Acknowledges an existing violation. By acknowledging a violation, users acknowledge the existence of a compliance violation in their workload and decide to ignore it due to a valid business justification. Acknowledgement is a permanent operation and it cannot be reverted.

Lists the Violations in the AssuredWorkload Environment. Callers may also choose to read across multiple Workloads as per [AIP-159](https://google.aip.dev/159) by using '-' (the hyphen or dash character) as a wildcard character instead of workload-id in the parent. Format `organizations/{org_id}/locations/{location}/workloads/-`

Method Details

acknowledge(name, body=None, x__xgafv=None)

Acknowledges an existing violation. By acknowledging a violation, users acknowledge the existence of a compliance violation in their workload and decide to ignore it due to a valid business justification. Acknowledgement is a permanent operation and it cannot be reverted.

Args:
  name: string, Required. The resource name of the violation to acknowledge. Format: `organizations/{organization}/locations/{location}/workloads/{workload}/violations/{violation}` (required)
  body: object, The request body.
    The object takes the form of:

{ # Request message for acknowledging a violation.
  "acknowledgeType": "A String", # Optional. The scope of the acknowledgement for the specified violation. If not specified, `SINGLE_VIOLATION` is used.
  "comment": "A String", # Required. The business justification for acknowledging the violation. The comment can't be empty or contain only whitespace characters.
  "nonCompliantOrgPolicy": "A String", # Optional. Deprecated: This field is deprecated and will be removed in a future version of the API. The service identifies the violation to acknowledge by `name`, and ignores this field. Don't set this field. The name of the organization policy that was modified with a non-compliant change and resulted in this violation. Formats: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}`
  "view": "A String", # Optional. The violation view (`VIOLATION_VIEW_ASSURED_WORKLOADS` or `VIOLATION_VIEW_DATA_BOUNDARY`) that the violation belongs to. If not specified, `VIOLATION_VIEW_ASSURED_WORKLOADS` is used.
}

  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # Response message for acknowledging a violation. This message is empty.
}

close()

Close httplib2 connections.

get(name, view=None, x__xgafv=None)

Retrieves an Assured Workloads violation by its resource name.

Args:
name: string, Required. The resource name of the violation to retrieve (that is, the value of `Violation.name`). Format: `organizations/{organization}/locations/{location}/workloads/{workload}/violations/{violation}` (required)
view: string, Optional. The violation view (`VIOLATION_VIEW_ASSURED_WORKLOADS` or `VIOLATION_VIEW_DATA_BOUNDARY`) that the violation belongs to. If not specified, `VIOLATION_VIEW_ASSURED_WORKLOADS` is used.
Allowed values
VIOLATION_VIEW_UNSPECIFIED - Defaults to the ASSURED_WORKLOADS view.
VIOLATION_VIEW_ASSURED_WORKLOADS - Includes the basic metadata about the violation.
VIOLATION_VIEW_DATA_BOUNDARY - Includes all information about the violation, including details about the data boundary.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format

Returns:
An object of the form:

