| 1 | <?php
|
|---|
| 2 | /*
|
|---|
| 3 | * Copyright 2014 Google Inc.
|
|---|
| 4 | *
|
|---|
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|---|
| 6 | * use this file except in compliance with the License. You may obtain a copy of
|
|---|
| 7 | * the License at
|
|---|
| 8 | *
|
|---|
| 9 | * http://www.apache.org/licenses/LICENSE-2.0
|
|---|
| 10 | *
|
|---|
| 11 | * Unless required by applicable law or agreed to in writing, software
|
|---|
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|---|
| 13 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|---|
| 14 | * License for the specific language governing permissions and limitations under
|
|---|
| 15 | * the License.
|
|---|
| 16 | */
|
|---|
| 17 |
|
|---|
| 18 | namespace Google\Service\CloudAsset\Resource;
|
|---|
| 19 |
|
|---|
| 20 | use Google\Service\CloudAsset\AnalyzeIamPolicyLongrunningRequest;
|
|---|
| 21 | use Google\Service\CloudAsset\AnalyzeIamPolicyResponse;
|
|---|
| 22 | use Google\Service\CloudAsset\AnalyzeMoveResponse;
|
|---|
| 23 | use Google\Service\CloudAsset\AnalyzeOrgPoliciesResponse;
|
|---|
| 24 | use Google\Service\CloudAsset\AnalyzeOrgPolicyGovernedAssetsResponse;
|
|---|
| 25 | use Google\Service\CloudAsset\AnalyzeOrgPolicyGovernedContainersResponse;
|
|---|
| 26 | use Google\Service\CloudAsset\BatchGetAssetsHistoryResponse;
|
|---|
| 27 | use Google\Service\CloudAsset\ExportAssetsRequest;
|
|---|
| 28 | use Google\Service\CloudAsset\Operation;
|
|---|
| 29 | use Google\Service\CloudAsset\QueryAssetsRequest;
|
|---|
| 30 | use Google\Service\CloudAsset\QueryAssetsResponse;
|
|---|
| 31 | use Google\Service\CloudAsset\SearchAllIamPoliciesResponse;
|
|---|
| 32 | use Google\Service\CloudAsset\SearchAllResourcesResponse;
|
|---|
| 33 |
|
|---|
| 34 | /**
|
|---|
| 35 | * The "v1" collection of methods.
|
|---|
| 36 | * Typical usage is:
|
|---|
| 37 | * <code>
|
|---|
| 38 | * $cloudassetService = new Google\Service\CloudAsset(...);
|
|---|
| 39 | * $v1 = $cloudassetService->v1;
|
|---|
| 40 | * </code>
|
|---|
| 41 | */
|
|---|
| 42 | class V1 extends \Google\Service\Resource
|
|---|
| 43 | {
|
|---|
| 44 | /**
|
|---|
| 45 | * Analyzes IAM policies to answer which identities have what accesses on which
|
|---|
| 46 | * resources. (v1.analyzeIamPolicy)
|
|---|
| 47 | *
|
|---|
| 48 | * @param string $scope Required. The relative name of the root asset. Only
|
|---|
| 49 | * resources and IAM policies within the scope will be analyzed. This can only
|
|---|
| 50 | * be an organization number (such as "organizations/123"), a folder number
|
|---|
| 51 | * (such as "folders/123"), a project ID (such as "projects/my-project-id"), or
|
|---|
| 52 | * a project number (such as "projects/12345"). To know how to get organization
|
|---|
| 53 | * ID, visit [here ](https://cloud.google.com/resource-manager/docs/creating-
|
|---|
| 54 | * managing-organization#retrieving_your_organization_id). To know how to get
|
|---|
| 55 | * folder or project ID, visit [here ](https://cloud.google.com/resource-
|
|---|
| 56 | * manager/docs/creating-managing-
|
|---|
| 57 | * folders#viewing_or_listing_folders_and_projects).
|
|---|
| 58 | * @param array $optParams Optional parameters.
|
|---|
| 59 | *
|
|---|
| 60 | * @opt_param string analysisQuery.accessSelector.permissions Optional. The
|
|---|
| 61 | * permissions to appear in result.
|
|---|
| 62 | * @opt_param string analysisQuery.accessSelector.roles Optional. The roles to
|
|---|
| 63 | * appear in result.
|
|---|
| 64 | * @opt_param string analysisQuery.conditionContext.accessTime The hypothetical
|
|---|
| 65 | * access timestamp to evaluate IAM conditions. Note that this value must not be
|
|---|
| 66 | * earlier than the current time; otherwise, an INVALID_ARGUMENT error will be
|
|---|
| 67 | * returned.
|
|---|
| 68 | * @opt_param string analysisQuery.identitySelector.identity Required. The
|
|---|
| 69 | * identity appear in the form of principals in [IAM policy
|
|---|
| 70 | * binding](https://cloud.google.com/iam/reference/rest/v1/Binding). The
|
|---|
| 71 | * examples of supported forms are: "user:mike@example.com",
|
|---|
| 72 | * "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-
|
|---|
| 73 | * id@appspot.gserviceaccount.com". Notice that wildcard characters (such as *
|
|---|
| 74 | * and ?) are not supported. You must give a specific identity.
|
|---|
| 75 | * @opt_param bool analysisQuery.options.analyzeServiceAccountImpersonation
|
|---|
| 76 | * Optional. If true, the response will include access analysis from identities
|
|---|
| 77 | * to resources via service account impersonation. This is a very expensive
|
|---|
| 78 | * operation, because many derived queries will be executed. We highly recommend
|
|---|
| 79 | * you use AssetService.AnalyzeIamPolicyLongrunning RPC instead. For example, if
|
|---|
| 80 | * the request analyzes for which resources user A has permission P, and there's
|
|---|
| 81 | * an IAM policy states user A has iam.serviceAccounts.getAccessToken permission
|
|---|
| 82 | * to a service account SA, and there's another IAM policy states service
|
|---|
| 83 | * account SA has permission P to a Google Cloud folder F, then user A
|
|---|
| 84 | * potentially has access to the Google Cloud folder F. And those advanced
|
|---|
| 85 | * analysis results will be included in
|
|---|
| 86 | * AnalyzeIamPolicyResponse.service_account_impersonation_analysis. Another
|
|---|
| 87 | * example, if the request analyzes for who has permission P to a Google Cloud
|
|---|
| 88 | * folder F, and there's an IAM policy states user A has
|
|---|
| 89 | * iam.serviceAccounts.actAs permission to a service account SA, and there's
|
|---|
| 90 | * another IAM policy states service account SA has permission P to the Google
|
|---|
| 91 | * Cloud folder F, then user A potentially has access to the Google Cloud folder
|
|---|
| 92 | * F. And those advanced analysis results will be included in
|
|---|
| 93 | * AnalyzeIamPolicyResponse.service_account_impersonation_analysis. Only the
|
|---|
| 94 | * following permissions are considered in this analysis: *
|
|---|
| 95 | * `iam.serviceAccounts.actAs` * `iam.serviceAccounts.signBlob` *
|
|---|
| 96 | * `iam.serviceAccounts.signJwt` * `iam.serviceAccounts.getAccessToken` *
|
|---|
| 97 | * `iam.serviceAccounts.getOpenIdToken` *
|
|---|
| 98 | * `iam.serviceAccounts.implicitDelegation` Default is false.
