audit

package
v0.0.0-...-6cb3ea0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 7, 2021 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var File_google_cloud_audit_audit_log_proto protoreflect.FileDescriptor

Functions

This section is empty.

Types

type AuditLog

type AuditLog struct {

	// The name of the API service performing the operation. For example,
	// `"compute.googleapis.com"`.
	ServiceName string `protobuf:"bytes,7,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// The name of the service method or operation.
	// For API calls, this should be the name of the API method.
	// For example,
	//
	//     "google.cloud.bigquery.v2.TableService.InsertTable"
	//     "google.logging.v2.ConfigServiceV2.CreateSink"
	MethodName string `protobuf:"bytes,8,opt,name=method_name,json=methodName,proto3" json:"method_name,omitempty"`
	// The resource or collection that is the target of the operation.
	// The name is a scheme-less URI, not including the API service name.
	// For example:
	//
	//     "projects/PROJECT_ID/zones/us-central1-a/instances"
	//     "projects/PROJECT_ID/datasets/DATASET_ID"
	ResourceName string `protobuf:"bytes,11,opt,name=resource_name,json=resourceName,proto3" json:"resource_name,omitempty"`
	// The resource location information.
	ResourceLocation *ResourceLocation `protobuf:"bytes,20,opt,name=resource_location,json=resourceLocation,proto3" json:"resource_location,omitempty"`
	// The resource's original state before mutation. Present only for
	// operations which have successfully modified the targeted resource(s).
	// In general, this field should contain all changed fields, except those
	// that are already been included in `request`, `response`, `metadata` or
	// `service_data` fields.
	// When the JSON object represented here has a proto equivalent,
	// the proto name will be indicated in the `@type` property.
	ResourceOriginalState *structpb.Struct `` /* 127-byte string literal not displayed */
	// The number of items returned from a List or Query API method,
	// if applicable.
	NumResponseItems int64 `protobuf:"varint,12,opt,name=num_response_items,json=numResponseItems,proto3" json:"num_response_items,omitempty"`
	// The status of the overall operation.
	Status *status.Status `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
	// Authentication information.
	AuthenticationInfo *AuthenticationInfo `protobuf:"bytes,3,opt,name=authentication_info,json=authenticationInfo,proto3" json:"authentication_info,omitempty"`
	// Authorization information. If there are multiple
	// resources or permissions involved, then there is
	// one AuthorizationInfo element for each {resource, permission} tuple.
	AuthorizationInfo []*AuthorizationInfo `protobuf:"bytes,9,rep,name=authorization_info,json=authorizationInfo,proto3" json:"authorization_info,omitempty"`
	// Metadata about the operation.
	RequestMetadata *RequestMetadata `protobuf:"bytes,4,opt,name=request_metadata,json=requestMetadata,proto3" json:"request_metadata,omitempty"`
	// The operation request. This may not include all request parameters,
	// such as those that are too large, privacy-sensitive, or duplicated
	// elsewhere in the log record.
	// It should never include user-generated data, such as file contents.
	// When the JSON object represented here has a proto equivalent, the proto
	// name will be indicated in the `@type` property.
	Request *structpb.Struct `protobuf:"bytes,16,opt,name=request,proto3" json:"request,omitempty"`
	// The operation response. This may not include all response elements,
	// such as those that are too large, privacy-sensitive, or duplicated
	// elsewhere in the log record.
	// It should never include user-generated data, such as file contents.
	// When the JSON object represented here has a proto equivalent, the proto
	// name will be indicated in the `@type` property.
	Response *structpb.Struct `protobuf:"bytes,17,opt,name=response,proto3" json:"response,omitempty"`
	// Other service-specific data about the request, response, and other
	// information associated with the current audited event.
	Metadata *structpb.Struct `protobuf:"bytes,18,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Deprecated. Use the `metadata` field instead.
	// Other service-specific data about the request, response, and other
	// activities.
	//
	// Deprecated: Do not use.
	ServiceData *anypb.Any `protobuf:"bytes,15,opt,name=service_data,json=serviceData,proto3" json:"service_data,omitempty"`
	// contains filtered or unexported fields
}

Common audit log format for Google Cloud Platform API operations.

func (*AuditLog) Descriptor deprecated

func (*AuditLog) Descriptor() ([]byte, []int)

Deprecated: Use AuditLog.ProtoReflect.Descriptor instead.

