Skip to content

Commit 40292fc

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Update AuditLog proto to include all new changes in Audit Logging. Also add a bazel build file.
The AuditLog proto is used by Cloud Audit Logging for various types of audit logs generated by various GCP services and written to Cloud Logging. The AuditLog proto is encoded as a google.protobuf.Any message inside the protoPayload field of the LogEntry. An updated proto and bazel build file allows client libraries to decode the Any message when reading logs from the Cloud Logging API. PiperOrigin-RevId: 319820594
1 parent b085d0a commit 40292fc

3 files changed

Lines changed: 321 additions & 4 deletions

File tree

‎google/cloud/audit/BUILD.bazel‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# This file was automatically generated by BuildFileGenerator
2+
3+
# This is an API workspace, having public visibility by default makes perfect sense.
4+
package(default_visibility = ["//visibility:public"])
5+
6+
##############################################################################
7+
# Common
8+
##############################################################################
9+
load("@rules_proto//proto:defs.bzl", "proto_library")
10+
11+
proto_library(
12+
name = "audit_proto",
13+
srcs = [
14+
"audit_log.proto",
15+
],
16+
deps = [
17+
"//google/rpc/context:attribute_context_proto",
18+
"//google/rpc:status_proto",
19+
"@com_google_protobuf//:any_proto",
20+
"@com_google_protobuf//:struct_proto",
21+
],
22+
)
23+
24+
##############################################################################
25+
# Java
26+
##############################################################################
27+
load(
28+
"@com_google_googleapis_imports//:imports.bzl",
29+
"java_grpc_library",
30+
"java_proto_library",
31+
)
32+
33+
java_proto_library(
34+
name = "audit_java_proto",
35+
deps = [":audit_proto"],
36+
)
37+
38+
java_grpc_library(
39+
name = "audit_java_grpc",
40+
srcs = [":audit_proto"],
41+
deps = [":audit_java_proto"],
42+
)
43+
44+
##############################################################################
45+
# Go
46+
##############################################################################
47+
load(
48+
"@com_google_googleapis_imports//:imports.bzl",
49+
"go_proto_library",
50+
)
51+
52+
go_proto_library(
53+
name = "audit_go_proto",
54+
compilers = ["@io_bazel_rules_go//proto:go_grpc"],
55+
importpath = "google.golang.org/genproto/googleapis/cloud/audit",
56+
protos = [":audit_proto"],
57+
deps = [
58+
"//google/rpc/context:attribute_context_go_proto",
59+
"//google/rpc:status_go_proto",
60+
],
61+
)
62+
63+
##############################################################################
64+
# Python
65+
##############################################################################
66+
load(
67+
"@com_google_googleapis_imports//:imports.bzl",
68+
"moved_proto_library",
69+
"py_grpc_library",
70+
"py_proto_library",
71+
)
72+
73+
moved_proto_library(
74+
name = "audit_moved_proto",
75+
srcs = [":audit_proto"],
76+
deps = [
77+
"//google/rpc/context:attribute_context_proto",
78+
"//google/rpc:status_proto",
79+
"@com_google_protobuf//:any_proto",
80+
"@com_google_protobuf//:struct_proto",
81+
],
82+
)
83+
84+
py_proto_library(
85+
name = "audit_py_proto",
86+
deps = [":audit_moved_proto"],
87+
)
88+
89+
py_grpc_library(
90+
name = "audit_py_grpc",
91+
srcs = [":audit_moved_proto"],
92+
deps = [":audit_py_proto"],
93+
)
94+
95+
##############################################################################
96+
# PHP
97+
##############################################################################
98+
load(
99+
"@com_google_googleapis_imports//:imports.bzl",
100+
"php_grpc_library",
101+
"php_proto_library",
102+
)
103+
104+
php_proto_library(
105+
name = "audit_php_proto",
106+
deps = [":audit_proto"],
107+
)
108+
109+
php_grpc_library(
110+
name = "audit_php_grpc",
111+
srcs = [":audit_proto"],
112+
deps = [":audit_php_proto"],
113+
)
114+
115+
##############################################################################
116+
# Node.js
117+
##############################################################################
118+
load(
119+
"@com_google_googleapis_imports//:imports.bzl",
120+
"nodejs_gapic_assembly_pkg",
121+
"nodejs_gapic_library",
122+
)
123+
124+
125+
##############################################################################
126+
# Ruby
127+
##############################################################################
128+
load(
129+
"@com_google_googleapis_imports//:imports.bzl",
130+
"ruby_grpc_library",
131+
"ruby_proto_library",
132+
)
133+
134+
ruby_proto_library(
135+
name = "audit_ruby_proto",
136+
deps = [":audit_proto"],
137+
)
138+
139+
ruby_grpc_library(
140+
name = "audit_ruby_grpc",
141+
srcs = [":audit_proto"],
142+
deps = [":audit_ruby_proto"],
143+
)
144+
145+
##############################################################################
146+
# C#
147+
##############################################################################
148+
load(
149+
"@com_google_googleapis_imports//:imports.bzl",
150+
"csharp_grpc_library",
151+
"csharp_proto_library",
152+
)
153+
154+
csharp_proto_library(
155+
name = "audit_csharp_proto",
156+
deps = [":audit_proto"],
157+
)
158+
159+
csharp_grpc_library(
160+
name = "audit_csharp_grpc",
161+
srcs = [":audit_proto"],
162+
deps = [":audit_csharp_proto"],
163+
)
164+
165+
##############################################################################
166+
# C++
167+
##############################################################################
168+
# Put your C++ code here