|
|---|
| 99 | * @opt_param bool analysisQuery.options.expandGroups Optional. If true, the
|
|---|
| 100 | * identities section of the result will expand any Google groups appearing in
|
|---|
| 101 | * an IAM policy binding. If IamPolicyAnalysisQuery.identity_selector is
|
|---|
| 102 | * specified, the identity in the result will be determined by the selector, and
|
|---|
| 103 | * this flag is not allowed to set. If true, the default max expansion per group
|
|---|
| 104 | * is 1000 for AssetService.AnalyzeIamPolicy][]. Default is false.
|
|---|
| 105 | * @opt_param bool analysisQuery.options.expandResources Optional. If true and
|
|---|
| 106 | * IamPolicyAnalysisQuery.resource_selector is not specified, the resource
|
|---|
| 107 | * section of the result will expand any resource attached to an IAM policy to
|
|---|
| 108 | * include resources lower in the resource hierarchy. For example, if the
|
|---|
| 109 | * request analyzes for which resources user A has permission P, and the results
|
|---|
| 110 | * include an IAM policy with P on a Google Cloud folder, the results will also
|
|---|
| 111 | * include resources in that folder with permission P. If true and
|
|---|
| 112 | * IamPolicyAnalysisQuery.resource_selector is specified, the resource section
|
|---|
| 113 | * of the result will expand the specified resource to include resources lower
|
|---|
| 114 | * in the resource hierarchy. Only project or lower resources are supported.
|
|---|
| 115 | * Folder and organization resources cannot be used together with this option.
|
|---|
| 116 | * For example, if the request analyzes for which users have permission P on a
|
|---|
| 117 | * Google Cloud project with this option enabled, the results will include all
|
|---|
| 118 | * users who have permission P on that project or any lower resource. If true,
|
|---|
| 119 | * the default max expansion per resource is 1000 for
|
|---|
| 120 | * AssetService.AnalyzeIamPolicy][] and 100000 for
|
|---|
| 121 | * AssetService.AnalyzeIamPolicyLongrunning][]. Default is false.
|
|---|
| 122 | * @opt_param bool analysisQuery.options.expandRoles Optional. If true, the
|
|---|
| 123 | * access section of result will expand any roles appearing in IAM policy
|
|---|
| 124 | * bindings to include their permissions. If
|
|---|
| 125 | * IamPolicyAnalysisQuery.access_selector is specified, the access section of
|
|---|
| 126 | * the result will be determined by the selector, and this flag is not allowed
|
|---|
| 127 | * to set. Default is false.
|
|---|
| 128 | * @opt_param bool analysisQuery.options.outputGroupEdges Optional. If true, the
|
|---|
| 129 | * result will output the relevant membership relationships between groups and
|
|---|
| 130 | * other groups, and between groups and principals. Default is false.
|
|---|
| 131 | * @opt_param bool analysisQuery.options.outputResourceEdges Optional. If true,
|
|---|
| 132 | * the result will output the relevant parent/child relationships between
|
|---|
| 133 | * resources. Default is false.
|
|---|
| 134 | * @opt_param string analysisQuery.resourceSelector.fullResourceName Required.
|
|---|
| 135 | * The [full resource name] (https://cloud.google.com/asset-
|
|---|
| 136 | * inventory/docs/resource-name-format) of a resource of [supported resource
|
|---|
| 137 | * types](https://cloud.google.com/asset-inventory/docs/supported-asset-
|
|---|
| 138 | * types#analyzable_asset_types).
|
|---|
| 139 | * @opt_param string executionTimeout Optional. Amount of time executable has to
|
|---|
| 140 | * complete. See JSON representation of
|
|---|
| 141 | * [Duration](https://developers.google.com/protocol-buffers/docs/proto3#json).
|
|---|
| 142 | * If this field is set with a value less than the RPC deadline, and the
|
|---|
| 143 | * execution of your query hasn't finished in the specified execution timeout,
|
|---|
| 144 | * you will get a response with partial result. Otherwise, your query's
|
|---|
| 145 | * execution will continue until the RPC deadline. If it's not finished until
|
|---|
| 146 | * then, you will get a DEADLINE_EXCEEDED error. Default is empty.
|
|---|
| 147 | * @opt_param string savedAnalysisQuery Optional. The name of a saved query,
|
|---|
| 148 | * which must be in the format of: *
|
|---|
| 149 | * projects/project_number/savedQueries/saved_query_id *
|
|---|
| 150 | * folders/folder_number/savedQueries/saved_query_id *
|
|---|
| 151 | * organizations/organization_number/savedQueries/saved_query_id If both
|
|---|
| 152 | * `analysis_query` and `saved_analysis_query` are provided, they will be merged
|
|---|
| 153 | * together with the `saved_analysis_query` as base and the `analysis_query` as
|
|---|
| 154 | * overrides. For more details of the merge behavior, refer to the
|
|---|
| 155 | * [MergeFrom](https://developers.google.com/protocol-
|
|---|
| 156 | * buffers/docs/reference/cpp/google.protobuf.message#Message.MergeFrom.details)
|
|---|
| 157 | * page. Note that you cannot override primitive fields with default value, such
|
|---|
| 158 | * as 0 or empty string, etc., because we use proto3, which doesn't support
|
|---|
| 159 | * field presence yet.
|
|---|
| 160 | * @return AnalyzeIamPolicyResponse
|
|---|
| 161 | * @throws \Google\Service\Exception
|
|---|
| 162 | */
|
|---|
| 163 | public function analyzeIamPolicy($scope, $optParams = [])
|
|---|
| 164 | {
|
|---|
| 165 | $params = ['scope' => $scope];
|
|---|
| 166 | $params = array_merge($params, $optParams);
|
|---|
| 167 | return $this->call('analyzeIamPolicy', [$params], AnalyzeIamPolicyResponse::class);
|
|---|
| 168 | }
|
|---|
| 169 | /**
|
|---|
| 170 | * Analyzes IAM policies asynchronously to answer which identities have what
|
|---|
| 171 | * accesses on which resources, and writes the analysis results to a Google
|
|---|
| 172 | * Cloud Storage or a BigQuery destination. For Cloud Storage destination, the
|
|---|
| 173 | * output format is the JSON format that represents a AnalyzeIamPolicyResponse.
|
|---|
| 174 | * This method implements the google.longrunning.Operation, which allows you to
|
|---|
| 175 | * track the operation status. We recommend intervals of at least 2 seconds with
|
|---|
| 176 | * exponential backoff retry to poll the operation result. The metadata contains
|
|---|
| 177 | * the metadata for the long-running operation. (v1.analyzeIamPolicyLongrunning)
|
|---|
| 178 | *
|
|---|
| 179 | * @param string $scope Required. The relative name of the root asset. Only
|
|---|
| 180 | * resources and IAM policies within the scope will be analyzed. This can only
|
|---|
| 181 | * be an organization number (such as "organizations/123"), a folder number
|
|---|
| 182 | * (such as "folders/123"), a project ID (such as "projects/my-project-id"), or
|
|---|
| 183 | * a project number (such as "projects/12345"). To know how to get organization
|
|---|
| 184 | * ID, visit [here ](https://cloud.google.com/resource-manager/docs/creating-
|
|---|
| 185 | * managing-organization#retrieving_your_organization_id). To know how to get
|
|---|
| 186 | * folder or project ID, visit [here ](https://cloud.google.com/resource-
|
|---|
| 187 | * manager/docs/creating-managing-
|
|---|
| 188 | * folders#viewing_or_listing_folders_and_projects).