func (*AuditLog) GetAuthenticationInfo

func (x *AuditLog) GetAuthenticationInfo() *AuthenticationInfo

func (*AuditLog) GetAuthorizationInfo

func (x *AuditLog) GetAuthorizationInfo() []*AuthorizationInfo

func (*AuditLog) GetMetadata

func (x *AuditLog) GetMetadata() *structpb.Struct

func (*AuditLog) GetMethodName

func (x *AuditLog) GetMethodName() string

func (*AuditLog) GetNumResponseItems

func (x *AuditLog) GetNumResponseItems() int64

func (*AuditLog) GetRequest

func (x *AuditLog) GetRequest() *structpb.Struct

func (*AuditLog) GetRequestMetadata

func (x *AuditLog) GetRequestMetadata() *RequestMetadata

func (*AuditLog) GetResourceLocation

func (x *AuditLog) GetResourceLocation() *ResourceLocation

func (*AuditLog) GetResourceName

func (x *AuditLog) GetResourceName() string

func (*AuditLog) GetResourceOriginalState

func (x *AuditLog) GetResourceOriginalState() *structpb.Struct

func (*AuditLog) GetResponse

func (x *AuditLog) GetResponse() *structpb.Struct

func (*AuditLog) GetServiceData deprecated

func (x *AuditLog) GetServiceData() *anypb.Any

Deprecated: Do not use.

func (*AuditLog) GetServiceName

func (x *AuditLog) GetServiceName() string

func (*AuditLog) GetStatus

func (x *AuditLog) GetStatus() *status.Status

func (*AuditLog) ProtoMessage

func (*AuditLog) ProtoMessage()

func (*AuditLog) ProtoReflect

func (x *AuditLog) ProtoReflect() protoreflect.Message

func (*AuditLog) Reset

func (x *AuditLog) Reset()

func (*AuditLog) String

func (x *AuditLog) String() string

type AuthenticationInfo

type AuthenticationInfo struct {

	// The email address of the authenticated user (or service account on behalf
	// of third party principal) making the request. For third party identity
	// callers, the `principal_subject` field is populated instead of this field.
	// For privacy reasons, the principal email address is sometimes redacted.
	// For more information, see
	// https://cloud.google.com/logging/docs/audit#user-id.
	PrincipalEmail string `protobuf:"bytes,1,opt,name=principal_email,json=principalEmail,proto3" json:"principal_email,omitempty"`
	// The authority selector specified by the requestor, if any.
	// It is not guaranteed that the principal was allowed to use this authority.
	AuthoritySelector string `protobuf:"bytes,2,opt,name=authority_selector,json=authoritySelector,proto3" json:"authority_selector,omitempty"`
	// The third party identification (if any) of the authenticated user making
	// the request.
	// When the JSON object represented here has a proto equivalent, the proto
	// name will be indicated in the `@type` property.
	ThirdPartyPrincipal *structpb.Struct `protobuf:"bytes,4,opt,name=third_party_principal,json=thirdPartyPrincipal,proto3" json:"third_party_principal,omitempty"`
	// The name of the service account key used to create or exchange
	// credentials for authenticating the service account making the request.
	// This is a scheme-less URI full resource name. For example:
	//
	// "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}"
	ServiceAccountKeyName string `` /* 128-byte string literal not displayed */
	// Identity delegation history of an authenticated service account that makes
	// the request. It contains information on the real authorities that try to
	// access GCP resources by delegating on a service account. When multiple
	// authorities present, they are guaranteed to be sorted based on the original
	// ordering of the identity delegation events.
	ServiceAccountDelegationInfo []*ServiceAccountDelegationInfo `` /* 149-byte string literal not displayed */
	// String representation of identity of requesting party.
	// Populated for both first and third party identities.
	PrincipalSubject string `protobuf:"bytes,8,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	// contains filtered or unexported fields
}

Authentication information for the operation.

func (*AuthenticationInfo) Descriptor deprecated

func (*AuthenticationInfo) Descriptor() ([]byte, []int)

Deprecated: Use AuthenticationInfo.ProtoReflect.Descriptor instead.