‎google/cloud/audit/audit_log.proto‎

Lines changed: 146 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2016 Google Inc.
1+
// Copyright 2020 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -16,11 +16,12 @@ syntax = "proto3";
1616

1717
package google.cloud.audit;
1818

19-
import "google/api/annotations.proto";
2019
import "google/protobuf/any.proto";
2120
import "google/protobuf/struct.proto";
21+
import "google/rpc/context/attribute_context.proto";
2222
import "google/rpc/status.proto";
2323

24+
option cc_enable_arenas = true;
2425
option go_package = "google.golang.org/genproto/googleapis/cloud/audit;audit";
2526
option java_multiple_files = true;
2627
option java_outer_classname = "AuditLogProto";
@@ -48,6 +49,18 @@ message AuditLog {
4849
// "shelves/SHELF_ID/books/BOOK_ID"
4950
string resource_name = 11;
5051

52+
// The resource location information.
53+
ResourceLocation resource_location = 20;
54+
55+
// The resource's original state before mutation. Present only for
56+
// operations which have successfully modified the targeted resource(s).
57+
// In general, this field should contain all changed fields, except those
58+
// that are already been included in `request`, `response`, `metadata` or
59+
// `service_data` fields.
60+
// When the JSON object represented here has a proto equivalent,
61+
// the proto name will be indicated in the `@type` property.
62+
google.protobuf.Struct resource_original_state = 19;
63+
5164
// The number of items returned from a List or Query API method,
5265
// if applicable.
5366
int64 num_response_items = 12;
@@ -82,22 +95,58 @@ message AuditLog {
8295
// name will be indicated in the `@type` property.
8396
google.protobuf.Struct response = 17;
8497

98+
// Other service-specific data about the request, response, and other
99+
// information associated with the current audited event.
100+
google.protobuf.Struct metadata = 18;
101+
102+
// Deprecated, use `metadata` field instead.
85103
// Other service-specific data about the request, response, and other
86104
// activities.
87105
google.protobuf.Any service_data = 15;
88106
}
89107

90108
// Authentication information for the operation.
91109
message AuthenticationInfo {
92-
// The email address of the authenticated user making the request.
110+
// The email address of the authenticated user (or service account on behalf
111+
// of third party principal) making the request. For privacy reasons, the
112+
// principal email address is redacted for all read-only operations that fail
113+
// with a "permission denied" error.
93114
string principal_email = 1;
115+
116+
// The authority selector specified by the requestor, if any.
117+
// It is not guaranteed that the principal was allowed to use this authority.
118+
string authority_selector = 2;
119+
120+
// The third party identification (if any) of the authenticated user making
121+
// the request.
122+
// When the JSON object represented here has a proto equivalent, the proto
123+
// name will be indicated in the `@type` property.
124+
google.protobuf.Struct third_party_principal = 4;
125+
126+
// The name of the service account key used to create or exchange
127+
// credentials for authenticating the service account making the request.
128+
// This is a scheme-less URI full resource name. For example:
129+
//
130+
// "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}"
131+
string service_account_key_name = 5;
132+
133+
// Identity delegation history of an authenticated service account that makes
134+
// the request. It contains information on the real authorities that try to
135+
// access GCP resources by delegating on a service account. When multiple
136+
// authorities present, they are guaranteed to be sorted based on the original
137+
// ordering of the identity delegation events.
138+
repeated ServiceAccountDelegationInfo service_account_delegation_info = 6;
139+
140+
// String representation of identity of requesting party.
141+
// Populated for both first and third party identities.
142+
string principal_subject = 8;
94143
}
95144

96145
// Authorization information for the operation.
97146
message AuthorizationInfo {
98147
// The resource being accessed, as a REST-style string. For example:
99148
//
100-
// bigquery.googlapis.com/projects/PROJECTID/datasets/DATASETID
149+
// bigquery.googleapis.com/projects/PROJECTID/datasets/DATASETID
101150
string resource = 1;
102151