|
|---|
| 189 | * @param AnalyzeIamPolicyLongrunningRequest $postBody
|
|---|
| 190 | * @param array $optParams Optional parameters.
|
|---|
| 191 | * @return Operation
|
|---|
| 192 | * @throws \Google\Service\Exception
|
|---|
| 193 | */
|
|---|
| 194 | public function analyzeIamPolicyLongrunning($scope, AnalyzeIamPolicyLongrunningRequest $postBody, $optParams = [])
|
|---|
| 195 | {
|
|---|
| 196 | $params = ['scope' => $scope, 'postBody' => $postBody];
|
|---|
| 197 | $params = array_merge($params, $optParams);
|
|---|
| 198 | return $this->call('analyzeIamPolicyLongrunning', [$params], Operation::class);
|
|---|
| 199 | }
|
|---|
| 200 | /**
|
|---|
| 201 | * Analyze moving a resource to a specified destination without kicking off the
|
|---|
| 202 | * actual move. The analysis is best effort depending on the user's permissions
|
|---|
| 203 | * of viewing different hierarchical policies and configurations. The policies
|
|---|
| 204 | * and configuration are subject to change before the actual resource migration
|
|---|
| 205 | * takes place. (v1.analyzeMove)
|
|---|
| 206 | *
|
|---|
| 207 | * @param string $resource Required. Name of the resource to perform the
|
|---|
| 208 | * analysis against. Only Google Cloud projects are supported as of today.
|
|---|
| 209 | * Hence, this can only be a project ID (such as "projects/my-project-id") or a
|
|---|
| 210 | * project number (such as "projects/12345").
|
|---|
| 211 | * @param array $optParams Optional parameters.
|
|---|
| 212 | *
|
|---|
| 213 | * @opt_param string destinationParent Required. Name of the Google Cloud folder
|
|---|
| 214 | * or organization to reparent the target resource. The analysis will be
|
|---|
| 215 | * performed against hypothetically moving the resource to this specified
|
|---|
| 216 | * desitination parent. This can only be a folder number (such as "folders/123")
|
|---|
| 217 | * or an organization number (such as "organizations/123").
|
|---|
| 218 | * @opt_param string view Analysis view indicating what information should be
|
|---|
| 219 | * included in the analysis response. If unspecified, the default view is FULL.
|
|---|
| 220 | * @return AnalyzeMoveResponse
|
|---|
| 221 | * @throws \Google\Service\Exception
|
|---|
| 222 | */
|
|---|
| 223 | public function analyzeMove($resource, $optParams = [])
|
|---|
| 224 | {
|
|---|
| 225 | $params = ['resource' => $resource];
|
|---|
| 226 | $params = array_merge($params, $optParams);
|
|---|
| 227 | return $this->call('analyzeMove', [$params], AnalyzeMoveResponse::class);
|
|---|
| 228 | }
|
|---|
| 229 | /**
|
|---|
| 230 | * Analyzes organization policies under a scope. (v1.analyzeOrgPolicies)
|
|---|
| 231 | *
|
|---|
| 232 | * @param string $scope Required. The organization to scope the request. Only
|
|---|
| 233 | * organization policies within the scope will be analyzed. *
|
|---|
| 234 | * organizations/{ORGANIZATION_NUMBER} (e.g., "organizations/123456")
|
|---|
| 235 | * @param array $optParams Optional parameters.
|
|---|
| 236 | *
|
|---|
| 237 | * @opt_param string constraint Required. The name of the constraint to analyze
|
|---|
| 238 | * organization policies for. The response only contains analyzed organization
|
|---|
| 239 | * policies for the provided constraint.
|
|---|
| 240 | * @opt_param string filter The expression to filter
|
|---|
| 241 | * AnalyzeOrgPoliciesResponse.org_policy_results. Filtering is currently
|
|---|
| 242 | * available for bare literal values and the following fields: *
|
|---|
| 243 | * consolidated_policy.attached_resource * consolidated_policy.rules.enforce
|
|---|
| 244 | * When filtering by a specific field, the only supported operator is `=`. For
|
|---|
| 245 | * example, filtering by consolidated_policy.attached_resource="//cloudresourcem
|
|---|
| 246 | * anager.googleapis.com/folders/001" will return all the Organization Policy
|
|---|
| 247 | * results attached to "folders/001".
|
|---|
| 248 | * @opt_param int pageSize The maximum number of items to return per page. If
|
|---|
| 249 | * unspecified, AnalyzeOrgPoliciesResponse.org_policy_results will contain 20
|
|---|
| 250 | * items with a maximum of 200.
|
|---|
| 251 | * @opt_param string pageToken The pagination token to retrieve the next page.