{ # A compliance violation that's detected by Assured Workloads monitoring. A violation is created when an organization policy or a resource in a workload (or a Data Boundary scope) changes in a way that doesn't comply with the controls of the applicable compliance regime or framework.
"acknowledged": True or False, # Whether the violation has been acknowledged.
"acknowledgementTime": "A String", # Optional. The time when the violation was first acknowledged. To find the most recent time that the violation was acknowledged, check `exception_contexts`. This field is absent when `acknowledged` is `false`.
"affectedFrameworks": [ # Output only. The IDs of the compliance frameworks that are affected by this violation. For example, `builtin-fedramp-high`. This field is only populated when using `VIOLATION_VIEW_DATA_BOUNDARY`.
"A String",
],
"associatedOrgPolicyViolationId": "A String", # Optional. Output only. For resource violations, the ID of the organization policy violation that caused this resource violation. This field is empty for organization policy violations.
"auditLogLink": "A String", # Output only. Immutable. A link to the Cloud Audit Logs entries for the violated resource. Format: `https://console.cloud.google.com/logs/query;query={logName}{protoPayload.resourceName}{timeRange}{folder}`
"beginTime": "A String", # Output only. The time of the event that triggered the violation.
"category": "A String", # Output only. The category that the violation is mapped to. For example, `Location`, `Service Usage`, `Access`, or `Encryption`.
"childResourceViolationCount": 42, # Optional. Output only. For organization policy violations, the number of resource violations that are associated with this violation. This field is `0` for resource violations.
"description": "A String", # Output only. A description of the violation. For example, `OrgPolicy gcp.resourceLocations has non compliant value.`
"exceptionAuditLogLink": "A String", # Output only. Immutable. A link to the Cloud Audit Logs entries that contain the business justification that was provided when the violation was acknowledged. Format: `https://console.cloud.google.com/logs/query;query={logName}{protoPayload.resourceName}{protoPayload.methodName}{timeRange}{organization}`
"exceptionContexts": [ # Output only. The details of all of the acknowledgements (exceptions) for the violation.
{ # Details about an acknowledgement (exception) of a violation.
"acknowledgementTime": "A String", # The time when the violation was acknowledged.
"comment": "A String", # The business justification that was provided when the violation was acknowledged.
"userName": "A String", # The name of the user (or service account) who acknowledged the violation.
},
],
"name": "A String", # Output only. Immutable. The resource name of the violation. Format: `organizations/{organization}/locations/{location}/workloads/{workload_id}/violations/{violations_id}`
"nonCompliantOrgPolicy": "A String", # Output only. Immutable. The name of the organization policy that was modified with a non-compliant change and resulted in this violation. Formats: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}`
"orgPolicyConstraint": "A String", # Output only. Immutable. Deprecated: This field is deprecated and might be removed in a future version of the API. Use `non_compliant_org_policy` instead, which contains the full resource name of the organization policy, including the constraint name. The organization policy constraint that was changed in a non-compliant way, which resulted in this violation.
"parentProjectNumber": "A String", # Optional. Output only. For resource violations, the number of the project that contains the non-compliant resource. This field is empty for organization policy violations.
"remediation": { # Remediation guidance to resolve a compliance violation. # Output only. The remediation guidance for the violation.
"compliantValues": [ # The values that can resolve the violation. For example, for list organization policy violations, this field contains the list of allowed or denied values.
"A String",
],
"instructions": { # Instructions to remediate a violation. # Required. The instructions to resolve the violation.
"consoleInstructions": { # Instructions to remediate a violation by using the Google Cloud console. # Instructions to resolve the violation by using the Google Cloud console.
"additionalLinks": [ # Additional URLs with more information about the steps.
"A String",
],
"consoleUris": [ # Links to the Google Cloud console pages where the violation can be resolved.
"A String",
],
"steps": [ # The steps to resolve the violation by using the Google Cloud console.
"A String",
],
},
"gcloudInstructions": { # Instructions to remediate a violation by using the Google Cloud CLI. # Instructions to resolve the violation by using the gcloud CLI.
"additionalLinks": [ # Additional URLs with more information about the steps.
"A String",
],
"gcloudCommands": [ # The gcloud CLI commands that resolve the violation.
"A String",
],
"steps": [ # The steps to resolve the violation by using the gcloud CLI.
"A String",
],
},
},
"remediationType": "A String", # Output only. The remediation type, which is based on the type of organization policy values that were violated.
},
"remediationMarkdown": "A String", # Output only. The remediation instructions for the violation, in Markdown format. This field is only populated by `GetViolation` when using `VIOLATION_VIEW_DATA_BOUNDARY`. When this field isn't populated, see `remediation` instead.
"resolveTime": "A String", # Output only. The time of the event that resolved the violation. This field is empty if the violation is unresolved.
"resourceName": "A String", # Optional. Output only. For resource violations, the full resource name of the non-compliant resource. For example, `//storage.googleapis.com/myprojectxyz-testbucket`. This field is empty for organization policy violations.
"resourceType": "A String", # Optional. Output only. For resource violations, the type of the non-compliant resource. For example, `compute.googleapis.com/Disk`. This field is empty for organization policy violations.
"state": "A String", # Output only. The state of the violation.
"updateTime": "A String", # Output only. The time when the violation record was last updated.
"violationType": "A String", # Output only. The type of the violation.
}

list(parent, filter=None, interval_endTime=None, interval_startTime=None, orderBy=None, pageSize=None, pageToken=None, view=None, x__xgafv=None)

