Deletes all revisions of a Posture. You can only delete a posture if none of its revisions are deployed.

Extracts existing policies from an organization, folder, or project, and applies them to another organization, folder, or project as a Posture. If the other organization, folder, or project already has a posture, then the result of the long-running operation is an ALREADY_EXISTS error.

Lists the most recent revisions of all Posture resources in a specified organization and location.

Updates a revision of an existing Posture. If the posture revision that you update is currently deployed, then a new revision of the posture is created. To prevent concurrent updates from overwriting each other, always follow the read-modify-write pattern when you update a posture: 1. Call GetPosture to get the current version of the posture. 2. Update the fields in the posture as needed. 3. Call UpdatePosture to update the posture. Ensure that your request includes the `etag` value from the GetPosture response. **Important:** If you omit the `etag` when you call UpdatePosture, then the updated posture unconditionally overwrites the existing posture.

Method Details

close()

Close httplib2 connections.

create(parent, body=None, postureId=None, x__xgafv=None)

Creates a new Posture.

Args:
  parent: string, Required. The parent resource name, in the format `organizations/{organization}/locations/global`. (required)
  body: object, The request body.
    The object takes the form of:

{ # The details of a posture.
  "annotations": { # Optional. The user-specified annotations for the posture. For details about the values you can use in an annotation, see [AIP-148: Standard fields](https://google.aip.dev/148#annotations).
    "a_key": "A String",
  },
  "categories": [ # Output only. The categories that the posture belongs to, as determined by the Security Posture API.
    "A String",
  ],
  "createTime": "A String", # Output only. The time at which the posture was created.
  "description": "A String", # Optional. A description of the posture.
  "etag": "A String", # Optional. An opaque identifier for the current version of the posture at the specified `revision_id`. To prevent concurrent updates from overwriting each other, always provide the `etag` when you update a posture. You can also provide the `etag` when you delete a posture, to help ensure that you're deleting the intended version of the posture.
  "name": "A String", # Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
  "policySets": [ # Required. The PolicySet resources that the posture includes.
    { # A group of one or more Policy resources.
      "description": "A String", # Optional. A description of the policy set.
      "policies": [ # Required. The Policy resources in the policy set. Each policy must have a policy_id that's unique within the policy set.
        { # The details of a policy, including the constraints that it includes.
          "complianceStandards": [ # Optional. The compliance standards that the policy helps enforce.
            { # Information about a compliance standard that the policy helps enforce.
              "control": "A String", # Optional. The control in the compliance standard that the policy helps enforce. For example, `AC-3`.
              "standard": "A String", # Optional. The compliance standard that the policy helps enforce. For example, `NIST SP 800-53`.
            },
          ],
          "constraint": { # Metadata for a constraint in a Policy. # Required. The constraints that the policy includes.
            "orgPolicyConstraint": { # A predefined organization policy constraint. # Optional. A predefined organization policy constraint.
              "cannedConstraintId": "A String", # Required. A unique identifier for the constraint.
              "policyRules": [ # Required. The rules enforced by the constraint.
                { # A rule that defines the allowed and denied values for an organization policy constraint.
                  "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                  "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                    "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                    "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                    "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                    "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                  },
                  "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                  "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                  "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                    "a_key": "", # Properties of the object.
                  },
                  "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                    "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                      "A String",
                    ],
                  },
                  "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                    "allowedValues": [ # The allowed values for the constraint.
                      "A String",
                    ],
                    "deniedValues": [ # The denied values for the constraint.
                      "A String",
                    ],
                  },
                },
              ],
            },
            "orgPolicyConstraintCustom": { # A custom organization policy constraint. # Optional. A custom organization policy constraint.
              "customConstraint": { # A custom, user-defined constraint. You can apply the constraint only to the resource types specified in the constraint, and only within the organization where the constraint is defined. _When you create a custom constraint, it is not enforced automatically._ You must use an organization policy to [enforce the constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce). # Required. Metadata for the constraint.
                "actionType": "A String", # Whether to allow or deny the action.
                "condition": "A String", # A Common Expression Language (CEL) condition expression that must evaluate to `true` for the constraint to be enforced. The maximum length is 1000 characters. For example: + `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates to `true` if the resource's `instanceName` attribute contains the following: + The prefix `production` or `test` + An underscore (`_`) + Optional: One or more characters, followed by an underscore (`_`) + One or more digits + `resource.management.auto_upgrade == true`: Evaluates to `true` if the resource's `management.auto_upgrade` attribute is `true`.
                "description": "A String", # A description of the constraint. The maximum length is 2000 characters.
                "displayName": "A String", # A display name for the constraint. The maximum length is 200 characters.
                "methodTypes": [ # The types of operations that the constraint applies to.
                  "A String",
                ],
                "name": "A String", # Immutable. The name of the constraint, in the format `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`. For example, `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`. Must contain 1 to 62 characters, excluding the prefix `organizations/{organization_id}/customConstraints/custom.`.
                "resourceTypes": [ # Immutable. The resource type that the constraint applies to, in the format `{canonical_service_name}/{resource_type_name}`. For example, `compute.googleapis.com/Instance`.
                  "A String",
                ],