|
|---|
| 252 | * @return AnalyzeOrgPoliciesResponse
|
|---|
| 253 | * @throws \Google\Service\Exception
|
|---|
| 254 | */
|
|---|
| 255 | public function analyzeOrgPolicies($scope, $optParams = [])
|
|---|
| 256 | {
|
|---|
| 257 | $params = ['scope' => $scope];
|
|---|
| 258 | $params = array_merge($params, $optParams);
|
|---|
| 259 | return $this->call('analyzeOrgPolicies', [$params], AnalyzeOrgPoliciesResponse::class);
|
|---|
| 260 | }
|
|---|
| 261 | /**
|
|---|
| 262 | * Analyzes organization policies governed assets (Google Cloud resources or
|
|---|
| 263 | * policies) under a scope. This RPC supports custom constraints and the
|
|---|
| 264 | * following canned constraints: * constraints/ainotebooks.accessMode *
|
|---|
| 265 | * constraints/ainotebooks.disableFileDownloads *
|
|---|
| 266 | * constraints/ainotebooks.disableRootAccess *
|
|---|
| 267 | * constraints/ainotebooks.disableTerminal *
|
|---|
| 268 | * constraints/ainotebooks.environmentOptions *
|
|---|
| 269 | * constraints/ainotebooks.requireAutoUpgradeSchedule *
|
|---|
| 270 | * constraints/ainotebooks.restrictVpcNetworks *
|
|---|
| 271 | * constraints/compute.disableGuestAttributesAccess *
|
|---|
| 272 | * constraints/compute.disableInstanceDataAccessApis *
|
|---|
| 273 | * constraints/compute.disableNestedVirtualization *
|
|---|
| 274 | * constraints/compute.disableSerialPortAccess *
|
|---|
| 275 | * constraints/compute.disableSerialPortLogging *
|
|---|
| 276 | * constraints/compute.disableVpcExternalIpv6 *
|
|---|
| 277 | * constraints/compute.requireOsLogin * constraints/compute.requireShieldedVm *
|
|---|
| 278 | * constraints/compute.restrictLoadBalancerCreationForTypes *
|
|---|
| 279 | * constraints/compute.restrictProtocolForwardingCreationForTypes *
|
|---|
| 280 | * constraints/compute.restrictXpnProjectLienRemoval *
|
|---|
| 281 | * constraints/compute.setNewProjectDefaultToZonalDNSOnly *
|
|---|
| 282 | * constraints/compute.skipDefaultNetworkCreation *
|
|---|
| 283 | * constraints/compute.trustedImageProjects * constraints/compute.vmCanIpForward
|
|---|
| 284 | * * constraints/compute.vmExternalIpAccess *
|
|---|
| 285 | * constraints/gcp.detailedAuditLoggingMode * constraints/gcp.resourceLocations
|
|---|
| 286 | * * constraints/iam.allowedPolicyMemberDomains *
|
|---|
| 287 | * constraints/iam.automaticIamGrantsForDefaultServiceAccounts *
|
|---|
| 288 | * constraints/iam.disableServiceAccountCreation *
|
|---|
| 289 | * constraints/iam.disableServiceAccountKeyCreation *
|
|---|
| 290 | * constraints/iam.disableServiceAccountKeyUpload *
|
|---|
| 291 | * constraints/iam.restrictCrossProjectServiceAccountLienRemoval *
|
|---|
| 292 | * constraints/iam.serviceAccountKeyExpiryHours *
|
|---|
| 293 | * constraints/resourcemanager.accessBoundaries *
|
|---|
| 294 | * constraints/resourcemanager.allowedExportDestinations *
|
|---|
| 295 | * constraints/sql.restrictAuthorizedNetworks *
|
|---|
| 296 | * constraints/sql.restrictNoncompliantDiagnosticDataAccess *
|
|---|
| 297 | * constraints/sql.restrictNoncompliantResourceCreation *
|
|---|
| 298 | * constraints/sql.restrictPublicIp * constraints/storage.publicAccessPrevention
|
|---|
| 299 | * * constraints/storage.restrictAuthTypes *
|
|---|
| 300 | * constraints/storage.uniformBucketLevelAccess This RPC only returns either
|
|---|
| 301 | * resources of types [supported by search APIs](https://cloud.google.com/asset-
|
|---|
| 302 | * inventory/docs/supported-asset-types) or IAM policies.
|
|---|
| 303 | * (v1.analyzeOrgPolicyGovernedAssets)
|
|---|
| 304 | *
|
|---|
| 305 | * @param string $scope Required. The organization to scope the request. Only
|
|---|
| 306 | * organization policies within the scope will be analyzed. The output assets
|
|---|
| 307 | * will also be limited to the ones governed by those in-scope organization
|
|---|
| 308 | * policies. * organizations/{ORGANIZATION_NUMBER} (e.g.,
|
|---|
| 309 | * "organizations/123456")
|
|---|
| 310 | * @param array $optParams Optional parameters.
|
|---|
| 311 | *
|
|---|
| 312 | * @opt_param string constraint Required. The name of the constraint to analyze
|
|---|
| 313 | * governed assets for. The analysis only contains analyzed organization
|
|---|
| 314 | * policies for the provided constraint.
|
|---|
| 315 | * @opt_param string filter The expression to filter
|
|---|
| 316 | * AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets. For governed
|
|---|
| 317 | * resources, filtering is currently available for bare literal values and the
|
|---|
| 318 | * following fields: * governed_resource.project * governed_resource.folders *
|
|---|
| 319 | * consolidated_policy.rules.enforce When filtering by
|
|---|
| 320 | * `governed_resource.project` or `consolidated_policy.rules.enforce`, the only
|
|---|
| 321 | * supported operator is `=`. When filtering by `governed_resource.folders`, the
|
|---|
| 322 | * supported operators are `=` and `:`. For example, filtering by
|
|---|
| 323 | * `governed_resource.project="projects/12345678"` will return all the governed
|
|---|
| 324 | * resources under "projects/12345678", including the project itself if
|
|---|
| 325 | * applicable. For governed IAM policies, filtering is currently available for
|
|---|
| 326 | * bare literal values and the following fields: * governed_iam_policy.project *
|
|---|
| 327 | * governed_iam_policy.folders * consolidated_policy.rules.enforce When
|
|---|
| 328 | * filtering by `governed_iam_policy.project` or
|
|---|
| 329 | * `consolidated_policy.rules.enforce`, the only supported operator is `=`. When
|
|---|
| 330 | * filtering by `governed_iam_policy.folders`, the supported operators are `=`
|
|---|
| 331 | * and `:`. For example, filtering by
|
|---|
| 332 | * `governed_iam_policy.folders:"folders/12345678"` will return all the governed
|
|---|
| 333 | * IAM policies under "folders/001".
|
|---|
| 334 | * @opt_param int pageSize The maximum number of items to return per page. If
|
|---|
| 335 | * unspecified, AnalyzeOrgPolicyGovernedAssetsResponse.governed_assets will
|
|---|
| 336 | * contain 100 items with a maximum of 200.
|
|---|
| 337 | * @opt_param string pageToken The pagination token to retrieve the next page.
|
|---|
| 338 | * @return AnalyzeOrgPolicyGovernedAssetsResponse
|
|---|
| 339 | * @throws \Google\Service\Exception
|
|---|
| 340 | */
|
|---|
| 341 | public function analyzeOrgPolicyGovernedAssets($scope, $optParams = [])
|
|---|
| 342 | {
|
|---|
| 343 | $params = ['scope' => $scope];
|
|---|
| 344 | $params = array_merge($params, $optParams);
|
|---|
| 345 | return $this->call('analyzeOrgPolicyGovernedAssets', [$params], AnalyzeOrgPolicyGovernedAssetsResponse::class);
|
|---|
| 346 | }
|
|---|
| 347 | /**
|
|---|
| 348 | * Analyzes organization policies governed containers (projects, folders or
|
|---|
| 349 | * organization) under a scope. (v1.analyzeOrgPolicyGovernedContainers)
|
|---|
| 350 | *
|
|---|
| 351 | * @param string $scope Required. The organization to scope the request. Only
|
|---|
| 352 | * organization policies within the scope will be analyzed. The output
|
|---|
| 353 | * containers will also be limited to the ones governed by those in-scope
|
|---|
| 354 | * organization policies. * organizations/{ORGANIZATION_NUMBER} (e.g.,
|
|---|
| 355 | * "organizations/123456")
|
|---|
| 356 | * @param array $optParams Optional parameters.
|
|---|
| 357 | *
|
|---|
| 358 | * @opt_param string constraint Required. The name of the constraint to analyze
|
|---|
| 359 | * governed containers for. The analysis only contains organization policies for
|
|---|
| 360 | * the provided constraint.
|
|---|
| 361 | * @opt_param string filter The expression to filter
|
|---|
| 362 | * AnalyzeOrgPolicyGovernedContainersResponse.governed_containers. Filtering is
|
|---|
| 363 | * currently available for bare literal values and the following fields: *
|
|---|
| 364 | * parent * consolidated_policy.rules.enforce When filtering by a specific
|
|---|
| 365 | * field, the only supported operator is `=`. For example, filtering by
|
|---|
| 366 | * parent="//cloudresourcemanager.googleapis.com/folders/001" will return all
|
|---|
| 367 | * the containers under "folders/001".