Args:
parent: string, Required. The workload to list violations for. To list violations across all workloads in an organization, use `-` as the workload ID. When `view` is `VIOLATION_VIEW_DATA_BOUNDARY`, violations are listed for the entire organization and location, and the workload ID is ignored. Format: `organizations/{organization}/locations/{location}/workloads/{workload}` (required)
filter: string, Optional. A filter expression that restricts the violations that are returned. The syntax follows [AIP-160](https://google.aip.dev/160). Only the equality operator (`=`) is supported, and expressions can be combined with `AND`, `OR`, and `NOT`. When `view` is `VIOLATION_VIEW_DATA_BOUNDARY`, the following fields are supported: `violationId`, `category`, `state` (`UNRESOLVED`, `RESOLVED`, or `EXCEPTION`), `violationType` (`ORG_POLICY` or `RESOURCE`), `resourceType`, `resourceName`, `project`, `associatedOrgPolicyViolationId`, `cloudControlName`, `workloadDisplayName`, and `complianceType` (a framework ID). Example: `state = "UNRESOLVED" AND complianceType = "builtin-fedramp-high"`
interval_endTime: string, The end of the time window.
interval_startTime: string, The start of the time window.
orderBy: string, Optional. A comma-separated list of fields to sort the results by. The default sort order is ascending; to sort in descending order, append ` desc` to the field name. For example, `update_time desc,category`. When `view` is `VIOLATION_VIEW_DATA_BOUNDARY`, the following fields are supported: `begin_time`, `update_time`, `resource_type`, `state`, and `category`. If not specified, results are sorted by `begin_time` in descending order.
pageSize: integer, Optional. The maximum number of violations to return. The service might return fewer violations than this value. If unspecified, at most 100 violations are returned. The maximum value is 1000; values above 1000 are coerced to 1000.
pageToken: string, Optional. A page token, received from a previous `ListViolations` call. Provide this token to retrieve the subsequent page. When paginating, all other parameters that are provided to `ListViolations` must match the call that provided the page token.
view: string, Optional. The violation view (`VIOLATION_VIEW_ASSURED_WORKLOADS` or `VIOLATION_VIEW_DATA_BOUNDARY`) to list violations for. If not specified, `VIOLATION_VIEW_ASSURED_WORKLOADS` is used.
Allowed values
VIOLATION_VIEW_UNSPECIFIED - Defaults to the ASSURED_WORKLOADS view.
VIOLATION_VIEW_ASSURED_WORKLOADS - Includes the basic metadata about the violation.
VIOLATION_VIEW_DATA_BOUNDARY - Includes all information about the violation, including details about the data boundary.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format

Returns:
An object of the form:

