diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/async_client.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/async_client.py index a29458ebbeb5..7ae4c9bde9a7 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/async_client.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/async_client.py @@ -1444,11 +1444,11 @@ async def get_custom_constraint( timeout: Union[float, object] = gapic_v1.method.DEFAULT, metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), ) -> constraint.CustomConstraint: - r"""Gets a custom constraint. + r"""Gets a custom or managed constraint. Returns a ``google.rpc.Status`` with - ``google.rpc.Code.NOT_FOUND`` if the custom constraint does not - exist. + ``google.rpc.Code.NOT_FOUND`` if the custom or managed + constraint does not exist. .. code-block:: python @@ -1483,8 +1483,9 @@ async def sample_get_custom_constraint(): method. name (:class:`str`): Required. Resource name of the custom - constraint. See the custom constraint - entry for naming requirements. + or managed constraint. See the custom + constraint entry for naming + requirements. This corresponds to the ``name`` field on the ``request`` instance; if ``request`` is provided, this @@ -1623,8 +1624,8 @@ async def sample_list_custom_constraints(): google.cloud.orgpolicy_v2.services.org_policy.pagers.ListCustomConstraintsAsyncPager: The response returned from the [ListCustomConstraints] [google.cloud.orgpolicy.v2.OrgPolicy.ListCustomConstraints] - method. It will be empty if no custom constraints are - set on the organization resource. + method. It will be empty if no custom or managed + constraints are set on the organization resource. Iterating over this object will yield results and resolve additional pages automatically. diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/client.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/client.py index 93792e32bfee..9a43a4db5518 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/client.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/client.py @@ -1871,11 +1871,11 @@ def get_custom_constraint( timeout: Union[float, object] = gapic_v1.method.DEFAULT, metadata: Sequence[Tuple[str, Union[str, bytes]]] = (), ) -> constraint.CustomConstraint: - r"""Gets a custom constraint. + r"""Gets a custom or managed constraint. Returns a ``google.rpc.Status`` with - ``google.rpc.Code.NOT_FOUND`` if the custom constraint does not - exist. + ``google.rpc.Code.NOT_FOUND`` if the custom or managed + constraint does not exist. .. code-block:: python @@ -1910,8 +1910,9 @@ def sample_get_custom_constraint(): method. name (str): Required. Resource name of the custom - constraint. See the custom constraint - entry for naming requirements. + or managed constraint. See the custom + constraint entry for naming + requirements. This corresponds to the ``name`` field on the ``request`` instance; if ``request`` is provided, this @@ -2047,8 +2048,8 @@ def sample_list_custom_constraints(): google.cloud.orgpolicy_v2.services.org_policy.pagers.ListCustomConstraintsPager: The response returned from the [ListCustomConstraints] [google.cloud.orgpolicy.v2.OrgPolicy.ListCustomConstraints] - method. It will be empty if no custom constraints are - set on the organization resource. + method. It will be empty if no custom or managed + constraints are set on the organization resource. Iterating over this object will yield results and resolve additional pages automatically. diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py index a5a67a212b20..daf7dace7967 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc.py @@ -627,11 +627,11 @@ def get_custom_constraint( ) -> Callable[[orgpolicy.GetCustomConstraintRequest], constraint.CustomConstraint]: r"""Return a callable for the get custom constraint method over gRPC. - Gets a custom constraint. + Gets a custom or managed constraint. Returns a ``google.rpc.Status`` with - ``google.rpc.Code.NOT_FOUND`` if the custom constraint does not - exist. + ``google.rpc.Code.NOT_FOUND`` if the custom or managed + constraint does not exist. Returns: Callable[[~.GetCustomConstraintRequest], diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py index 497f3ce0c5b6..283c6f3a8b6d 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/grpc_asyncio.py @@ -643,11 +643,11 @@ def get_custom_constraint( ]: r"""Return a callable for the get custom constraint method over gRPC. - Gets a custom constraint. + Gets a custom or managed constraint. Returns a ``google.rpc.Status`` with - ``google.rpc.Code.NOT_FOUND`` if the custom constraint does not - exist. + ``google.rpc.Code.NOT_FOUND`` if the custom or managed + constraint does not exist. Returns: Callable[[~.GetCustomConstraintRequest], diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/rest.