|
|---|
| 368 | * @opt_param int pageSize The maximum number of items to return per page. If
|
|---|
| 369 | * unspecified, AnalyzeOrgPolicyGovernedContainersResponse.governed_containers
|
|---|
| 370 | * will contain 100 items with a maximum of 200.
|
|---|
| 371 | * @opt_param string pageToken The pagination token to retrieve the next page.
|
|---|
| 372 | * @return AnalyzeOrgPolicyGovernedContainersResponse
|
|---|
| 373 | * @throws \Google\Service\Exception
|
|---|
| 374 | */
|
|---|
| 375 | public function analyzeOrgPolicyGovernedContainers($scope, $optParams = [])
|
|---|
| 376 | {
|
|---|
| 377 | $params = ['scope' => $scope];
|
|---|
| 378 | $params = array_merge($params, $optParams);
|
|---|
| 379 | return $this->call('analyzeOrgPolicyGovernedContainers', [$params], AnalyzeOrgPolicyGovernedContainersResponse::class);
|
|---|
| 380 | }
|
|---|
| 381 | /**
|
|---|
| 382 | * Batch gets the update history of assets that overlap a time window. For
|
|---|
| 383 | * IAM_POLICY content, this API outputs history when the asset and its attached
|
|---|
| 384 | * IAM POLICY both exist. This can create gaps in the output history. Otherwise,
|
|---|
| 385 | * this API outputs history with asset in both non-delete or deleted status. If
|
|---|
| 386 | * a specified asset does not exist, this API returns an INVALID_ARGUMENT error.
|
|---|
| 387 | * (v1.batchGetAssetsHistory)
|
|---|
| 388 | *
|
|---|
| 389 | * @param string $parent Required. The relative name of the root asset. It can
|
|---|
| 390 | * only be an organization number (such as "organizations/123"), a project ID
|
|---|
| 391 | * (such as "projects/my-project-id")", or a project number (such as
|
|---|
| 392 | * "projects/12345").
|
|---|
| 393 | * @param array $optParams Optional parameters.
|
|---|
| 394 | *
|
|---|
| 395 | * @opt_param string assetNames A list of the full names of the assets. See:
|
|---|
| 396 | * https://cloud.google.com/asset-inventory/docs/resource-name-format Example: `
|
|---|
| 397 | * //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instan
|
|---|
| 398 | * ce1`. The request becomes a no-op if the asset name list is empty, and the
|
|---|
| 399 | * max size of the asset name list is 100 in one request.
|
|---|
| 400 | * @opt_param string contentType Optional. The content type.
|
|---|
| 401 | * @opt_param string readTimeWindow.endTime End time of the time window
|
|---|
| 402 | * (inclusive). If not specified, the current timestamp is used instead.
|
|---|
| 403 | * @opt_param string readTimeWindow.startTime Start time of the time window
|
|---|
| 404 | * (exclusive).
|
|---|
| 405 | * @opt_param string relationshipTypes Optional. A list of relationship types to
|
|---|
| 406 | * output, for example: `INSTANCE_TO_INSTANCEGROUP`. This field should only be
|
|---|
| 407 | * specified if content_type=RELATIONSHIP. * If specified: it outputs specified
|
|---|
| 408 | * relationships' history on the [asset_names]. It returns an error if any of
|
|---|
| 409 | * the [relationship_types] doesn't belong to the supported relationship types
|
|---|
| 410 | * of the [asset_names] or if any of the [asset_names]'s types doesn't belong to
|
|---|
| 411 | * the source types of the [relationship_types]. * Otherwise: it outputs the
|
|---|
| 412 | * supported relationships' history on the [asset_names] or returns an error if
|
|---|
| 413 | * any of the [asset_names]'s types has no relationship support. See
|
|---|
| 414 | * [Introduction to Cloud Asset Inventory](https://cloud.google.com/asset-
|
|---|
| 415 | * inventory/docs/overview) for all supported asset types and relationship
|
|---|
| 416 | * types.
|
|---|
| 417 | * @return BatchGetAssetsHistoryResponse
|
|---|
| 418 | * @throws \Google\Service\Exception
|
|---|
| 419 | */
|
|---|
| 420 | public function batchGetAssetsHistory($parent, $optParams = [])
|
|---|
| 421 | {
|
|---|
| 422 | $params = ['parent' => $parent];
|
|---|
| 423 | $params = array_merge($params, $optParams);
|
|---|
| 424 | return $this->call('batchGetAssetsHistory', [$params], BatchGetAssetsHistoryResponse::class);
|
|---|
| 425 | }
|
|---|
| 426 | /**
|
|---|
| 427 | * Exports assets with time and resource types to a given Cloud Storage
|
|---|
| 428 | * location/BigQuery table. For Cloud Storage location destinations, the output
|
|---|
| 429 | * format is newline-delimited JSON. Each line represents a
|
|---|
| 430 | * google.cloud.asset.v1.Asset in the JSON format; for BigQuery table
|
|---|
| 431 | * destinations, the output table stores the fields in asset Protobuf as
|
|---|
| 432 | * columns. This API implements the google.longrunning.Operation API, which
|
|---|
| 433 | * allows you to keep track of the export. We recommend intervals of at least 2
|
|---|
| 434 | * seconds with exponential retry to poll the export operation result. For
|
|---|
| 435 | * regular-size resource parent, the export operation usually finishes within 5
|
|---|
| 436 | * minutes. (v1.exportAssets)
|
|---|
| 437 | *
|
|---|
| 438 | * @param string $parent Required. The relative name of the root asset. This can
|
|---|
| 439 | * only be an organization number (such as "organizations/123"), a project ID
|
|---|
| 440 | * (such as "projects/my-project-id"), or a project number (such as
|
|---|
| 441 | * "projects/12345"), or a folder number (such as "folders/123").
|
|---|
| 442 | * @param ExportAssetsRequest $postBody
|
|---|
| 443 | * @param array $optParams Optional parameters.
|
|---|
| 444 | * @return Operation
|
|---|
| 445 | * @throws \Google\Service\Exception
|
|---|
| 446 | */
|
|---|
| 447 | public function exportAssets($parent, ExportAssetsRequest $postBody, $optParams = [])
|
|---|
| 448 | {
|
|---|
| 449 | $params = ['parent' => $parent, 'postBody' => $postBody];
|
|---|
| 450 | $params = array_merge($params, $optParams);
|
|---|
| 451 | return $this->call('exportAssets', [$params], Operation::class);
|
|---|
| 452 | }
|
|---|
| 453 | /**
|
|---|
| 454 | * Issue a job that queries assets using a SQL statement compatible with
|
|---|
| 455 | * [BigQuery SQL](https://cloud.google.com/bigquery/docs/introduction-sql). If
|
|---|
| 456 | * the query execution finishes within timeout and there's no pagination, the
|
|---|
| 457 | * full query results will be returned in the `QueryAssetsResponse`. Otherwise,
|
|---|
| 458 | * full query results can be obtained by issuing extra requests with the
|
|---|
| 459 | * `job_reference` from the a previous `QueryAssets` call. Note, the query
|
|---|
| 460 | * result has approximately 10 GB limitation enforced by
|
|---|
| 461 | * [BigQuery](https://cloud.google.com/bigquery/docs/best-practices-performance-
|
|---|
| 462 | * output). Queries return larger results will result in errors.