                "updateTime": "A String", # Output only. The last time at which the constraint was updated or created.
              },
              "policyRules": [ # Required. The rules enforced by the constraint.
                { # A rule that defines the allowed and denied values for an organization policy constraint.
                  "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                  "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                    "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                    "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                    "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                    "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                  },
                  "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                  "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                  "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                    "a_key": "", # Properties of the object.
                  },
                  "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                    "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                      "A String",
                    ],
                  },
                  "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                    "allowedValues": [ # The allowed values for the constraint.
                      "A String",
                    ],
                    "deniedValues": [ # The denied values for the constraint.
                      "A String",
                    ],
                  },
                },
              ],
            },
            "securityHealthAnalyticsCustomModule": { # A custom module for Security Health Analytics. # Optional. A custom module for Security Health Analytics.
              "config": { # A custom module configuration for Security Health Analytics. Use `CustomConfig` to create custom detectors that generate custom findings for resources that you specify. # Required. Configuration settings for the custom module.
                "customOutput": { # Definitions of custom source properties that can appear in findings. # Optional. Definitions of custom source properties to include in findings.
                  "properties": [ # Optional. The custom source properties that can appear in findings.
                    { # A name-value pair used as a custom source property.
                      "name": "A String", # Required. The name of the custom source property.
                      "valueExpression": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Optional. The CEL expression for the value of the custom source property. For resource properties, you can return the value of the property or a string enclosed in quotation marks.
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                    },
                  ],
                },
                "description": "A String", # Optional. A description of the vulnerability or misconfiguration that the custom module detects. The description appears in each finding. Provide enough information to help an investigator understand the finding. The value must be enclosed in quotation marks.
                "predicate": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Required. The Common Expression Language (CEL) expression to evaluate. When the expression evaluates to `true` for a resource, a finding is generated.
                  "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                  "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                  "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                  "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                },
                "recommendation": "A String", # Required. An explanation of the steps that security teams can take to resolve the detected issue. The explanation appears in each finding.
                "resourceSelector": { # A selector for the resource types to run the detector on. # Required. The resource types that the custom module operates on.
                  "resourceTypes": [ # Required. The resource types to run the detector on. Each custom module can specify up to 5 resource types.
                    "A String",
                  ],
                },
                "severity": "A String", # Required. The severity of findings generated by the custom module.
              },
              "displayName": "A String", # Optional. The display name of the custom module. This value is used as the finding category for all the asset violation findings that the custom module returns. The display name must contain between 1 and 128 alphanumeric characters or underscores, and it must start with a lowercase letter.
              "id": "A String", # Output only. Immutable. The unique identifier for the custom module. Contains 1 to 20 digits.
              "moduleEnablementState": "A String", # Whether the custom module is enabled at a specified level of the resource hierarchy.
            },
            "securityHealthAnalyticsModule": { # A built-in detector for Security Health Analytics. # Optional. A built-in detector for Security Health Analytics.
              "moduleEnablementState": "A String", # Whether the detector is enabled at a specified level of the resource hierarchy.
              "moduleName": "A String", # Required. The name of the detector. For example, `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding category for all the asset violation findings that the detector returns.
            },
          },
          "description": "A String", # Optional. A description of the policy.
          "policyId": "A String", # Required. A user-specified identifier for the policy. In a PolicySet, each policy must have a unique identifier.
        },
      ],
      "policySetId": "A String", # Required. An identifier for the policy set.
    },
  ],
  "reconciling": True or False, # Output only. Whether the posture is in the process of being updated.
  "revisionId": "A String", # Output only. Immutable. An opaque eight-character string that identifies the revision of the posture. A posture can have multiple revisions; when you deploy a posture, you deploy a specific revision of the posture.
  "state": "A String", # Required. The state of the posture at the specified `revision_id`.
  "updateTime": "A String", # Output only. The time at which the posture was last updated.
}

  postureId: string, Required. An identifier for the posture.
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # This resource represents a long-running operation that is the result of a network API call.
  "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
  "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
    "code": 42, # The status code, which should be an enum value of google.rpc.Code.
    "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
      {
        "a_key": "", # Properties of the object. Contains field @type with type URL.
      },
    ],
    "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
  },
  "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
    "a_key": "", # Properties of the object. Contains field @type with type URL.
  },
  "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
  "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
    "a_key": "", # Properties of the object. Contains field @type with type URL.
  },
}

delete(name, etag=None, x__xgafv=None)

Deletes all revisions of a Posture. You can only delete a posture if none of its revisions are deployed.