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/rest.py index bdae060e8d2b..e4df024cf4b5 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/rest.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/services/org_policy/transports/rest.py @@ -1978,8 +1978,8 @@ def __call__( ~.orgpolicy.ListCustomConstraintsResponse: The response returned from the [ListCustomConstraints] [google.cloud.orgpolicy.v2.OrgPolicy.ListCustomConstraints] - method. It will be empty if no custom constraints are - set on the organization resource. + method. It will be empty if no custom or managed + constraints are set on the organization resource. """ diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/constraint.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/constraint.py index 1144568f8075..73b74d04eebd 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/constraint.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/constraint.py @@ -17,6 +17,7 @@ from typing import MutableMapping, MutableSequence +from google.protobuf import struct_pb2 # type: ignore from google.protobuf import timestamp_pb2 # type: ignore import proto # type: ignore @@ -39,8 +40,8 @@ class Constraint(proto.Message): a policy that includes constraints at different locations in the organization's resource hierarchy. Policies are inherited down the resource hierarchy from higher levels, but can also be overridden. - For details about the inheritance rules please read about - [``policies``][google.cloud.OrgPolicy.v2.Policy]. + For details about the inheritance rules, see + [``Policy``][google.cloud.orgpolicy.v2.Policy]. Constraints have a default behavior determined by the ``constraint_default`` field, which is the enforcement behavior that @@ -79,18 +80,25 @@ class Constraint(proto.Message): The evaluation behavior of this constraint in the absence of a policy. list_constraint (google.cloud.orgpolicy_v2.types.Constraint.ListConstraint): - Defines this constraint as being a - ListConstraint. + Defines this constraint as being a list + constraint. This field is a member of `oneof`_ ``constraint_type``. boolean_constraint (google.cloud.orgpolicy_v2.types.Constraint.BooleanConstraint): - Defines this constraint as being a - BooleanConstraint. + Defines this constraint as being a boolean + constraint. This field is a member of `oneof`_ ``constraint_type``. supports_dry_run (bool): Shows if dry run is supported for this constraint or not. + equivalent_constraint (str): + Managed constraint and canned constraint + sometimes can have equivalents. This field is + used to store the equivalent constraint name. + supports_simulation (bool): + Shows if simulation is supported for this + constraint or not. """ class ConstraintDefault(proto.Enum): @@ -102,7 +110,8 @@ class ConstraintDefault(proto.Enum): Values: CONSTRAINT_DEFAULT_UNSPECIFIED (0): This is only used for distinguishing unset - values and should never be used. + values and should never be used. Results in an + error. ALLOW (1): Indicate that all values are allowed for list constraints. Indicate that enforcement is off @@ -117,9 +126,9 @@ class ConstraintDefault(proto.Enum): DENY = 2 class ListConstraint(proto.Message): - r"""A constraint that allows or disallows a list of string - values, which are configured by an Organization Policy - administrator with a policy. + r"""A constraint type that allows or disallows a list of string values, + which are configured in the + [``PolicyRule``][google.cloud.orgpolicy.v2.PolicySpec.PolicyRule]. Attributes: supports_in (bool): @@ -144,16 +153,225 @@ class ListConstraint(proto.Message): number=2, ) + class CustomConstraintDefinition(proto.Message): + r"""Custom constraint definition. Defines this as a managed + constraint. + + Attributes: + resource_types (MutableSequence[str]): + The resource instance type on which this policy applies. + Format will be of the form : ``/`` + Example: + + - ``compute.googleapis.com/Instance``. + method_types (MutableSequence[google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition.MethodType]): + All the operations being applied for this + constraint. + condition (str): + Org policy condition/expression. For example: + ``resource.instanceName.matches("[production|test]_.