|
|---|
| 463 | * (v1.queryAssets)
|
|---|
| 464 | *
|
|---|
| 465 | * @param string $parent Required. The relative name of the root asset. This can
|
|---|
| 466 | * only be an organization number (such as "organizations/123"), a project ID
|
|---|
| 467 | * (such as "projects/my-project-id"), or a project number (such as
|
|---|
| 468 | * "projects/12345"), or a folder number (such as "folders/123"). Only assets
|
|---|
| 469 | * belonging to the `parent` will be returned.
|
|---|
| 470 | * @param QueryAssetsRequest $postBody
|
|---|
| 471 | * @param array $optParams Optional parameters.
|
|---|
| 472 | * @return QueryAssetsResponse
|
|---|
| 473 | * @throws \Google\Service\Exception
|
|---|
| 474 | */
|
|---|
| 475 | public function queryAssets($parent, QueryAssetsRequest $postBody, $optParams = [])
|
|---|
| 476 | {
|
|---|
| 477 | $params = ['parent' => $parent, 'postBody' => $postBody];
|
|---|
| 478 | $params = array_merge($params, $optParams);
|
|---|
| 479 | return $this->call('queryAssets', [$params], QueryAssetsResponse::class);
|
|---|
| 480 | }
|
|---|
| 481 | /**
|
|---|
| 482 | * Searches all IAM policies within the specified scope, such as a project,
|
|---|
| 483 | * folder, or organization. The caller must be granted the
|
|---|
| 484 | * `cloudasset.assets.searchAllIamPolicies` permission on the desired scope,
|
|---|
| 485 | * otherwise the request will be rejected. (v1.searchAllIamPolicies)
|
|---|
| 486 | *
|
|---|
| 487 | * @param string $scope Required. A scope can be a project, a folder, or an
|
|---|
| 488 | * organization. The search is limited to the IAM policies within the `scope`.
|
|---|
| 489 | * The caller must be granted the
|
|---|
| 490 | * [`cloudasset.assets.searchAllIamPolicies`](https://cloud.google.com/asset-
|
|---|
| 491 | * inventory/docs/access-control#required_permissions) permission on the desired
|
|---|
| 492 | * scope. The allowed values are: * projects/{PROJECT_ID} (e.g., "projects/foo-
|
|---|
| 493 | * bar") * projects/{PROJECT_NUMBER} (e.g., "projects/12345678") *
|
|---|
| 494 | * folders/{FOLDER_NUMBER} (e.g., "folders/1234567") *
|
|---|
| 495 | * organizations/{ORGANIZATION_NUMBER} (e.g., "organizations/123456")
|
|---|
| 496 | * @param array $optParams Optional parameters.
|
|---|
| 497 | *
|
|---|
| 498 | * @opt_param string assetTypes Optional. A list of asset types that the IAM
|
|---|
| 499 | * policies are attached to. If empty, it will search the IAM policies that are
|
|---|
| 500 | * attached to all the asset types [supported by search
|
|---|
| 501 | * APIs](https://cloud.google.com/asset-inventory/docs/supported-asset-types)
|
|---|
| 502 | * Regular expressions are also supported. For example: *
|
|---|
| 503 | * "compute.googleapis.com.*" snapshots IAM policies attached to asset type
|
|---|
| 504 | * starts with "compute.googleapis.com". * ".*Instance" snapshots IAM policies
|
|---|
| 505 | * attached to asset type ends with "Instance". * ".*Instance.*" snapshots IAM
|
|---|
| 506 | * policies attached to asset type contains "Instance". See
|
|---|
| 507 | * [RE2](https://github.com/google/re2/wiki/Syntax) for all supported regular
|
|---|
| 508 | * expression syntax. If the regular expression does not match any supported
|
|---|
| 509 | * asset type, an INVALID_ARGUMENT error will be returned.
|
|---|
| 510 | * @opt_param string orderBy Optional. A comma-separated list of fields
|
|---|
| 511 | * specifying the sorting order of the results. The default order is ascending.
|
|---|
| 512 | * Add " DESC" after the field name to indicate descending order. Redundant
|
|---|
| 513 | * space characters are ignored. Example: "assetType DESC, resource". Only
|
|---|
| 514 | * singular primitive fields in the response are sortable: * resource *
|
|---|
| 515 | * assetType * project All the other fields such as repeated fields (e.g.,
|
|---|
| 516 | * `folders`) and non-primitive fields (e.g., `policy`) are not supported.
|
|---|
| 517 | * @opt_param int pageSize Optional. The page size for search result pagination.
|
|---|
| 518 | * Page size is capped at 500 even if a larger value is given. If set to zero or
|
|---|
| 519 | * a negative value, server will pick an appropriate default. Returned results
|
|---|
| 520 | * may be fewer than requested. When this happens, there could be more results
|
|---|
| 521 | * as long as `next_page_token` is returned.
|
|---|
| 522 | * @opt_param string pageToken Optional. If present, retrieve the next batch of
|
|---|
| 523 | * results from the preceding call to this method. `page_token` must be the
|
|---|
| 524 | * value of `next_page_token` from the previous response. The values of all
|
|---|
| 525 | * other method parameters must be identical to those in the previous call.
|
|---|
| 526 | * @opt_param string query Optional. The query statement. See [how to construct
|
|---|
| 527 | * a query](https://cloud.google.com/asset-inventory/docs/searching-iam-
|
|---|
| 528 | * policies#how_to_construct_a_query) for more information. If not specified or
|
|---|
| 529 | * empty, it will search all the IAM policies within the specified `scope`. Note
|
|---|
| 530 | * that the query string is compared against each IAM policy binding, including
|
|---|
| 531 | * its principals, roles, and IAM conditions. The returned IAM policies will
|
|---|
| 532 | * only contain the bindings that match your query. To learn more about the IAM
|
|---|
| 533 | * policy structure, see the [IAM policy
|
|---|
| 534 | * documentation](https://cloud.google.com/iam/help/allow-policies/structure).