Args:
name: string, Required. The name of the Posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`. (required)
etag: string, Optional. An opaque identifier for the current version of the posture. If you provide this value, then it must match the existing value. If the values don't match, then the request fails with an ABORTED error. If you omit this value, then the posture is deleted regardless of its current `etag` value.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format

Returns:
An object of the form:

{ # This resource represents a long-running operation that is the result of a network API call.
"done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
"error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
"code": 42, # The status code, which should be an enum value of google.rpc.Code.
"details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
{
"a_key": "", # Properties of the object. Contains field @type with type URL.
},
],
"message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
},
"metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
"a_key": "", # Properties of the object. Contains field @type with type URL.
},
"name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
"response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
"a_key": "", # Properties of the object. Contains field @type with type URL.
},
}

extract(parent, body=None, x__xgafv=None)

Args:
parent: string, Required. The parent resource name, in the format `organizations/{organization}/locations/global`. (required)
body: object, The request body.
The object takes the form of:

{ # Request message for ExtractPosture.
"postureId": "A String", # Required. An identifier for the posture.
"workload": "A String", # Required. The organization, folder, or project from which policies are extracted. Must be within the organization defined in parent. Use one of the following formats: * `organization/{organization_number}` * `folder/{folder_number}` * `project/{project_number}`
}

x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format

Returns:
An object of the form:

get(name, revisionId=None, x__xgafv=None)

Gets a single revision of a Posture.

Args:
  name: string, Required. The name of the Posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`. (required)
  revisionId: string, Optional. The posture revision to retrieve. If not specified, the most recently updated revision is retrieved.
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # The details of a posture.
  "annotations": { # Optional. The user-specified annotations for the posture. For details about the values you can use in an annotation, see [AIP-148: Standard fields](https://google.aip.dev/148#annotations).
    "a_key": "A String",
  },
  "categories": [ # Output only. The categories that the posture belongs to, as determined by the Security Posture API.
    "A String",
  ],
  "createTime": "A String", # Output only. The time at which the posture was created.
  "description": "A String", # Optional. A description of the posture.
  "etag": "A String", # Optional. An opaque identifier for the current version of the posture at the specified `revision_id`. To prevent concurrent updates from overwriting each other, always provide the `etag` when you update a posture. You can also provide the `etag` when you delete a posture, to help ensure that you're deleting the intended version of the posture.
  "name": "A String", # Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
  "policySets": [ # Required. The PolicySet resources that the posture includes.
    { # A group of one or more Policy resources.
      "description": "A String", # Optional. A description of the policy set.
      "policies": [ # Required. The Policy resources in the policy set. Each policy must have a policy_id that's unique within the policy set.
        { # The details of a policy, including the constraints that it includes.
          "complianceStandards": [ # Optional. The compliance standards that the policy helps enforce.
            { # Information about a compliance standard that the policy helps enforce.
              "control": "A String", # Optional. The control in the compliance standard that the policy helps enforce. For example, `AC-3`.
              "standard": "A String", # Optional. The compliance standard that the policy helps enforce. For example, `NIST SP 800-53`.
            },
          ],
          "constraint": { # Metadata for a constraint in a Policy. # Required. The constraints that the policy includes.
            "orgPolicyConstraint": { # A predefined organization policy constraint. # Optional. A predefined organization policy constraint.
              "cannedConstraintId": "A String", # Required. A unique identifier for the constraint.
              "policyRules": [ # Required. The rules enforced by the constraint.
                { # A rule that defines the allowed and denied values for an organization policy constraint.
                  "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                  "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                    "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                    "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                    "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                    "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                  },
                  "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                  "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                  "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                    "a_key": "", # Properties of the object.
                  },
                  "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                    "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                      "A String",
                    ],
                  },
                  "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                    "allowedValues": [ # The allowed values for the constraint.
                      "A String",
                    ],
                    "deniedValues": [ # The denied values for the constraint.
                      "A String",
                    ],
                  },
                },
              ],
            },
            "orgPolicyConstraintCustom": { # A custom organization policy constraint. # Optional. A custom organization policy constraint.
              "customConstraint": { # A custom, user-defined constraint. You can apply the constraint only to the resource types specified in the constraint, and only within the organization where the constraint is defined. _When you create a custom constraint, it is not enforced automatically._ You must use an organization policy to [enforce the constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce). # Required. Metadata for the constraint.
                "actionType": "A String", # Whether to allow or deny the action.
                "condition": "A String", # A Common Expression Language (CEL) condition expression that must evaluate to `true` for the constraint to be enforced. The maximum length is 1000 characters. For example: + `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates to `true` if the resource's `instanceName` attribute contains the following: + The prefix `production` or `test` + An underscore (`_`) + Optional: One or more characters, followed by an underscore (`_`) + One or more digits + `resource.management.auto_upgrade == true`: Evaluates to `true` if the resource's `management.auto_upgrade` attribute is `true`.