*_(\d)+")`` + or, ``resource.management.auto_upgrade == true`` + + The max length of the condition is 1000 characters. + action_type (google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition.ActionType): + Allow or deny type. + parameters (MutableMapping[str, google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition.Parameter]): + Stores the structure of + [``Parameters``][google.cloud.orgpolicy.v2.Constraint.CustomConstraintDefinition.Parameter] + used by the constraint condition. The key of ``map`` + represents the name of the parameter. + """ + + class MethodType(proto.Enum): + r"""The operation for which this constraint will be applied. To apply + this constraint only when creating new resources, the + ``method_types`` should be ``CREATE`` only. To apply this constraint + when creating or deleting resources, the ``method_types`` should be + ``CREATE`` and ``DELETE``. + + ``UPDATE``-only custom constraints are not supported. Use ``CREATE`` + or ``CREATE, UPDATE``. + + Values: + METHOD_TYPE_UNSPECIFIED (0): + This is only used for distinguishing unset + values and should never be used. Results in an + error. + CREATE (1): + Constraint applied when creating the + resource. + UPDATE (2): + Constraint applied when updating the + resource. + DELETE (3): + Constraint applied when deleting the + resource. Not currently supported. + REMOVE_GRANT (4): + Constraint applied when removing an IAM + grant. + GOVERN_TAGS (5): + Constraint applied when enforcing forced + tagging. + """ + METHOD_TYPE_UNSPECIFIED = 0 + CREATE = 1 + UPDATE = 2 + DELETE = 3 + REMOVE_GRANT = 4 + GOVERN_TAGS = 5 + + class ActionType(proto.Enum): + r"""Allow or deny type. + + Values: + ACTION_TYPE_UNSPECIFIED (0): + This is only used for distinguishing unset + values and should never be used. Results in an + error. + ALLOW (1): + Allowed action type. + DENY (2): + Deny action type. + """ + ACTION_TYPE_UNSPECIFIED = 0 + ALLOW = 1 + DENY = 2 + + class Parameter(proto.Message): + r"""Defines a parameter structure. + + Attributes: + type_ (google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition.Parameter.Type): + Type of the parameter. + default_value (google.protobuf.struct_pb2.Value): + Sets the value of the parameter in an + assignment if no value is given. + valid_values_expr (str): + Provides a CEL expression to specify the + acceptable parameter values during assignment. + For example, parameterName in + ("parameterValue1", "parameterValue2") + metadata (google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition.Parameter.Metadata): + Defines subproperties primarily used by the + UI to display user-friendly information. + item (google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition.Parameter.Type): + Determines the parameter's value structure. For example, + ``LIST`` can be specified by defining + ``type: LIST``, and ``item: STRING``. + """ + + class Type(proto.Enum): + r"""All valid types of parameter. + + Values: + TYPE_UNSPECIFIED (0): + This is only used for distinguishing unset + values and should never be used. Results in an + error. + LIST (1): + List parameter type. + STRING (2): + String parameter type. + BOOLEAN (3): + Boolean parameter type. + """ + TYPE_UNSPECIFIED = 0 + LIST = 1 + STRING = 2 + BOOLEAN = 3 + + class Metadata(proto.Message): + r"""Defines Metadata structure. + + Attributes: + description (str): + Detailed description of what this ``parameter`` is and use + of it. Mutable. + """ + + description: str = proto.Field( + proto.STRING, + number=1, + ) + + type_: "Constraint.CustomConstraintDefinition.Parameter.Type" = proto.Field( + proto.ENUM, + number=1, + enum="Constraint.CustomConstraintDefinition.Parameter.Type", + ) + default_value: struct_pb2.Value = proto.Field( + proto.MESSAGE, + number=2, + message=struct_pb2.Value, + ) + valid_values_expr: str = proto.Field( + proto.STRING, + number=3, + ) + metadata: "Constraint.CustomConstraintDefinition.Parameter.Metadata" = ( + proto.Field( + proto.MESSAGE, + number=4, + message="Constraint.CustomConstraintDefinition.Parameter.Metadata", + ) + ) + item: "Constraint.CustomConstraintDefinition.Parameter.Type" = proto.Field( + proto.ENUM, + number=5, + enum="Constraint.CustomConstraintDefinition.Parameter.Type", + ) + + resource_types: MutableSequence[str] = proto.RepeatedField( + proto.STRING, + number=1, + ) + method_types: MutableSequence[ + "Constraint.CustomConstraintDefinition.MethodType" + ] = proto.RepeatedField( + proto.ENUM, + number=2, + enum="Constraint.CustomConstraintDefinition.MethodType", + ) + condition: str = proto.Field( + proto.STRING, + number=3, + ) + action_type: "Constraint.CustomConstraintDefinition.ActionType" = proto.Field( + proto.ENUM, + number=4, + enum="Constraint.CustomConstraintDefinition.ActionType", + ) + parameters: MutableMapping[ + str, "Constraint.CustomConstraintDefinition.Parameter" + ] = proto.MapField( + proto.STRING, + proto.MESSAGE, + number=5, + message="Constraint.CustomConstraintDefinition.Parameter", + ) + class BooleanConstraint(proto.Message): - r"""A constraint that is either enforced or not. + r"""A constraint type is enforced or not enforced, which is configured + in the + [``PolicyRule``][google.cloud.orgpolicy.v2.PolicySpec.PolicyRule]. - For example, a constraint - ``constraints/compute.disableSerialPortAccess``. If it is enforced - on a VM instance, serial port connections will not be opened to that - instance. + If ``customConstraintDefinition`` is defined, this constraint is a + managed constraint. + Attributes: + custom_constraint_definition (google.cloud.orgpolicy_v2.types.Constraint.CustomConstraintDefinition): + Custom constraint definition. Defines this as + a managed constraint. """ + custom_constraint_definition: "Constraint.CustomConstraintDefinition" = ( + proto.Field( + proto.MESSAGE, + number=1, + message="Constraint.CustomConstraintDefinition", + ) + ) + name: str = proto.Field( proto.STRING, number=1, @@ -187,6 +405,14 @@ class BooleanConstraint(proto.Message): proto.BOOL, number=7, ) + equivalent_constraint: str = proto.Field( + proto.STRING, + number=8, + ) + supports_simulation: bool = proto.Field( + proto.BOOL, + number=9, + ) class CustomConstraint(proto.Message): @@ -214,14 +440,15 @@ class CustomConstraint(proto.Message): resource_types (MutableSequence[str]): Immutable. The resource instance type on which this policy applies. Format will be of the form : - ``/`` Example: + ``/`` Example: - ``compute.googleapis.com/Instance``. method_types (MutableSequence[google.cloud.orgpolicy_v2.types.CustomConstraint.MethodType]): All the operations being applied for this constraint. condition (str): - Org policy condition/expression. For example: + A Common Expression Language (CEL) condition which is used + in the evaluation of the constraint. For example: ``resource.instanceName.matches("[production|test]_.*_(\d)+")`` or, ``resource.management.auto_upgrade == true`` @@ -238,23 +465,25 @@ class CustomConstraint(proto.Message): update_time (google.protobuf.timestamp_pb2.Timestamp): Output only. The last time this custom constraint was updated. This represents the last time that the - ``CreateCustomConstraint`` or ``UpdateCustomConstraint`` RPC - was called + ``CreateCustomConstraint`` or ``UpdateCustomConstraint`` + methods were called. """ class MethodType(proto.Enum): r"""The operation for which this constraint will be applied. To apply - this constraint only when creating new VMs, the ``method_types`` - should be ``CREATE`` only. To apply this constraint when creating or - deleting VMs, the ``method_types`` should be ``CREATE`` and - ``DELETE``. + this constraint only when creating new resources, the + ``method_types`` should be ``CREATE`` only. To apply this constraint + when creating or deleting resources, the ``method_types`` should be + ``CREATE`` and ``DELETE``. ``UPDATE`` only custom constraints are not supported. Use ``CREATE`` or ``CREATE, UPDATE``. Values: METHOD_TYPE_UNSPECIFIED (0): - Unspecified. Results in an error. + This is only used for distinguishing unset + values and should never be used. Results in an + error. CREATE (1): Constraint applied when creating the resource. @@ -263,7 +492,7 @@ class MethodType(proto.Enum): resource. DELETE (3): Constraint applied when deleting the - resource. Not supported yet. + resource. Not currently supported. REMOVE_GRANT (4): Constraint applied when removing an IAM grant. @@ -283,7 +512,9 @@ class ActionType(proto.Enum): Values: ACTION_TYPE_UNSPECIFIED (0): - Unspecified. Results in an error. + This is only used for distinguishing unset + values and should never be used. Results in an + error. ALLOW (1): Allowed action type. DENY (2): diff --git a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/orgpolicy.py b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/orgpolicy.py