|
|---|
| 535 | * Examples: * `policy:amy@gmail.com` to find IAM policy bindings that specify
|
|---|
| 536 | * user "amy@gmail.com". * `policy:roles/compute.admin` to find IAM policy
|
|---|
| 537 | * bindings that specify the Compute Admin role. * `policy:comp*` to find IAM
|
|---|
| 538 | * policy bindings that contain "comp" as a prefix of any word in the binding. *
|
|---|
| 539 | * `policy.role.permissions:storage.buckets.update` to find IAM policy bindings
|
|---|
| 540 | * that specify a role containing "storage.buckets.update" permission. Note that
|
|---|
| 541 | * if callers don't have `iam.roles.get` access to a role's included
|
|---|
| 542 | * permissions, policy bindings that specify this role will be dropped from the
|
|---|
| 543 | * search results. * `policy.role.permissions:upd*` to find IAM policy bindings
|
|---|
| 544 | * that specify a role containing "upd" as a prefix of any word in the role
|
|---|
| 545 | * permission. Note that if callers don't have `iam.roles.get` access to a
|
|---|
| 546 | * role's included permissions, policy bindings that specify this role will be
|
|---|
| 547 | * dropped from the search results. * `resource:organizations/123456` to find
|
|---|
| 548 | * IAM policy bindings that are set on "organizations/123456". *
|
|---|
| 549 | * `resource=//cloudresourcemanager.googleapis.com/projects/myproject` to find
|
|---|
| 550 | * IAM policy bindings that are set on the project named "myproject". *
|
|---|
| 551 | * `Important` to find IAM policy bindings that contain "Important" as a word in
|
|---|
| 552 | * any of the searchable fields (except for the included permissions). *
|
|---|
| 553 | * `resource:(instance1 OR instance2) policy:amy` to find IAM policy bindings
|
|---|
| 554 | * that are set on resources "instance1" or "instance2" and also specify user
|
|---|
| 555 | * "amy". * `roles:roles/compute.admin` to find IAM policy bindings that specify
|
|---|
| 556 | * the Compute Admin role. * `memberTypes:user` to find IAM policy bindings that
|
|---|
| 557 | * contain the principal type "user".
|
|---|
| 558 | * @return SearchAllIamPoliciesResponse
|
|---|
| 559 | * @throws \Google\Service\Exception
|
|---|
| 560 | */
|
|---|
| 561 | public function searchAllIamPolicies($scope, $optParams = [])
|
|---|
| 562 | {
|
|---|
| 563 | $params = ['scope' => $scope];
|
|---|
| 564 | $params = array_merge($params, $optParams);
|
|---|
| 565 | return $this->call('searchAllIamPolicies', [$params], SearchAllIamPoliciesResponse::class);
|
|---|
| 566 | }
|
|---|
| 567 | /**
|
|---|
| 568 | * Searches all Google Cloud resources within the specified scope, such as a
|
|---|
| 569 | * project, folder, or organization. The caller must be granted the
|
|---|
| 570 | * `cloudasset.assets.searchAllResources` permission on the desired scope,
|
|---|
| 571 | * otherwise the request will be rejected. (v1.searchAllResources)
|
|---|
| 572 | *
|
|---|
| 573 | * @param string $scope Required. A scope can be a project, a folder, or an
|
|---|
| 574 | * organization. The search is limited to the resources within the `scope`. The
|
|---|
| 575 | * caller must be granted the
|
|---|
| 576 | * [`cloudasset.assets.searchAllResources`](https://cloud.google.com/asset-
|
|---|
| 577 | * inventory/docs/access-control#required_permissions) permission on the desired
|
|---|
| 578 | * scope. The allowed values are: * projects/{PROJECT_ID} (e.g., "projects/foo-
|
|---|
| 579 | * bar") * projects/{PROJECT_NUMBER} (e.g., "projects/12345678") *
|
|---|
| 580 | * folders/{FOLDER_NUMBER} (e.g., "folders/1234567") *
|
|---|
| 581 | * organizations/{ORGANIZATION_NUMBER} (e.g., "organizations/123456")
|
|---|
| 582 | * @param array $optParams Optional parameters.
|
|---|
| 583 | *
|
|---|
| 584 | * @opt_param string assetTypes Optional. A list of asset types that this
|
|---|
| 585 | * request searches for. If empty, it will search all the asset types [supported
|
|---|
| 586 | * by search APIs](https://cloud.google.com/asset-inventory/docs/supported-
|
|---|
| 587 | * asset-types). Regular expressions are also supported. For example: *
|
|---|
| 588 | * "compute.googleapis.com.*" snapshots resources whose asset type starts with
|
|---|
| 589 | * "compute.googleapis.com". * ".*Instance" snapshots resources whose asset type
|
|---|
| 590 | * ends with "Instance". * ".*Instance.*" snapshots resources whose asset type
|
|---|
| 591 | * contains "Instance". See [RE2](https://github.com/google/re2/wiki/Syntax) for
|
|---|
| 592 | * all supported regular expression syntax. If the regular expression does not
|
|---|
| 593 | * match any supported asset type, an INVALID_ARGUMENT error will be returned.
|
|---|
| 594 | * @opt_param string orderBy Optional. A comma-separated list of fields
|
|---|
| 595 | * specifying the sorting order of the results. The default order is ascending.
|
|---|
| 596 | * Add " DESC" after the field name to indicate descending order. Redundant
|
|---|
| 597 | * space characters are ignored. Example: "location DESC, name". Only the
|
|---|
| 598 | * following fields in the response are sortable: * name * assetType * project *
|
|---|
| 599 | * displayName * description * location * createTime * updateTime * state *
|
|---|
| 600 | * parentFullResourceName * parentAssetType
|
|---|
| 601 | * @opt_param int pageSize Optional. The page size for search result pagination.
|
|---|
| 602 | * Page size is capped at 500 even if a larger value is given. If set to zero or
|
|---|
| 603 | * a negative value, server will pick an appropriate default. Returned results
|
|---|
| 604 | * may be fewer than requested. When this happens, there could be more results
|
|---|
| 605 | * as long as `next_page_token` is returned.
|
|---|
| 606 | * @opt_param string pageToken Optional. If present, then retrieve the next
|
|---|
| 607 | * batch of results from the preceding call to this method. `page_token` must be
|
|---|
| 608 | * the value of `next_page_token` from the previous response. The values of all
|
|---|
| 609 | * other method parameters, must be identical to those in the previous call.
|
|---|
| 610 | * @opt_param string query Optional. The query statement. See [how to construct
|
|---|
| 611 | * a query](https://cloud.google.com/asset-inventory/docs/searching-
|
|---|
| 612 | * resources#how_to_construct_a_query) for more information. If not specified or
|
|---|
| 613 | * empty, it will search all the resources within the specified `scope`.