                "description": "A String", # A description of the constraint. The maximum length is 2000 characters.
                "displayName": "A String", # A display name for the constraint. The maximum length is 200 characters.
                "methodTypes": [ # The types of operations that the constraint applies to.
                  "A String",
                ],
                "name": "A String", # Immutable. The name of the constraint, in the format `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`. For example, `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`. Must contain 1 to 62 characters, excluding the prefix `organizations/{organization_id}/customConstraints/custom.`.
                "resourceTypes": [ # Immutable. The resource type that the constraint applies to, in the format `{canonical_service_name}/{resource_type_name}`. For example, `compute.googleapis.com/Instance`.
                  "A String",
                ],
                "updateTime": "A String", # Output only. The last time at which the constraint was updated or created.
              },
              "policyRules": [ # Required. The rules enforced by the constraint.
                { # A rule that defines the allowed and denied values for an organization policy constraint.
                  "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                  "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                    "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                    "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                    "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                    "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                  },
                  "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                  "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                  "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                    "a_key": "", # Properties of the object.
                  },
                  "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                    "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                      "A String",
                    ],
                  },
                  "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                    "allowedValues": [ # The allowed values for the constraint.
                      "A String",
                    ],
                    "deniedValues": [ # The denied values for the constraint.
                      "A String",
                    ],
                  },
                },
              ],
            },
            "securityHealthAnalyticsCustomModule": { # A custom module for Security Health Analytics. # Optional. A custom module for Security Health Analytics.
              "config": { # A custom module configuration for Security Health Analytics. Use `CustomConfig` to create custom detectors that generate custom findings for resources that you specify. # Required. Configuration settings for the custom module.
                "customOutput": { # Definitions of custom source properties that can appear in findings. # Optional. Definitions of custom source properties to include in findings.
                  "properties": [ # Optional. The custom source properties that can appear in findings.
                    { # A name-value pair used as a custom source property.
                      "name": "A String", # Required. The name of the custom source property.
                      "valueExpression": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Optional. The CEL expression for the value of the custom source property. For resource properties, you can return the value of the property or a string enclosed in quotation marks.
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                    },
                  ],
                },
                "description": "A String", # Optional. A description of the vulnerability or misconfiguration that the custom module detects. The description appears in each finding. Provide enough information to help an investigator understand the finding. The value must be enclosed in quotation marks.
                "predicate": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Required. The Common Expression Language (CEL) expression to evaluate. When the expression evaluates to `true` for a resource, a finding is generated.
                  "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                  "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                  "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                  "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                },
                "recommendation": "A String", # Required. An explanation of the steps that security teams can take to resolve the detected issue. The explanation appears in each finding.
                "resourceSelector": { # A selector for the resource types to run the detector on. # Required. The resource types that the custom module operates on.
                  "resourceTypes": [ # Required. The resource types to run the detector on. Each custom module can specify up to 5 resource types.
                    "A String",
                  ],
                },
                "severity": "A String", # Required. The severity of findings generated by the custom module.
              },
              "displayName": "A String", # Optional. The display name of the custom module. This value is used as the finding category for all the asset violation findings that the custom module returns. The display name must contain between 1 and 128 alphanumeric characters or underscores, and it must start with a lowercase letter.
              "id": "A String", # Output only. Immutable. The unique identifier for the custom module. Contains 1 to 20 digits.
              "moduleEnablementState": "A String", # Whether the custom module is enabled at a specified level of the resource hierarchy.
            },
            "securityHealthAnalyticsModule": { # A built-in detector for Security Health Analytics. # Optional. A built-in detector for Security Health Analytics.
              "moduleEnablementState": "A String", # Whether the detector is enabled at a specified level of the resource hierarchy.
              "moduleName": "A String", # Required. The name of the detector. For example, `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding category for all the asset violation findings that the detector returns.
            },
          },
          "description": "A String", # Optional. A description of the policy.
          "policyId": "A String", # Required. A user-specified identifier for the policy. In a PolicySet, each policy must have a unique identifier.
        },
      ],
      "policySetId": "A String", # Required. An identifier for the policy set.
    },
  ],
  "reconciling": True or False, # Output only. Whether the posture is in the process of being updated.
  "revisionId": "A String", # Output only. Immutable. An opaque eight-character string that identifies the revision of the posture. A posture can have multiple revisions; when you deploy a posture, you deploy a specific revision of the posture.
  "state": "A String", # Required. The state of the posture at the specified `revision_id`.
  "updateTime": "A String", # Output only. The time at which the posture was last updated.
}