index f4f31d6034b9..f45a2ff5fe05 100644 --- a/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/orgpolicy.py +++ b/packages/google-cloud-org-policy/google/cloud/orgpolicy_v2/types/orgpolicy.py @@ -18,6 +18,7 @@ from typing import MutableMapping, MutableSequence from google.protobuf import field_mask_pb2 # type: ignore +from google.protobuf import struct_pb2 # type: ignore from google.protobuf import timestamp_pb2 # type: ignore from google.type import expr_pb2 # type: ignore import proto # type: ignore @@ -70,8 +71,8 @@ class Policy(proto.Message): is also an acceptable name for API requests, but responses will return the name using the equivalent project number. spec (google.cloud.orgpolicy_v2.types.PolicySpec): - Basic information about the Organization - Policy. + Basic information about the organization + policy. alternate (google.cloud.orgpolicy_v2.types.AlternatePolicySpec): Deprecated. dry_run_spec (google.cloud.orgpolicy_v2.types.PolicySpec): @@ -116,8 +117,7 @@ class Policy(proto.Message): class AlternatePolicySpec(proto.Message): r"""Similar to PolicySpec but with an extra 'launch' field for - launch reference. The PolicySpec here is specific for - dry-run/darklaunch. + launch reference. The PolicySpec here is specific for dry-run. Attributes: launch (str): @@ -242,6 +242,13 @@ class PolicyRule(proto.Message): expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')". + parameters (google.protobuf.struct_pb2.Struct): + Optional. Required for managed constraints if parameters are + defined. Passes parameter values when policy enforcement is + enabled. Ensure that parameter value types match those + defined in the constraint definition. For example: { + "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : + true } """ class StringValues(proto.Message): @@ -307,6 +314,11 @@ class StringValues(proto.Message): number=5, message=expr_pb2.Expr, ) + parameters: struct_pb2.Struct = proto.Field( + proto.MESSAGE, + number=6, + message=struct_pb2.Struct, + ) etag: str = proto.Field( proto.STRING, @@ -612,9 +624,9 @@ class GetCustomConstraintRequest(proto.Message): Attributes: name (str): - Required. Resource name of the custom - constraint. See the custom constraint entry for - naming requirements. + Required. Resource name of the custom or + managed constraint. See the custom constraint + entry for naming requirements. """ name: str = proto.Field( @@ -663,14 +675,14 @@ class ListCustomConstraintsRequest(proto.Message): class ListCustomConstraintsResponse(proto.Message): r"""The response returned from the [ListCustomConstraints] [google.cloud.orgpolicy.v2.OrgPolicy.ListCustomConstraints] method. - It will be empty if no custom constraints are set on the + It will be empty if no custom or managed constraints are set on the organization resource. Attributes: custom_constraints (MutableSequence[google.cloud.orgpolicy_v2.types.CustomConstraint]): - All custom constraints that exist on the - organization resource. It will be empty if no - custom constraints are set. + All custom and managed constraints that exist + on the organization resource. It will be empty + if no custom constraints are set. next_page_token (str): Page token used to retrieve the next page. This is currently not used, but the server may diff --git a/packages/google-cloud-org-policy/tests/unit/gapic/orgpolicy_v2/test_org_policy.py b/packages/google-cloud-org-policy/tests/unit/gapic/orgpolicy_v2/test_org_policy.py index 6b6834eb9039..5277b91503ef 100644 --- a/packages/google-cloud-org-policy/tests/unit/gapic/orgpolicy_v2/test_org_policy.py +++ b/packages/google-cloud-org-policy/tests/unit/gapic/orgpolicy_v2/test_org_policy.py @@ -52,6 +52,7 @@ from google.auth.exceptions import MutualTLSChannelError from google.oauth2 import service_account from google.protobuf import field_mask_pb2 # type: ignore +from google.protobuf import struct_pb2 # type: ignore from google.protobuf import timestamp_pb2 # type: ignore from google.type import expr_pb2 # type: ignore @@ -9408,6 +9409,7 @@ def test_create_policy_rest_call_success(request_type): "description": "description_value", "location": "location_value", }, + "parameters": {"fields": {}}, } ], "inherit_from_parent": True, @@ -9633,6 +9635,7 @@ def test_update_policy_rest_call_success(request_type): "description": "description_value", "location": "location_value", }, + "parameters": {"fields": {}}, } ], "inherit_from_parent": True,