func (*AuthenticationInfo) GetAuthoritySelector

func (x *AuthenticationInfo) GetAuthoritySelector() string

func (*AuthenticationInfo) GetPrincipalEmail

func (x *AuthenticationInfo) GetPrincipalEmail() string

func (*AuthenticationInfo) GetPrincipalSubject

func (x *AuthenticationInfo) GetPrincipalSubject() string

func (*AuthenticationInfo) GetServiceAccountDelegationInfo

func (x *AuthenticationInfo) GetServiceAccountDelegationInfo() []*ServiceAccountDelegationInfo

func (*AuthenticationInfo) GetServiceAccountKeyName

func (x *AuthenticationInfo) GetServiceAccountKeyName() string

func (*AuthenticationInfo) GetThirdPartyPrincipal

func (x *AuthenticationInfo) GetThirdPartyPrincipal() *structpb.Struct

func (*AuthenticationInfo) ProtoMessage

func (*AuthenticationInfo) ProtoMessage()

func (*AuthenticationInfo) ProtoReflect

func (x *AuthenticationInfo) ProtoReflect() protoreflect.Message

func (*AuthenticationInfo) Reset

func (x *AuthenticationInfo) Reset()

func (*AuthenticationInfo) String

func (x *AuthenticationInfo) String() string

type AuthorizationInfo

type AuthorizationInfo struct {

	// The resource being accessed, as a REST-style or cloud resource string.
	// For example:
	//
	//     bigquery.googleapis.com/projects/PROJECTID/datasets/DATASETID
	// or
	//     projects/PROJECTID/datasets/DATASETID
	Resource string `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// The required IAM permission.
	Permission string `protobuf:"bytes,2,opt,name=permission,proto3" json:"permission,omitempty"`
	// Whether or not authorization for `resource` and `permission`
	// was granted.
	Granted bool `protobuf:"varint,3,opt,name=granted,proto3" json:"granted,omitempty"`
	// Resource attributes used in IAM condition evaluation. This field contains
	// resource attributes like resource type and resource name.
	//
	// To get the whole view of the attributes used in IAM
	// condition evaluation, the user must also look into
	// `AuditLog.request_metadata.request_attributes`.
	ResourceAttributes *attribute_context.AttributeContext_Resource `protobuf:"bytes,5,opt,name=resource_attributes,json=resourceAttributes,proto3" json:"resource_attributes,omitempty"`
	// contains filtered or unexported fields
}

Authorization information for the operation.

func (*AuthorizationInfo) Descriptor deprecated

func (*AuthorizationInfo) Descriptor() ([]byte, []int)

Deprecated: Use AuthorizationInfo.ProtoReflect.Descriptor instead.

func (*AuthorizationInfo) GetGranted

func (x *AuthorizationInfo) GetGranted() bool

func (*AuthorizationInfo) GetPermission

func (x *AuthorizationInfo) GetPermission() string

func (*AuthorizationInfo) GetResource

func (x *AuthorizationInfo) GetResource() string

func (*AuthorizationInfo) GetResourceAttributes

func (*AuthorizationInfo) ProtoMessage

func (*AuthorizationInfo) ProtoMessage()

func (*AuthorizationInfo) ProtoReflect

func (x *AuthorizationInfo) ProtoReflect() protoreflect.Message

func (*AuthorizationInfo) Reset

func (x *AuthorizationInfo) Reset()

func (*AuthorizationInfo) String

func (x *AuthorizationInfo) String() string

type RequestMetadata

type RequestMetadata struct {

	// The IP address of the caller.
	// For caller from internet, this will be public IPv4 or IPv6 address.
	// For caller from a Compute Engine VM with external IP address, this
	// will be the VM's external IP address. For caller from a Compute
	// Engine VM without external IP address, if the VM is in the same
	// organization (or project) as the accessed resource, `caller_ip` will
	// be the VM's internal IPv4 address, otherwise the `caller_ip` will be
	// redacted to "gce-internal-ip".
	// See https://cloud.google.com/compute/docs/vpc/ for more information.
	CallerIp string `protobuf:"bytes,1,opt,name=caller_ip,json=callerIp,proto3" json:"caller_ip,omitempty"`
	// The user agent of the caller.
	// This information is not authenticated and should be treated accordingly.
	// For example:
	//
	// +   `google-api-python-client/1.4.0`:
	//     The request was made by the Google API client for Python.
	// +   `Cloud SDK Command Line Tool apitools-client/1.0 gcloud/0.9.62`:
	//     The request was made by the Google Cloud SDK CLI (gcloud).
	// +   `AppEngine-Google; (+http://code.google.com/appengine; appid:
	// s~my-project`:
	//     The request was made from the `my-project` App Engine app.
	CallerSuppliedUserAgent string `` /* 134-byte string literal not displayed */
	// The network of the caller.
	// Set only if the network host project is part of the same GCP organization
	// (or project) as the accessed resource.
	// See https://cloud.google.com/compute/docs/vpc/ for more information.
	// This is a scheme-less URI full resource name. For example:
	//
	//     "//compute.googleapis.com/projects/PROJECT_ID/global/networks/NETWORK_ID"
	CallerNetwork string `protobuf:"bytes,3,opt,name=caller_network,json=callerNetwork,proto3" json:"caller_network,omitempty"`
	// Request attributes used in IAM condition evaluation. This field contains
	// request attributes like request time and access levels associated with
	// the request.
	//
	//
	// To get the whole view of the attributes used in IAM
	// condition evaluation, the user must also look into
	// `AuditLog.authentication_info.resource_attributes`.
	RequestAttributes *attribute_context.AttributeContext_Request `protobuf:"bytes,7,opt,name=request_attributes,json=requestAttributes,proto3" json:"request_attributes,omitempty"`
	// The destination of a network activity, such as accepting a TCP connection.
	// In a multi hop network activity, the destination represents the receiver of
	// the last hop. Only two fields are used in this message, Peer.port and
	// Peer.ip. These fields are optionally populated by those services utilizing
	// the IAM condition feature.
	DestinationAttributes *attribute_context.AttributeContext_Peer `protobuf:"bytes,8,opt,name=destination_attributes,json=destinationAttributes,proto3" json:"destination_attributes,omitempty"`
	// contains filtered or unexported fields
}