list(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)

Lists the most recent revisions of all Posture resources in a specified organization and location.

Args:
  parent: string, Required. The parent resource name, in the format `organizations/{organization}/locations/global`. (required)
  filter: string, Optional. A filter to apply to the list of postures, in the format defined in [AIP-160: Filtering](https://google.aip.dev/160).
  pageSize: integer, The maximum number of postures to return. The default value is `500`. If you exceed the maximum value of `1000`, then the service uses the maximum value.
  pageToken: string, A pagination token returned from a previous request to list postures. Provide this token to retrieve the next page of results.
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # Response message for ListPostures.
  "nextPageToken": "A String", # A pagination token. To retrieve the next page of results, call the method again with this token.
  "postures": [ # The list of Posture resources.
    { # The details of a posture.
      "annotations": { # Optional. The user-specified annotations for the posture. For details about the values you can use in an annotation, see [AIP-148: Standard fields](https://google.aip.dev/148#annotations).
        "a_key": "A String",
      },
      "categories": [ # Output only. The categories that the posture belongs to, as determined by the Security Posture API.
        "A String",
      ],
      "createTime": "A String", # Output only. The time at which the posture was created.
      "description": "A String", # Optional. A description of the posture.
      "etag": "A String", # Optional. An opaque identifier for the current version of the posture at the specified `revision_id`. To prevent concurrent updates from overwriting each other, always provide the `etag` when you update a posture. You can also provide the `etag` when you delete a posture, to help ensure that you're deleting the intended version of the posture.
      "name": "A String", # Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
      "policySets": [ # Required. The PolicySet resources that the posture includes.
        { # A group of one or more Policy resources.
          "description": "A String", # Optional. A description of the policy set.
          "policies": [ # Required. The Policy resources in the policy set. Each policy must have a policy_id that's unique within the policy set.
            { # The details of a policy, including the constraints that it includes.
              "complianceStandards": [ # Optional. The compliance standards that the policy helps enforce.
                { # Information about a compliance standard that the policy helps enforce.
                  "control": "A String", # Optional. The control in the compliance standard that the policy helps enforce. For example, `AC-3`.
                  "standard": "A String", # Optional. The compliance standard that the policy helps enforce. For example, `NIST SP 800-53`.
                },
              ],
              "constraint": { # Metadata for a constraint in a Policy. # Required. The constraints that the policy includes.
                "orgPolicyConstraint": { # A predefined organization policy constraint. # Optional. A predefined organization policy constraint.
                  "cannedConstraintId": "A String", # Required. A unique identifier for the constraint.
                  "policyRules": [ # Required. The rules enforced by the constraint.
                    { # A rule that defines the allowed and denied values for an organization policy constraint.
                      "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                      "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                      "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                      "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                      "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                        "a_key": "", # Properties of the object.
                      },
                      "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                        "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                          "A String",
                        ],
                      },
                      "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                        "allowedValues": [ # The allowed values for the constraint.
                          "A String",
                        ],
                        "deniedValues": [ # The denied values for the constraint.
                          "A String",
                        ],
                      },
                    },
                  ],
                },
                "orgPolicyConstraintCustom": { # A custom organization policy constraint. # Optional. A custom organization policy constraint.
                  "customConstraint": { # A custom, user-defined constraint. You can apply the constraint only to the resource types specified in the constraint, and only within the organization where the constraint is defined. _When you create a custom constraint, it is not enforced automatically._ You must use an organization policy to [enforce the constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce). # Required. Metadata for the constraint.
                    "actionType": "A String", # Whether to allow or deny the action.
                    "condition": "A String", # A Common Expression Language (CEL) condition expression that must evaluate to `true` for the constraint to be enforced. The maximum length is 1000 characters. For example: + `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates to `true` if the resource's `instanceName` attribute contains the following: + The prefix `production` or `test` + An underscore (`_`) + Optional: One or more characters, followed by an underscore (`_`) + One or more digits + `resource.management.auto_upgrade == true`: Evaluates to `true` if the resource's `management.auto_upgrade` attribute is `true`.
                    "description": "A String", # A description of the constraint. The maximum length is 2000 characters.
                    "displayName": "A String", # A display name for the constraint. The maximum length is 200 characters.
                    "methodTypes": [ # The types of operations that the constraint applies to.
                      "A String",
                    ],
                    "name": "A String", # Immutable. The name of the constraint, in the format `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`. For example, `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`. Must contain 1 to 62 characters, excluding the prefix `organizations/{organization_id}/customConstraints/custom.`.
                    "resourceTypes": [ # Immutable. The resource type that the constraint applies to, in the format `{canonical_service_name}/{resource_type_name}`. For example, `compute.googleapis.com/Instance`.