{ # Response message for the `ListViolations` method.
"nextPageToken": "A String", # A token that can be sent as `page_token` to retrieve the next page. If this field is empty, there are no subsequent pages.
"totalSize": 42, # The total number of violations that match the request, across all pages. This field might not be populated for all requests; when it's not populated, its value is `0`.
"violations": [ # The list of violations.
{ # A compliance violation that's detected by Assured Workloads monitoring. A violation is created when an organization policy or a resource in a workload (or a Data Boundary scope) changes in a way that doesn't comply with the controls of the applicable compliance regime or framework.
"acknowledged": True or False, # Whether the violation has been acknowledged.
"acknowledgementTime": "A String", # Optional. The time when the violation was first acknowledged. To find the most recent time that the violation was acknowledged, check `exception_contexts`. This field is absent when `acknowledged` is `false`.
"affectedFrameworks": [ # Output only. The IDs of the compliance frameworks that are affected by this violation. For example, `builtin-fedramp-high`. This field is only populated when using `VIOLATION_VIEW_DATA_BOUNDARY`.
"A String",
],
"associatedOrgPolicyViolationId": "A String", # Optional. Output only. For resource violations, the ID of the organization policy violation that caused this resource violation. This field is empty for organization policy violations.
"auditLogLink": "A String", # Output only. Immutable. A link to the Cloud Audit Logs entries for the violated resource. Format: `https://console.cloud.google.com/logs/query;query={logName}{protoPayload.resourceName}{timeRange}{folder}`
"beginTime": "A String", # Output only. The time of the event that triggered the violation.
"category": "A String", # Output only. The category that the violation is mapped to. For example, `Location`, `Service Usage`, `Access`, or `Encryption`.
"childResourceViolationCount": 42, # Optional. Output only. For organization policy violations, the number of resource violations that are associated with this violation. This field is `0` for resource violations.
"description": "A String", # Output only. A description of the violation. For example, `OrgPolicy gcp.resourceLocations has non compliant value.`
"exceptionAuditLogLink": "A String", # Output only. Immutable. A link to the Cloud Audit Logs entries that contain the business justification that was provided when the violation was acknowledged. Format: `https://console.cloud.google.com/logs/query;query={logName}{protoPayload.resourceName}{protoPayload.methodName}{timeRange}{organization}`
"exceptionContexts": [ # Output only. The details of all of the acknowledgements (exceptions) for the violation.
{ # Details about an acknowledgement (exception) of a violation.
"acknowledgementTime": "A String", # The time when the violation was acknowledged.
"comment": "A String", # The business justification that was provided when the violation was acknowledged.
"userName": "A String", # The name of the user (or service account) who acknowledged the violation.
},
],
"name": "A String", # Output only. Immutable. The resource name of the violation. Format: `organizations/{organization}/locations/{location}/workloads/{workload_id}/violations/{violations_id}`
"nonCompliantOrgPolicy": "A String", # Output only. Immutable. The name of the organization policy that was modified with a non-compliant change and resulted in this violation. Formats: * `projects/{project_number}/policies/{constraint_name}` * `folders/{folder_id}/policies/{constraint_name}` * `organizations/{organization_id}/policies/{constraint_name}`
"orgPolicyConstraint": "A String", # Output only. Immutable. Deprecated: This field is deprecated and might be removed in a future version of the API. Use `non_compliant_org_policy` instead, which contains the full resource name of the organization policy, including the constraint name. The organization policy constraint that was changed in a non-compliant way, which resulted in this violation.
"parentProjectNumber": "A String", # Optional. Output only. For resource violations, the number of the project that contains the non-compliant resource. This field is empty for organization policy violations.
"remediation": { # Remediation guidance to resolve a compliance violation. # Output only. The remediation guidance for the violation.
"compliantValues": [ # The values that can resolve the violation. For example, for list organization policy violations, this field contains the list of allowed or denied values.
"A String",
],
"instructions": { # Instructions to remediate a violation. # Required. The instructions to resolve the violation.
"consoleInstructions": { # Instructions to remediate a violation by using the Google Cloud console. # Instructions to resolve the violation by using the Google Cloud console.
"additionalLinks": [ # Additional URLs with more information about the steps.
"A String",
],
"consoleUris": [ # Links to the Google Cloud console pages where the violation can be resolved.
"A String",
],
"steps": [ # The steps to resolve the violation by using the Google Cloud console.
"A String",
],
},
"gcloudInstructions": { # Instructions to remediate a violation by using the Google Cloud CLI. # Instructions to resolve the violation by using the gcloud CLI.
"additionalLinks": [ # Additional URLs with more information about the steps.
"A String",
],
"gcloudCommands": [ # The gcloud CLI commands that resolve the violation.
"A String",
],
"steps": [ # The steps to resolve the violation by using the gcloud CLI.
"A String",
],
},
},
"remediationType": "A String", # Output only. The remediation type, which is based on the type of organization policy values that were violated.
},
"remediationMarkdown": "A String", # Output only. The remediation instructions for the violation, in Markdown format. This field is only populated by `GetViolation` when using `VIOLATION_VIEW_DATA_BOUNDARY`. When this field isn't populated, see `remediation` instead.
"resolveTime": "A String", # Output only. The time of the event that resolved the violation. This field is empty if the violation is unresolved.
"resourceName": "A String", # Optional. Output only. For resource violations, the full resource name of the non-compliant resource. For example, `//storage.googleapis.com/myprojectxyz-testbucket`. This field is empty for organization policy violations.
"resourceType": "A String", # Optional. Output only. For resource violations, the type of the non-compliant resource. For example, `compute.googleapis.com/Disk`. This field is empty for organization policy violations.
"state": "A String", # Output only. The state of the violation.
"updateTime": "A String", # Output only. The time when the violation record was last updated.
"violationType": "A String", # Output only. The type of the violation.
},
],
}

Assured Workloads API . organizations . locations . workloads . violations

Instance Methods

Method Details