|
|---|
| 614 | * Examples: * `name:Important` to find Google Cloud resources whose name
|
|---|
| 615 | * contains `Important` as a word. * `name=Important` to find the Google Cloud
|
|---|
| 616 | * resource whose name is exactly `Important`. * `displayName:Impor*` to find
|
|---|
| 617 | * Google Cloud resources whose display name contains `Impor` as a prefix of any
|
|---|
| 618 | * word in the field. * `location:us-west*` to find Google Cloud resources whose
|
|---|
| 619 | * location contains both `us` and `west` as prefixes. * `labels:prod` to find
|
|---|
| 620 | * Google Cloud resources whose labels contain `prod` as a key or value. *
|
|---|
| 621 | * `labels.env:prod` to find Google Cloud resources that have a label `env` and
|
|---|
| 622 | * its value is `prod`. * `labels.env:*` to find Google Cloud resources that
|
|---|
| 623 | * have a label `env`. * `tagKeys:env` to find Google Cloud resources that have
|
|---|
| 624 | * directly attached tags where the
|
|---|
| 625 | * [`TagKey.namespacedName`](https://cloud.google.com/resource-
|
|---|
| 626 | * manager/reference/rest/v3/tagKeys#resource:-tagkey) contains `env`. *
|
|---|
| 627 | * `tagValues:prod*` to find Google Cloud resources that have directly attached
|
|---|
| 628 | * tags where the [`TagValue.namespacedName`](https://cloud.google.com/resource-
|
|---|
| 629 | * manager/reference/rest/v3/tagValues#resource:-tagvalue) contains a word
|
|---|
| 630 | * prefixed by `prod`. * `tagValueIds=tagValues/123` to find Google Cloud
|
|---|
| 631 | * resources that have directly attached tags where the
|
|---|
| 632 | * [`TagValue.name`](https://cloud.google.com/resource-
|
|---|
| 633 | * manager/reference/rest/v3/tagValues#resource:-tagvalue) is exactly
|
|---|
| 634 | * `tagValues/123`. * `effectiveTagKeys:env` to find Google Cloud resources that
|
|---|
| 635 | * have directly attached or inherited tags where the
|
|---|
| 636 | * [`TagKey.namespacedName`](https://cloud.google.com/resource-
|
|---|
| 637 | * manager/reference/rest/v3/tagKeys#resource:-tagkey) contains `env`. *
|
|---|
| 638 | * `effectiveTagValues:prod*` to find Google Cloud resources that have directly
|
|---|
| 639 | * attached or inherited tags where the
|
|---|
| 640 | * [`TagValue.namespacedName`](https://cloud.google.com/resource-
|
|---|
| 641 | * manager/reference/rest/v3/tagValues#resource:-tagvalue) contains a word
|
|---|
| 642 | * prefixed by `prod`. * `effectiveTagValueIds=tagValues/123` to find Google
|
|---|
| 643 | * Cloud resources that have directly attached or inherited tags where the
|
|---|
| 644 | * [`TagValue.name`](https://cloud.google.com/resource-
|
|---|
| 645 | * manager/reference/rest/v3/tagValues#resource:-tagvalue) is exactly
|
|---|
| 646 | * `tagValues/123`. * `kmsKey:key` to find Google Cloud resources encrypted with
|
|---|
| 647 | * a customer-managed encryption key whose name contains `key` as a word. This
|
|---|
| 648 | * field is deprecated. Use the `kmsKeys` field to retrieve Cloud KMS key
|
|---|
| 649 | * information. * `kmsKeys:key` to find Google Cloud resources encrypted with
|
|---|
| 650 | * customer-managed encryption keys whose name contains the word `key`. *
|
|---|
| 651 | * `relationships:instance-group-1` to find Google Cloud resources that have
|
|---|
| 652 | * relationships with `instance-group-1` in the related resource name. *
|
|---|
| 653 | * `relationships:INSTANCE_TO_INSTANCEGROUP` to find Compute Engine instances
|
|---|
| 654 | * that have relationships of type `INSTANCE_TO_INSTANCEGROUP`. *
|
|---|
| 655 | * `relationships.INSTANCE_TO_INSTANCEGROUP:instance-group-1` to find Compute
|
|---|
| 656 | * Engine instances that have relationships with `instance-group-1` in the
|
|---|
| 657 | * Compute Engine instance group resource name, for relationship type
|
|---|
| 658 | * `INSTANCE_TO_INSTANCEGROUP`. * `sccSecurityMarks.key=value` to find Cloud
|
|---|
| 659 | * resources that are attached with security marks whose key is `key` and value
|
|---|
| 660 | * is `value`. * `sccSecurityMarks.key:*` to find Cloud resources that are
|
|---|
| 661 | * attached with security marks whose key is `key`. * `state:ACTIVE` to find
|
|---|
| 662 | * Google Cloud resources whose state contains `ACTIVE` as a word. * `NOT
|
|---|
| 663 | * state:ACTIVE` to find Google Cloud resources whose state doesn't contain
|
|---|
| 664 | * `ACTIVE` as a word. * `createTime<1609459200` to find Google Cloud resources
|
|---|
| 665 | * that were created before `2021-01-01 00:00:00 UTC`. `1609459200` is the epoch
|
|---|
| 666 | * timestamp of `2021-01-01 00:00:00 UTC` in seconds. * `updateTime>1609459200`
|
|---|
| 667 | * to find Google Cloud resources that were updated after `2021-01-01 00:00:00
|
|---|
| 668 | * UTC`. `1609459200` is the epoch timestamp of `2021-01-01 00:00:00 UTC` in
|
|---|
| 669 | * seconds. * `Important` to find Google Cloud resources that contain
|
|---|
| 670 | * `Important` as a word in any of the searchable fields. * `Impor*` to find
|
|---|
| 671 | * Google Cloud resources that contain `Impor` as a prefix of any word in any of
|
|---|
| 672 | * the searchable fields. * `Important location:(us-west1 OR global)` to find
|
|---|
| 673 | * Google Cloud resources that contain `Important` as a word in any of the
|
|---|
| 674 | * searchable fields and are also located in the `us-west1` region or the
|
|---|
| 675 | * `global` location.
|
|---|
| 676 | * @opt_param string readMask Optional. A comma-separated list of fields that
|
|---|
| 677 | * you want returned in the results. The following fields are returned by
|
|---|
| 678 | * default if not specified: * `name` * `assetType` * `project` * `folders` *
|
|---|
| 679 | * `organization` * `displayName` * `description` * `location` * `labels` *
|
|---|
| 680 | * `tags` * `effectiveTags` * `networkTags` * `kmsKeys` * `createTime` *
|
|---|
| 681 | * `updateTime` * `state` * `additionalAttributes` * `parentFullResourceName` *
|
|---|
| 682 | * `parentAssetType` Some fields of large size, such as `versionedResources`,
|
|---|
| 683 | * `attachedResources`, `effectiveTags` etc., are not returned by default, but
|
|---|
| 684 | * you can specify them in the `read_mask` parameter if you want to include
|
|---|
| 685 | * them. If `"*"` is specified, all [available
|
|---|
| 686 | * fields](https://cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLe
|
|---|
| 687 | * vel/searchAllResources#resourcesearchresult) are returned. Examples:
|
|---|
| 688 | * `"name,location"`, `"name,versionedResources"`, `"*"`. Any invalid field path
|
|---|
| 689 | * will trigger INVALID_ARGUMENT error.
|
|---|
| 690 | * @return SearchAllResourcesResponse
|
|---|
| 691 | * @throws \Google\Service\Exception
|
|---|
| 692 | */
|
|---|
| 693 | public function searchAllResources($scope, $optParams = [])
|
|---|
| 694 | {
|
|---|
| 695 | $params = ['scope' => $scope];
|
|---|
| 696 | $params = array_merge($params, $optParams);
|
|---|
| 697 | return $this->call('searchAllResources', [$params], SearchAllResourcesResponse::class);
|
|---|
| 698 | }
|
|---|
| 699 | }
|
|---|
| 700 |
|
|---|
| 701 | // Adding a class alias for backwards compatibility with the previous class name.
|
|---|
| 702 | class_alias(V1::class, 'Google_Service_CloudAsset_Resource_V1');
|
|---|