                      "A String",
                    ],
                    "updateTime": "A String", # Output only. The last time at which the constraint was updated or created.
                  },
                  "policyRules": [ # Required. The rules enforced by the constraint.
                    { # A rule that defines the allowed and denied values for an organization policy constraint.
                      "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                      "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                      "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                      "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                      "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                        "a_key": "", # Properties of the object.
                      },
                      "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                        "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                          "A String",
                        ],
                      },
                      "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                        "allowedValues": [ # The allowed values for the constraint.
                          "A String",
                        ],
                        "deniedValues": [ # The denied values for the constraint.
                          "A String",
                        ],
                      },
                    },
                  ],
                },
                "securityHealthAnalyticsCustomModule": { # A custom module for Security Health Analytics. # Optional. A custom module for Security Health Analytics.
                  "config": { # A custom module configuration for Security Health Analytics. Use `CustomConfig` to create custom detectors that generate custom findings for resources that you specify. # Required. Configuration settings for the custom module.
                    "customOutput": { # Definitions of custom source properties that can appear in findings. # Optional. Definitions of custom source properties to include in findings.
                      "properties": [ # Optional. The custom source properties that can appear in findings.
                        { # A name-value pair used as a custom source property.
                          "name": "A String", # Required. The name of the custom source property.
                          "valueExpression": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Optional. The CEL expression for the value of the custom source property. For resource properties, you can return the value of the property or a string enclosed in quotation marks.
                            "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                            "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                            "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                            "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                          },
                        },
                      ],
                    },
                    "description": "A String", # Optional. A description of the vulnerability or misconfiguration that the custom module detects. The description appears in each finding. Provide enough information to help an investigator understand the finding. The value must be enclosed in quotation marks.
                    "predicate": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Required. The Common Expression Language (CEL) expression to evaluate. When the expression evaluates to `true` for a resource, a finding is generated.
                      "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                      "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                      "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                      "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                    },
                    "recommendation": "A String", # Required. An explanation of the steps that security teams can take to resolve the detected issue. The explanation appears in each finding.
                    "resourceSelector": { # A selector for the resource types to run the detector on. # Required. The resource types that the custom module operates on.
                      "resourceTypes": [ # Required. The resource types to run the detector on. Each custom module can specify up to 5 resource types.
                        "A String",
                      ],
                    },
                    "severity": "A String", # Required. The severity of findings generated by the custom module.
                  },
                  "displayName": "A String", # Optional. The display name of the custom module. This value is used as the finding category for all the asset violation findings that the custom module returns. The display name must contain between 1 and 128 alphanumeric characters or underscores, and it must start with a lowercase letter.
                  "id": "A String", # Output only. Immutable. The unique identifier for the custom module. Contains 1 to 20 digits.
                  "moduleEnablementState": "A String", # Whether the custom module is enabled at a specified level of the resource hierarchy.
                },
                "securityHealthAnalyticsModule": { # A built-in detector for Security Health Analytics. # Optional. A built-in detector for Security Health Analytics.
                  "moduleEnablementState": "A String", # Whether the detector is enabled at a specified level of the resource hierarchy.
                  "moduleName": "A String", # Required. The name of the detector. For example, `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding category for all the asset violation findings that the detector returns.
                },
              },
              "description": "A String", # Optional. A description of the policy.
              "policyId": "A String", # Required. A user-specified identifier for the policy. In a PolicySet, each policy must have a unique identifier.
            },
          ],
          "policySetId": "A String", # Required. An identifier for the policy set.
        },
      ],
      "reconciling": True or False, # Output only. Whether the posture is in the process of being updated.
      "revisionId": "A String", # Output only. Immutable. An opaque eight-character string that identifies the revision of the posture. A posture can have multiple revisions; when you deploy a posture, you deploy a specific revision of the posture.
      "state": "A String", # Required. The state of the posture at the specified `revision_id`.
      "updateTime": "A String", # Output only. The time at which the posture was last updated.
    },
  ],
  "unreachable": [ # Locations that were temporarily unavailable and could not be reached.
    "A String",
  ],
}

