feat(target): Classify resources for audit events
This commit is contained in:
Timothy Messier authored and 
Johan Brandhorst-Satzkorn committed
1 parent
c8be4a9890
commit
3be5c44907
7 files changed
+1017
-657
No files matched your search
@@ -13,62 +13,62 @@ import "controller/custom_options/v1/options.proto";
|
||||
|
||||
message HostSource {
|
||||
// Output only. The ID of the Host Set.
|
||||
string id = 10;
|
||||
string id = 10; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The Host Catalog to which this Host Source belongs.
|
||||
string host_catalog_id = 20 [json_name = "host_catalog_id"];
|
||||
string host_catalog_id = 20 [json_name = "host_catalog_id"]; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
message HostSet {
|
||||
// Output only. The ID of the Host Set.
|
||||
string id = 10;
|
||||
string id = 10; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The Host Catalog to which this Host Set belongs.
|
||||
string host_catalog_id = 20 [json_name = "host_catalog_id"];
|
||||
string host_catalog_id = 20 [json_name = "host_catalog_id"]; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
message CredentialSource {
|
||||
// The ID of the Credential. May be empty if the credential is dynamically generated from a library.
|
||||
string id = 10;
|
||||
string id = 10; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The name of the Credential source.
|
||||
string name = 20;
|
||||
string name = 20; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The description of the Credential source.
|
||||
string description = 30;
|
||||
string description = 30; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The Credential Store to which this Credential source belongs.
|
||||
string credential_store_id = 40 [json_name = "credential_store_id"];
|
||||
string credential_store_id = 40 [json_name = "credential_store_id"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The type of the credential source (e.g. "vault"; not the type of the credential itself).
|
||||
string type = 60;
|
||||
string type = 60; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The type of the credential, empty if unspecified.
|
||||
string credential_type = 70;
|
||||
string credential_type = 70; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
message CredentialLibrary {
|
||||
// The ID of the Credential Library.
|
||||
string id = 10;
|
||||
string id = 10; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The name of the Credential Library.
|
||||
string name = 20;
|
||||
string name = 20; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The description of the Credential Library.
|
||||
string description = 30;
|
||||
string description = 30; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The Credential Store to which this Credential Library belongs.
|
||||
string credential_store_id = 40 [json_name = "credential_store_id"];
|
||||
string credential_store_id = 40 [json_name = "credential_store_id"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The type of the credential library.
|
||||
string type = 60;
|
||||
string type = 60; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
// The actual secret for a session credential.
|
||||
message SessionSecret {
|
||||
// Output only. The base64-encoded value representing the raw bytes from the
|
||||
// credential provider.
|
||||
string raw = 10;
|
||||
string raw = 10; // @gotags: `class:"secret"`
|
||||
|
||||
// Output only. The decoded raw string, if a JSON object.
|
||||
google.protobuf.Struct decoded = 20;
|
||||
@@ -93,95 +93,94 @@ message SessionCredential {
|
||||
// Target contains all fields related to a Target resource
|
||||
message Target {
|
||||
// Output only. The ID of the resource.
|
||||
string id = 10;
|
||||
string id = 10; // @gotags: `class:"public"`
|
||||
|
||||
// The Scope of of this resource. This must be defined for creation of this resource, but is otherwise output only.
|
||||
string scope_id = 20 [json_name = "scope_id"];
|
||||
string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. Scope information for this resource.
|
||||
resources.scopes.v1.ScopeInfo scope = 30;
|
||||
|
||||
// Required name for identification purposes.
|
||||
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "name" }];
|
||||
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "name" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Optional user-set description for identification purposes.
|
||||
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "description" }];
|
||||
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "description" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The time this resource was created.
|
||||
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"];
|
||||
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The time this resource was last updated.
|
||||
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"];
|
||||
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`
|
||||
|
||||
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
|
||||
// The mutation will fail if the version does not match the latest known good version.
|
||||
uint32 version = 80;
|
||||
uint32 version = 80; // @gotags: `class:"public"`
|
||||
|
||||
// The type of the Target.
|
||||
string type = 90;
|
||||
string type = 90; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The IDs of the Host Sets associated with this Target.
|
||||
repeated string host_set_ids = 100 [json_name = "host_set_ids"];
|
||||
repeated string host_set_ids = 100 [json_name = "host_set_ids"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The Host Sets associated with this Target.
|
||||
repeated HostSet host_sets = 110 [json_name = "host_sets"];
|
||||
|
||||
// Output only. The IDs of the Host Sources associated with this Target.
|
||||
repeated string host_source_ids = 420 [json_name = "host_source_ids"];
|
||||
repeated string host_source_ids = 420 [json_name = "host_source_ids"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The Host Sources associated with this Target.
|
||||
repeated HostSource host_sources = 430 [json_name = "host_sources"];
|
||||
|
||||
// Maximum total lifetime of a created Session, in seconds.
|
||||
google.protobuf.UInt32Value session_max_seconds = 120
|
||||
[json_name = "session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_max_seconds" that: "SessionMaxSeconds" }];
|
||||
[json_name = "session_max_seconds", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_max_seconds" that: "SessionMaxSeconds" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Maximum number of connections allowed in a Session. Unlimited is indicated by the value -1.
|
||||
google.protobuf.Int32Value session_connection_limit = 130
|
||||
[json_name = "session_connection_limit", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_connection_limit" that: "SessionConnectionLimit" }];
|
||||
[json_name = "session_connection_limit", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "session_connection_limit" that: "SessionConnectionLimit" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Optional boolean expression to filter the workers that are allowed to satisfy this request.
|
||||
google.protobuf.StringValue worker_filter = 140
|
||||
[json_name = "worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "worker_filter" that: "WorkerFilter" }];
|
||||
[json_name = "worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "worker_filter" that: "WorkerFilter" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead.
|
||||
repeated string application_credential_library_ids = 150 [json_name = "application_credential_library_ids", deprecated = true];
|
||||
repeated string application_credential_library_ids = 150 [json_name = "application_credential_library_ids", deprecated = true]; // @gotags: `class:"public"`
|
||||
// Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.
|
||||
repeated CredentialLibrary application_credential_libraries = 180 [json_name = "application_credential_libraries", deprecated = true];
|
||||
|
||||
// Output only. The IDs of the application credential source ids associated with this Target.
|
||||
repeated string application_credential_source_ids = 400 [json_name = "application_credential_source_ids"];
|
||||
repeated string application_credential_source_ids = 400 [json_name = "application_credential_source_ids"]; // @gotags: `class:"public"`
|
||||
// Output only. The application credential sources associated with this Target.
|
||||
repeated CredentialSource application_credential_sources = 410 [json_name = "application_credential_sources"];
|
||||
|
||||
// Output only. The IDs of the egress credential source ids associated with this Target.
|
||||
repeated string egress_credential_source_ids = 500 [json_name = "egress_credential_source_ids"];
|
||||
repeated string egress_credential_source_ids = 500 [json_name = "egress_credential_source_ids"]; // @gotags: `class:"public"`
|
||||
// Output only. The egress credential sources associated with this Target.
|
||||
repeated CredentialSource egress_credential_sources = 510 [json_name = "egress_credential_sources"];
|
||||
|
||||
oneof attrs {
|
||||
// The attributes that are applicable for the specific Target.
|
||||
google.protobuf.Struct attributes = 200 [
|
||||
(google.api.field_visibility).restriction = "INTERNAL",
|
||||
(custom_options.v1.generate_sdk_option) = true,
|
||||
(custom_options.v1.subtype) = "default"
|
||||
(custom_options.v1.subtype) = "default"
|
||||
];
|
||||
TcpTargetAttributes tcp_target_attributes = 201 [
|
||||
(google.api.field_visibility).restriction = "INTERNAL",
|
||||
(custom_options.v1.generate_sdk_option) = true,
|
||||
(custom_options.v1.subtype) = "tcp"
|
||||
];
|
||||
TcpTargetAttributes tcp_target_attributes = 201 [
|
||||
(google.api.field_visibility).restriction = "INTERNAL",
|
||||
(custom_options.v1.generate_sdk_option) = true,
|
||||
(custom_options.v1.subtype) = "tcp"
|
||||
];
|
||||
}
|
||||
|
||||
// Output only. The available actions on this resource for this user.
|
||||
repeated string authorized_actions = 300 [json_name = "authorized_actions"];
|
||||
repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
// TcpTargetAttributes contains attributes relevant to Targets of type "tcp"
|
||||
message TcpTargetAttributes {
|
||||
// The default TCP port that will be used when connecting to the endpoint unless overridden by a Host Set or Host.
|
||||
google.protobuf.UInt32Value default_port = 10
|
||||
[json_name = "default_port", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.default_port" that: "DefaultPort" }];
|
||||
[json_name = "default_port", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.default_port" that: "DefaultPort" }]; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
// WorkerInfo contains information about workers, returned in to the client in SessionAuthorization
|
||||
@@ -211,7 +210,7 @@ message SessionAuthorizationData {
|
||||
int32 connection_limit = 90 [json_name = "connection_limit"];
|
||||
|
||||
// Output only. The certificate to use when connecting. Raw DER bytes.
|
||||
bytes certificate = 120; // @gotags: `class:"secret"`
|
||||
bytes certificate = 120; // @gotags: `class:"sensitive"`
|
||||
|
||||
// Output only. The private key to use when connecting. We are using Ed25519, so this is purely raw bytes, no marshaling.
|
||||
bytes private_key = 130 [json_name = "private_key"]; // @gotags: `class:"secret"`
|
||||
@@ -262,11 +261,11 @@ message SessionAuthorization {
|
||||
repeated SessionCredential credentials = 110 [json_name = "credentials"];
|
||||
}
|
||||
|
||||
// The layout of the struct for "credential" field in SessionCredential for a user_password credential type.
|
||||
// The layout of the struct for "credential" field in SessionCredential for a user_password credential type.
|
||||
message UserPasswordCredential {
|
||||
// Username of the credential
|
||||
string username = 1;
|
||||
string username = 1; // @gotags: `class:"sensitive"`
|
||||
|
||||
// Password of the credential
|
||||
string password = 2;
|
||||
string password = 2; // @gotags: `class:"secret"`
|
||||
}
|
||||
Reference in new issue
Block a user