Metadata about the request.

func (*RequestMetadata) Descriptor deprecated

func (*RequestMetadata) Descriptor() ([]byte, []int)

Deprecated: Use RequestMetadata.ProtoReflect.Descriptor instead.

func (*RequestMetadata) GetCallerIp

func (x *RequestMetadata) GetCallerIp() string

func (*RequestMetadata) GetCallerNetwork

func (x *RequestMetadata) GetCallerNetwork() string

func (*RequestMetadata) GetCallerSuppliedUserAgent

func (x *RequestMetadata) GetCallerSuppliedUserAgent() string

func (*RequestMetadata) GetDestinationAttributes

func (x *RequestMetadata) GetDestinationAttributes() *attribute_context.AttributeContext_Peer

func (*RequestMetadata) GetRequestAttributes

func (x *RequestMetadata) GetRequestAttributes() *attribute_context.AttributeContext_Request

func (*RequestMetadata) ProtoMessage

func (*RequestMetadata) ProtoMessage()

func (*RequestMetadata) ProtoReflect

func (x *RequestMetadata) ProtoReflect() protoreflect.Message

func (*RequestMetadata) Reset

func (x *RequestMetadata) Reset()

func (*RequestMetadata) String

func (x *RequestMetadata) String() string

type ResourceLocation

type ResourceLocation struct {

	// The locations of a resource after the execution of the operation.
	// Requests to create or delete a location based resource must populate
	// the 'current_locations' field and not the 'original_locations' field.
	// For example:
	//
	//     "europe-west1-a"
	//     "us-east1"
	//     "nam3"
	CurrentLocations []string `protobuf:"bytes,1,rep,name=current_locations,json=currentLocations,proto3" json:"current_locations,omitempty"`
	// The locations of a resource prior to the execution of the operation.
	// Requests that mutate the resource's location must populate both the
	// 'original_locations' as well as the 'current_locations' fields.
	// For example:
	//
	//     "europe-west1-a"
	//     "us-east1"
	//     "nam3"
	OriginalLocations []string `protobuf:"bytes,2,rep,name=original_locations,json=originalLocations,proto3" json:"original_locations,omitempty"`
	// contains filtered or unexported fields
}

Location information about a resource.

func (*ResourceLocation) Descriptor deprecated

func (*ResourceLocation) Descriptor() ([]byte, []int)

Deprecated: Use ResourceLocation.ProtoReflect.Descriptor instead.

func (*ResourceLocation) GetCurrentLocations

func (x *ResourceLocation) GetCurrentLocations() []string

func (*ResourceLocation) GetOriginalLocations

func (x *ResourceLocation) GetOriginalLocations() []string

func (*ResourceLocation) ProtoMessage

func (*ResourceLocation) ProtoMessage()

func (*ResourceLocation) ProtoReflect

func (x *ResourceLocation) ProtoReflect() protoreflect.Message

func (*ResourceLocation) Reset

func (x *ResourceLocation) Reset()

func (*ResourceLocation) String

func (x *ResourceLocation) String() string

type ServiceAccountDelegationInfo

type ServiceAccountDelegationInfo struct {

	// A string representing the principal_subject associated with the identity.
	// For most identities, the format will be
	// `principal://iam.googleapis.com/{identity pool name}/subject/{subject)`
	// except for some GKE identities (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD)
	// that are still in the legacy format `serviceAccount:{identity pool
	// name}[{subject}]`
	PrincipalSubject string `protobuf:"bytes,3,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	// Entity that creates credentials for service account and assumes its
	// identity for authentication.
	//
	// Types that are assignable to Authority:
	//	*ServiceAccountDelegationInfo_FirstPartyPrincipal_
	//	*ServiceAccountDelegationInfo_ThirdPartyPrincipal_
	Authority isServiceAccountDelegationInfo_Authority `protobuf_oneof:"Authority"`
	// contains filtered or unexported fields
}