listRevisions(name, pageSize=None, pageToken=None, x__xgafv=None)

Lists all revisions of a single Posture.

Args:
  name: string, Required. The name of the Posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`. (required)
  pageSize: integer, Optional. The maximum number of posture revisions to return. The default value is `500`. If you exceed the maximum value of `1000`, then the service uses the maximum value.
  pageToken: string, Optional. A pagination token from a previous request to list posture revisions. Provide this token to retrieve the next page of results.
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # Response message for ListPostureRevisions.
  "nextPageToken": "A String", # A pagination token. To retrieve the next page of results, call the method again with this token.
  "revisions": [ # The list of revisions for the Posture.
    { # The details of a posture.
      "annotations": { # Optional. The user-specified annotations for the posture. For details about the values you can use in an annotation, see [AIP-148: Standard fields](https://google.aip.dev/148#annotations).
        "a_key": "A String",
      },
      "categories": [ # Output only. The categories that the posture belongs to, as determined by the Security Posture API.
        "A String",
      ],
      "createTime": "A String", # Output only. The time at which the posture was created.
      "description": "A String", # Optional. A description of the posture.
      "etag": "A String", # Optional. An opaque identifier for the current version of the posture at the specified `revision_id`. To prevent concurrent updates from overwriting each other, always provide the `etag` when you update a posture. You can also provide the `etag` when you delete a posture, to help ensure that you're deleting the intended version of the posture.
      "name": "A String", # Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
      "policySets": [ # Required. The PolicySet resources that the posture includes.
        { # A group of one or more Policy resources.
          "description": "A String", # Optional. A description of the policy set.
          "policies": [ # Required. The Policy resources in the policy set. Each policy must have a policy_id that's unique within the policy set.
            { # The details of a policy, including the constraints that it includes.
              "complianceStandards": [ # Optional. The compliance standards that the policy helps enforce.
                { # Information about a compliance standard that the policy helps enforce.
                  "control": "A String", # Optional. The control in the compliance standard that the policy helps enforce. For example, `AC-3`.
                  "standard": "A String", # Optional. The compliance standard that the policy helps enforce. For example, `NIST SP 800-53`.
                },
              ],
              "constraint": { # Metadata for a constraint in a Policy. # Required. The constraints that the policy includes.
                "orgPolicyConstraint": { # A predefined organization policy constraint. # Optional. A predefined organization policy constraint.
                  "cannedConstraintId": "A String", # Required. A unique identifier for the constraint.
                  "policyRules": [ # Required. The rules enforced by the constraint.
                    { # A rule that defines the allowed and denied values for an organization policy constraint.
                      "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                      "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                      "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                      "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                      "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                        "a_key": "", # Properties of the object.
                      },
                      "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                        "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                          "A String",
                        ],
                      },
                      "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                        "allowedValues": [ # The allowed values for the constraint.
                          "A String",
                        ],
                        "deniedValues": [ # The denied values for the constraint.
                          "A String",
                        ],
                      },
                    },
                  ],
                },
                "orgPolicyConstraintCustom": { # A custom organization policy constraint. # Optional. A custom organization policy constraint.
                  "customConstraint": { # A custom, user-defined constraint. You can apply the constraint only to the resource types specified in the constraint, and only within the organization where the constraint is defined. _When you create a custom constraint, it is not enforced automatically._ You must use an organization policy to [enforce the constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce). # Required. Metadata for the constraint.
                    "actionType": "A String", # Whether to allow or deny the action.
                    "condition": "A String", # A Common Expression Language (CEL) condition expression that must evaluate to `true` for the constraint to be enforced. The maximum length is 1000 characters. For example: + `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates to `true` if the resource's `instanceName` attribute contains the following: + The prefix `production` or `test` + An underscore (`_`) + Optional: One or more characters, followed by an underscore (`_`) + One or more digits + `resource.management.auto_upgrade == true`: Evaluates to `true` if the resource's `management.auto_upgrade` attribute is `true`.
                    "description": "A String", # A description of the constraint. The maximum length is 2000 characters.
                    "displayName": "A String", # A display name for the constraint. The maximum length is 200 characters.
                    "methodTypes": [ # The types of operations that the constraint applies to.
                      "A String",
                    ],
                    "name": "A String", # Immutable. The name of the constraint, in the format `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`. For example, `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`. Must contain 1 to 62 characters, excluding the prefix `organizations/{organization_id}/customConstraints/custom.`.
                    "resourceTypes": [ # Immutable. The resource type that the constraint applies to, in the format `{canonical_service_name}/{resource_type_name}`. For example, `compute.googleapis.com/Instance`.
                      "A String",
                    ],
                    "updateTime": "A String", # Output only. The last time at which the constraint was updated or created.
                  },
                  "policyRules": [ # Required. The rules enforced by the constraint.
                    { # A rule that defines the allowed and denied values for an organization policy constraint.
                      "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                      "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                      "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                      "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                      "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                        "a_key": "", # Properties of the object.
                      },
                      "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                        "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                          "A String",
                        ],
                      },
                      "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                        "allowedValues": [ # The allowed values for the constraint.
                          "A String",
                        ],
                        "deniedValues": [ # The denied values for the constraint.
                          "A String",
                        ],
                      },
                    },
                  ],
                },
                "securityHealthAnalyticsCustomModule": { # A custom module for Security Health Analytics. # Optional. A custom module for Security Health Analytics.
                  "config": { # A custom module configuration for Security Health Analytics. Use `CustomConfig` to create custom detectors that generate custom findings for resources that you specify. # Required. Configuration settings for the custom module.
                    "customOutput": { # Definitions of custom source properties that can appear in findings. # Optional. Definitions of custom source properties to include in findings.
                      "properties": [ # Optional. The custom source properties that can appear in findings.
                        { # A name-value pair used as a custom source property.
                          "name": "A String", # Required. The name of the custom source property.
                          "valueExpression": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Optional. The CEL expression for the value of the custom source property. For resource properties, you can return the value of the property or a string enclosed in quotation marks.
                            "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                            "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                            "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                            "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                          },
                        },
                      ],
                    },
                    "description": "A String", # Optional. A description of the vulnerability or misconfiguration that the custom module detects. The description appears in each finding. Provide enough information to help an investigator understand the finding. The value must be enclosed in quotation marks.
                    "predicate": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Required. The Common Expression Language (CEL) expression to evaluate. When the expression evaluates to `true` for a resource, a finding is generated.
                      "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                      "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                      "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                      "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                    },
                    "recommendation": "A String", # Required. An explanation of the steps that security teams can take to resolve the detected issue. The explanation appears in each finding.
                    "resourceSelector": { # A selector for the resource types to run the detector on. # Required. The resource types that the custom module operates on.
                      "resourceTypes": [ # Required. The resource types to run the detector on. Each custom module can specify up to 5 resource types.
                        "A String",
                      ],
                    },
                    "severity": "A String", # Required. The severity of findings generated by the custom module.
                  },
                  "displayName": "A String", # Optional. The display name of the custom module. This value is used as the finding category for all the asset violation findings that the custom module returns. The display name must contain between 1 and 128 alphanumeric characters or underscores, and it must start with a lowercase letter.
                  "id": "A String", # Output only. Immutable. The unique identifier for the custom module. Contains 1 to 20 digits.
                  "moduleEnablementState": "A String", # Whether the custom module is enabled at a specified level of the resource hierarchy.
                },
                "securityHealthAnalyticsModule": { # A built-in detector for Security Health Analytics. # Optional. A built-in detector for Security Health Analytics.
                  "moduleEnablementState": "A String", # Whether the detector is enabled at a specified level of the resource hierarchy.
                  "moduleName": "A String", # Required. The name of the detector. For example, `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding category for all the asset violation findings that the detector returns.
                },
              },
              "description": "A String", # Optional. A description of the policy.
              "policyId": "A String", # Required. A user-specified identifier for the policy. In a PolicySet, each policy must have a unique identifier.
            },
          ],
          "policySetId": "A String", # Required. An identifier for the policy set.
        },
      ],
      "reconciling": True or False, # Output only. Whether the posture is in the process of being updated.
      "revisionId": "A String", # Output only. Immutable. An opaque eight-character string that identifies the revision of the posture. A posture can have multiple revisions; when you deploy a posture, you deploy a specific revision of the posture.
      "state": "A String", # Required. The state of the posture at the specified `revision_id`.
      "updateTime": "A String", # Output only. The time at which the posture was last updated.
    },
  ],
}

