
3545
)
3646

@@ -46,10 +56,7 @@ load(
4656

4757
java_proto_library(
4858
name = "audit_java_proto",
49-
deps = [
50-
":audit_proto",
51-
":bigquery_audit_metadata_proto",
52-
],
59+
deps = [":audit_proto"],
5360
)
5461

5562
java_grpc_library(
@@ -85,6 +92,8 @@ go_proto_library(
8592
importpath = "google.golang.org/genproto/googleapis/cloud/audit",
8693
protos = [":audit_proto"],
8794
deps = [
95+
"//google/api:annotations_go_proto",
96+
"//google/iam/v1:iam_go_proto",
8897
"//google/rpc:status_go_proto",
8998
"//google/rpc/context:attribute_context_go_proto",
9099
],
@@ -104,10 +113,14 @@ moved_proto_library(
104113
name = "audit_moved_proto",
105114
srcs = [":audit_proto"],
106115
deps = [
116+
"//google/api:field_behavior_proto",
117+
"//google/iam/v1:policy_proto",
107118
"//google/rpc:status_proto",
108119
"//google/rpc/context:attribute_context_proto",
109120
"@com_google_protobuf//:any_proto",
121+
"@com_google_protobuf//:duration_proto",
110122
"@com_google_protobuf//:struct_proto",
123+
"@com_google_protobuf//:timestamp_proto",
111124
],
112125
)
113126

‎google/cloud/audit/audit_log.proto‎

Lines changed: 81 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2021 Google LLC
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@ syntax = "proto3";
1616

1717
package google.cloud.audit;
1818

19+
import "google/api/field_behavior.proto";
1920
import "google/protobuf/any.proto";
2021
import "google/protobuf/struct.proto";
2122
import "google/rpc/context/attribute_context.proto";
@@ -76,6 +77,11 @@ message AuditLog {
7677
// one AuthorizationInfo element for each {resource, permission} tuple.
7778
repeated AuthorizationInfo authorization_info = 9;
7879

80+
// Indicates the policy violations for this request. If the request
81+
// is denied by the policy, violation information will be logged
82+
// here.
83+
PolicyViolationInfo policy_violation_info = 25;
84+
7985
// Metadata about the operation.
8086
RequestMetadata request_metadata = 4;
8187

@@ -111,8 +117,8 @@ message AuthenticationInfo {
111117
// of third party principal) making the request. For third party identity
112118
// callers, the `principal_subject` field is populated instead of this field.
113119
// For privacy reasons, the principal email address is sometimes redacted.
114-
// For more information, see
115-
// https://cloud.google.com/logging/docs/audit#user-id.
120+
// For more information, see [Caller identities in audit
121+
// logs](https://cloud.google.com/logging/docs/audit#user-id).
116122
string principal_email = 1;
117123

118124
// The authority selector specified by the requestor, if any.
@@ -173,14 +179,16 @@ message AuthorizationInfo {
173179
// Metadata about the request.
174180
message RequestMetadata {
175181
// The IP address of the caller.
176-
// For caller from internet, this will be public IPv4 or IPv6 address.
177-
// For caller from a Compute Engine VM with external IP address, this
178-
// will be the VM's external IP address. For caller from a Compute
179-
// Engine VM without external IP address, if the VM is in the same
180-
// organization (or project) as the accessed resource, `caller_ip` will
181-
// be the VM's internal IPv4 address, otherwise the `caller_ip` will be
182-
// redacted to "gce-internal-ip".
183-
// See https://cloud.google.com/compute/docs/vpc/ for more information.
182+
// For a caller from the internet, this will be the public IPv4 or IPv6
183+
// address. For calls made from inside Google's internal production network
184+
// from one GCP service to another, `caller_ip` will be redacted to "private".
185+
// For a caller from a Compute Engine VM with a external IP address,
186+
// `caller_ip` will be the VM's external IP address. For a caller from a
187+
// Compute Engine VM without a external IP address, if the VM is in the same
188+
// organization (or project) as the accessed resource, `caller_ip` will be the
189+
// VM's internal IPv4 address, otherwise `caller_ip` will be redacted to
190+
// "gce-internal-ip". See https://cloud.google.com/compute/docs/vpc/ for more
191+
// information.
184192
string caller_ip = 1;
185193

186194
// The user agent of the caller.
@@ -281,3 +289,65 @@ message ServiceAccountDelegationInfo {
281289
ThirdPartyPrincipal third_party_principal = 2;
282290
}
283291
}
292+
293+
// Information related to policy violations for this request.
294+
message PolicyViolationInfo {
295+
// Indicates the orgpolicy violations for this resource.
296+
OrgPolicyViolationInfo org_policy_violation_info = 1;
297+
}
298+
299+
// Represents OrgPolicy Violation information.
300+
message OrgPolicyViolationInfo {
301+
// Optional. Resource payload that is currently in scope and is subjected to orgpolicy
302+
// conditions. This payload may be the subset of the actual Resource that may
303+
// come in the request. This payload should not contain any core content.
304+
google.protobuf.Struct payload = 1 [(google.api.field_behavior) = OPTIONAL];
305+
306+
// Optional. Resource type that the orgpolicy is checked against.
307+
// Example: compute.googleapis.com/Instance, store.googleapis.com/bucket
308+
string resource_type = 2 [(google.api.field_behavior) = OPTIONAL];
309+
310+
// Optional. Tags referenced on the resource at the time of evaluation. These also
311+
// include the federated tags, if they are supplied in the CheckOrgPolicy
312+
// or CheckCustomConstraints Requests.
313+
//
314+
// Optional field as of now. These tags are the Cloud tags that are
315+
// available on the resource during the policy evaluation and will
316+
// be available as part of the OrgPolicy check response for logging purposes.
317+
map<string, string> resource_tags = 3 [(google.api.field_behavior) = OPTIONAL];
318+
319+
// Optional. Policy violations
320+
repeated ViolationInfo violation_info = 4 [(google.api.field_behavior) = OPTIONAL];
321+
}
322+
323+
// Provides information about the Policy violation info for this request.
324+
message ViolationInfo {
325+
// Policy Type enum
326+
enum PolicyType {
327+
// Default value. This value should not be used.
328+
POLICY_TYPE_UNSPECIFIED = 0;
329+
330+
// Indicates boolean policy constraint
331+
BOOLEAN_CONSTRAINT = 1;
332+
333+
// Indicates list policy constraint
334+
LIST_CONSTRAINT = 2;
335+
336+
// Indicates custom policy constraint
337+
CUSTOM_CONSTRAINT = 3;
338+
}
339+
340+
// Optional. Constraint name
341+
string constraint = 1 [(google.api.field_behavior) = OPTIONAL];
342+
343+
// Optional. Error message that policy is indicating.
344+
string error_message = 2 [(google.api.field_behavior) = OPTIONAL];
345+
346+
// Optional. Value that is being checked for the policy.
347+
// This could be in encrypted form (if pii sensitive).
348+
// This field will only be emitted in LIST_POLICY types
349+
string checked_value = 3 [(google.api.field_behavior) = OPTIONAL];
350+
351+
// Optional. Indicates the type of the policy.
352+
PolicyType policy_type = 4 [(google.api.field_behavior) = OPTIONAL];
353+
}

0 commit comments

Comments
 (0)