103152
// The required IAM permission.
@@ -106,11 +155,27 @@ message AuthorizationInfo {
106155
// Whether or not authorization for `resource` and `permission`
107156
// was granted.
108157
bool granted = 3;
158+
159+
// Resource attributes used in IAM condition evaluation. This field contains
160+
// resource attributes like resource type and resource name.
161+
//
162+
// To get the whole view of the attributes used in IAM
163+
// condition evaluation, the user must also look into
164+
// `AuditLog.request_metadata.request_attributes`.
165+
google.rpc.context.AttributeContext.Resource resource_attributes = 5;
109166
}
110167

111168
// Metadata about the request.
112169
message RequestMetadata {
113170
// The IP address of the caller.
171+
// For caller from internet, this will be public IPv4 or IPv6 address.
172+
// For caller from a Compute Engine VM with external IP address, this
173+
// will be the VM's external IP address. For caller from a Compute
174+
// Engine VM without external IP address, if the VM is in the same
175+
// organization (or project) as the accessed resource, `caller_ip` will
176+
// be the VM's internal IPv4 address, otherwise the `caller_ip` will be
177+
// redacted to "gce-internal-ip".
178+
// See https://cloud.google.com/compute/docs/vpc/ for more information.
114179
string caller_ip = 1;
115180

116181
// The user agent of the caller.
@@ -125,4 +190,81 @@ message RequestMetadata {
125190
// s~my-project`:
126191
// The request was made from the `my-project` App Engine app.
127192
string caller_supplied_user_agent = 2;
193+
194+
// The network of the caller.
195+
// Set only if the network host project is part of the same GCP organization
196+
// (or project) as the accessed resource.
197+
// See https://cloud.google.com/compute/docs/vpc/ for more information.
198+
// This is a scheme-less URI full resource name. For example:
199+
//
200+
// "//compute.googleapis.com/projects/PROJECT_ID/global/networks/NETWORK_ID"
201+
string caller_network = 3;
202+
203+
// Request attributes used in IAM condition evaluation. This field contains
204+
// request attributes like request time and access levels associated with
205+
// the request.
206+
//
207+
//
208+
// To get the whole view of the attributes used in IAM
209+
// condition evaluation, the user must also look into
210+
// `AuditLog.authentication_info.resource_attributes`.
211+
google.rpc.context.AttributeContext.Request request_attributes = 7;
212+
213+
// The destination of a network activity, such as accepting a TCP connection.
214+
// In a multi hop network activity, the destination represents the receiver of
215+
// the last hop. Only two fields are used in this message, Peer.port and
216+
// Peer.ip. These fields are optionally populated by those services utilizing
217+
// the IAM condition feature.
218+
google.rpc.context.AttributeContext.Peer destination_attributes = 8;
219+
}
220+
221+
// Location information about a resource.
222+
message ResourceLocation {
223+
// The locations of a resource after the execution of the operation.
224+
// Requests to create or delete a location based resource must populate
225+
// the 'current_locations' field and not the 'original_locations' field.
226+
// For example:
227+
//
228+
// "europe-west1-a"
229+
// "us-east1"
230+
// "nam3"
231+
repeated string current_locations = 1;
232+
233+
// The locations of a resource prior to the execution of the operation.
234+
// Requests that mutate the resource's location must populate both the
235+
// 'original_locations' as well as the 'current_locations' fields.
236+
// For example:
237+
//
238+
// "europe-west1-a"
239+
// "us-east1"
240+
// "nam3"
241+
repeated string original_locations = 2;
242+
}
243+
244+
// Identity delegation history of an authenticated service account.
245+
message ServiceAccountDelegationInfo {
246+
// First party identity principal.
247+
message FirstPartyPrincipal {
248+
// The email address of a Google account.
249+
string principal_email = 1;
250+
251+
// Metadata about the service that uses the service account.
252+
google.protobuf.Struct service_metadata = 2;
253+
}
254+
255+
// Third party identity principal.
256+
message ThirdPartyPrincipal {
257+
// Metadata about third party identity.
258+
google.protobuf.Struct third_party_claims = 1;
259+
}
260+
261+
// Entity that creates credentials for service account and assumes its
262+
// identity for authentication.
263+
oneof Authority {
264+
// First party (Google) identity as the real authority.
265+
FirstPartyPrincipal first_party_principal = 1;
266+
267+
// Third party identity as the real authority.
268+
ThirdPartyPrincipal third_party_principal = 2;
269+
}
128270
}

‎google/cloud/audit/cloudaudit.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
type: google.api.Service
2+
config_version: 2
3+
name: cloudaudit.googleapis.com
4+
title: Audit Log
5+
6+
types:
7+
- name: google.cloud.audit.AuditLog

0 commit comments

Comments
 (0)