Identity delegation history of an authenticated service account.

func (*ServiceAccountDelegationInfo) Descriptor deprecated

func (*ServiceAccountDelegationInfo) Descriptor() ([]byte, []int)

Deprecated: Use ServiceAccountDelegationInfo.ProtoReflect.Descriptor instead.

func (*ServiceAccountDelegationInfo) GetAuthority

func (m *ServiceAccountDelegationInfo) GetAuthority() isServiceAccountDelegationInfo_Authority

func (*ServiceAccountDelegationInfo) GetFirstPartyPrincipal

func (*ServiceAccountDelegationInfo) GetPrincipalSubject

func (x *ServiceAccountDelegationInfo) GetPrincipalSubject() string

func (*ServiceAccountDelegationInfo) GetThirdPartyPrincipal

func (*ServiceAccountDelegationInfo) ProtoMessage

func (*ServiceAccountDelegationInfo) ProtoMessage()

func (*ServiceAccountDelegationInfo) ProtoReflect

func (*ServiceAccountDelegationInfo) Reset

func (x *ServiceAccountDelegationInfo) Reset()

func (*ServiceAccountDelegationInfo) String

type ServiceAccountDelegationInfo_FirstPartyPrincipal

type ServiceAccountDelegationInfo_FirstPartyPrincipal struct {

	// The email address of a Google account.
	PrincipalEmail string `protobuf:"bytes,1,opt,name=principal_email,json=principalEmail,proto3" json:"principal_email,omitempty"`
	// Metadata about the service that uses the service account.
	ServiceMetadata *structpb.Struct `protobuf:"bytes,2,opt,name=service_metadata,json=serviceMetadata,proto3" json:"service_metadata,omitempty"`
	// contains filtered or unexported fields
}

First party identity principal.

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) Descriptor deprecated

Deprecated: Use ServiceAccountDelegationInfo_FirstPartyPrincipal.ProtoReflect.Descriptor instead.

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) GetPrincipalEmail

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) GetServiceMetadata

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) ProtoMessage

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) ProtoReflect

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) Reset

func (*ServiceAccountDelegationInfo_FirstPartyPrincipal) String

type ServiceAccountDelegationInfo_FirstPartyPrincipal_

type ServiceAccountDelegationInfo_FirstPartyPrincipal_ struct {
	// First party (Google) identity as the real authority.
	FirstPartyPrincipal *ServiceAccountDelegationInfo_FirstPartyPrincipal `protobuf:"bytes,1,opt,name=first_party_principal,json=firstPartyPrincipal,proto3,oneof"`
}

type ServiceAccountDelegationInfo_ThirdPartyPrincipal

type ServiceAccountDelegationInfo_ThirdPartyPrincipal struct {

	// Metadata about third party identity.
	ThirdPartyClaims *structpb.Struct `protobuf:"bytes,1,opt,name=third_party_claims,json=thirdPartyClaims,proto3" json:"third_party_claims,omitempty"`
	// contains filtered or unexported fields
}

Third party identity principal.

func (*ServiceAccountDelegationInfo_ThirdPartyPrincipal) Descriptor deprecated

Deprecated: Use ServiceAccountDelegationInfo_ThirdPartyPrincipal.ProtoReflect.Descriptor instead.

func (*ServiceAccountDelegationInfo_ThirdPartyPrincipal) GetThirdPartyClaims

func (*ServiceAccountDelegationInfo_ThirdPartyPrincipal) ProtoMessage

func (*ServiceAccountDelegationInfo_ThirdPartyPrincipal) ProtoReflect

func (*ServiceAccountDelegationInfo_ThirdPartyPrincipal) Reset

func (*ServiceAccountDelegationInfo_ThirdPartyPrincipal) String

type ServiceAccountDelegationInfo_ThirdPartyPrincipal_

type ServiceAccountDelegationInfo_ThirdPartyPrincipal_ struct {
	// Third party identity as the real authority.
	ThirdPartyPrincipal *ServiceAccountDelegationInfo_ThirdPartyPrincipal `protobuf:"bytes,2,opt,name=third_party_principal,json=thirdPartyPrincipal,proto3,oneof"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL