diff --git a/proto/google/events/cloud/audit/v1/data.proto b/proto/google/events/cloud/audit/v1/data.proto index 8e3eb1f0..14053a48 100644 --- a/proto/google/events/cloud/audit/v1/data.proto +++ b/proto/google/events/cloud/audit/v1/data.proto @@ -17,6 +17,7 @@ syntax = "proto3"; package google.events.cloud.audit.v1; import "google/protobuf/struct.proto"; +import "google/rpc/context/attribute_context.proto"; import "google/rpc/status.proto"; option csharp_namespace = "Google.Events.Protobuf.Cloud.Audit.V1"; @@ -46,6 +47,18 @@ message AuditLogData { // "shelves/SHELF_ID/books/BOOK_ID" string resource_name = 11; + // The resource location information. + ResourceLocation resource_location = 20; + + // The resource's original state before mutation. Present only for + // operations which have successfully modified the targeted resource(s). + // In general, this field should contain all changed fields, except those + // that are already been included in `request`, `response`, `metadata` or + // `service_data` fields. + // When the JSON object represented here has a proto equivalent, + // the proto name will be indicated in the `@type` property. + google.protobuf.Struct resource_original_state = 19; + // The number of items returned from a List or Query API method, // if applicable. int64 num_response_items = 12; @@ -80,6 +93,11 @@ message AuditLogData { // name will be indicated in the `@type` property. google.protobuf.Struct response = 17; + // Other service-specific data about the request, response, and other + // information associated with the current audited event. + google.protobuf.Struct metadata = 18; + + // Deprecated, use `metadata` field instead. // Other service-specific data about the request, response, and other // activities. // When the JSON object represented here has a proto equivalent, the proto @@ -89,15 +107,46 @@ message AuditLogData { // Authentication information for the operation. message AuthenticationInfo { - // The email address of the authenticated user making the request. + // The email address of the authenticated user (or service account on behalf + // of third party principal) making the request. For privacy reasons, the + // principal email address is redacted for all read-only operations that fail + // with a "permission denied" error. string principal_email = 1; + + // The authority selector specified by the requestor, if any. + // It is not guaranteed that the principal was allowed to use this authority. + string authority_selector = 2; + + // The third party identification (if any) of the authenticated user making + // the request. + // When the JSON object represented here has a proto equivalent, the proto + // name will be indicated in the `@type` property. + google.protobuf.Struct third_party_principal = 4; + + // The name of the service account key used to create or exchange + // credentials for authenticating the service account making the request. + // This is a scheme-less URI full resource name. For example: + // + // "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}" + string service_account_key_name = 5; + + // Identity delegation history of an authenticated service account that makes + // the request. It contains information on the real authorities that try to + // access GCP resources by delegating on a service account. When multiple + // authorities present, they are guaranteed to be sorted based on the original + // ordering of the identity delegation events. + repeated ServiceAccountDelegationInfo service_account_delegation_info = 6; + + // String representation of identity of requesting party. + // Populated for both first and third party identities. + string principal_subject = 8; } // Authorization information for the operation. message AuthorizationInfo { // The resource being accessed, as a REST-style string. For example: // - // bigquery.googlapis.com/projects/PROJECTID/datasets/DATASETID + // bigquery.googleapis.com/projects/PROJECTID/datasets/DATASETID string resource = 1; // The required IAM permission. @@ -106,11 +155,27 @@ message AuthorizationInfo { // Whether or not authorization for `resource` and `permission` // was granted. bool granted = 3; + + // Resource attributes used in IAM condition evaluation. This field contains + // resource attributes like resource type and resource name. + // + // To get the whole view of the attributes used in IAM + // condition evaluation, the user must also look into + // `AuditLogData.request_metadata.request_attributes`. + google.rpc.context.AttributeContext.Resource resource_attributes = 5; } // Metadata about the request. message RequestMetadata { // The IP address of the caller. + // For caller from internet, this will be public IPv4 or IPv6 address. + // For caller from a Compute Engine VM with external IP address, this + // will be the VM's external IP address. For caller from a Compute + // Engine VM without external IP address, if the VM is in the same + // organization (or project) as the accessed resource, `caller_ip` will + // be the VM's internal IPv4 address, otherwise the `caller_ip` will be + // redacted to "gce-internal-ip". + // See https://cloud.google.com/compute/docs/vpc/ for more information. string caller_ip = 1; // The user agent of the caller. @@ -125,4 +190,81 @@ message RequestMetadata { // s~my-project`: // The request was made from the `my-project` App Engine app. string caller_supplied_user_agent = 2; + + // The network of the caller. + // Set only if the network host project is part of the same GCP organization + // (or project) as the accessed resource. + // See https://cloud.google.com/compute/docs/vpc/ for more information. + // This is a scheme-less URI full resource name. For example: + // + // "//compute.googleapis.com/projects/PROJECT_ID/global/networks/NETWORK_ID" + string caller_network = 3; + + // Request attributes used in IAM condition evaluation. This field contains + // request attributes like request time and access levels associated with + // the request. + // + // + // To get the whole view of the attributes used in IAM + // condition evaluation, the user must also look into + // `AuditLog.authentication_info.resource_attributes`. + google.rpc.context.AttributeContext.Request request_attributes = 7; + + // The destination of a network activity, such as accepting a TCP connection. + // In a multi hop network activity, the destination represents the receiver of + // the last hop. Only two fields are used in this message, Peer.port and + // Peer.ip. These fields are optionally populated by those services utilizing + // the IAM condition feature. + google.rpc.context.AttributeContext.Peer destination_attributes = 8; +} + +// Location information about a resource. +message ResourceLocation { + // The locations of a resource after the execution of the operation. + // Requests to create or delete a location based resource must populate + // the 'current_locations' field and not the 'original_locations' field. + // For example: + // + // "europe-west1-a" + // "us-east1" + // "nam3" + repeated string current_locations = 1; + + // The locations of a resource prior to the execution of the operation. + // Requests that mutate the resource's location must populate both the + // 'original_locations' as well as the 'current_locations' fields. + // For example: + // + // "europe-west1-a" + // "us-east1" + // "nam3" + repeated string original_locations = 2; +} + +// Identity delegation history of an authenticated service account. +message ServiceAccountDelegationInfo { + // First party identity principal. + message FirstPartyPrincipal { + // The email address of a Google account. + string principal_email = 1; + + // Metadata about the service that uses the service account. + google.protobuf.Struct service_metadata = 2; + } + + // Third party identity principal. + message ThirdPartyPrincipal { + // Metadata about third party identity. + google.protobuf.Struct third_party_claims = 1; + } + + // Entity that creates credentials for service account and assumes its + // identity for authentication. + oneof Authority { + // First party (Google) identity as the real authority. + FirstPartyPrincipal first_party_principal = 1; + + // Third party identity as the real authority. + ThirdPartyPrincipal third_party_principal = 2; + } }