listRevisions_next()

Retrieves the next page of results.

        Args:
          previous_request: The request for the previous page. (required)
          previous_response: The response from the request for the previous page. (required)

        Returns:
          A request object that you can call 'execute()' on to request the next
          page. Returns None if there are no more items in the collection.

list_next()

Retrieves the next page of results.

        Args:
          previous_request: The request for the previous page. (required)
          previous_response: The response from the request for the previous page. (required)

        Returns:
          A request object that you can call 'execute()' on to request the next
          page. Returns None if there are no more items in the collection.

patch(name, body=None, revisionId=None, updateMask=None, x__xgafv=None)

Updates a revision of an existing Posture. If the posture revision that you update is currently deployed, then a new revision of the posture is created. To prevent concurrent updates from overwriting each other, always follow the read-modify-write pattern when you update a posture: 1. Call GetPosture to get the current version of the posture. 2. Update the fields in the posture as needed. 3. Call UpdatePosture to update the posture. Ensure that your request includes the `etag` value from the GetPosture response. **Important:** If you omit the `etag` when you call UpdatePosture, then the updated posture unconditionally overwrites the existing posture.

Args:
  name: string, Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`. (required)
  body: object, The request body.
    The object takes the form of:

{ # The details of a posture.
  "annotations": { # Optional. The user-specified annotations for the posture. For details about the values you can use in an annotation, see [AIP-148: Standard fields](https://google.aip.dev/148#annotations).
    "a_key": "A String",
  },
  "categories": [ # Output only. The categories that the posture belongs to, as determined by the Security Posture API.
    "A String",
  ],
  "createTime": "A String", # Output only. The time at which the posture was created.
  "description": "A String", # Optional. A description of the posture.
  "etag": "A String", # Optional. An opaque identifier for the current version of the posture at the specified `revision_id`. To prevent concurrent updates from overwriting each other, always provide the `etag` when you update a posture. You can also provide the `etag` when you delete a posture, to help ensure that you're deleting the intended version of the posture.
  "name": "A String", # Required. Identifier. The name of the posture, in the format `organizations/{organization}/locations/global/postures/{posture_id}`.
  "policySets": [ # Required. The PolicySet resources that the posture includes.
    { # A group of one or more Policy resources.
      "description": "A String", # Optional. A description of the policy set.
      "policies": [ # Required. The Policy resources in the policy set. Each policy must have a policy_id that's unique within the policy set.
        { # The details of a policy, including the constraints that it includes.
          "complianceStandards": [ # Optional. The compliance standards that the policy helps enforce.
            { # Information about a compliance standard that the policy helps enforce.
              "control": "A String", # Optional. The control in the compliance standard that the policy helps enforce. For example, `AC-3`.
              "standard": "A String", # Optional. The compliance standard that the policy helps enforce. For example, `NIST SP 800-53`.
            },
          ],
          "constraint": { # Metadata for a constraint in a Policy. # Required. The constraints that the policy includes.
            "orgPolicyConstraint": { # A predefined organization policy constraint. # Optional. A predefined organization policy constraint.
              "cannedConstraintId": "A String", # Required. A unique identifier for the constraint.
              "policyRules": [ # Required. The rules enforced by the constraint.
                { # A rule that defines the allowed and denied values for an organization policy constraint.
                  "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                  "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                    "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                    "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                    "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                    "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                  },
                  "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                  "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                  "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                    "a_key": "", # Properties of the object.
                  },
                  "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                    "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                      "A String",
                    ],
                  },
                  "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                    "allowedValues": [ # The allowed values for the constraint.
                      "A String",
                    ],
                    "deniedValues": [ # The denied values for the constraint.
                      "A String",
                    ],
                  },
                },
              ],
            },
            "orgPolicyConstraintCustom": { # A custom organization policy constraint. # Optional. A custom organization policy constraint.
              "customConstraint": { # A custom, user-defined constraint. You can apply the constraint only to the resource types specified in the constraint, and only within the organization where the constraint is defined. _When you create a custom constraint, it is not enforced automatically._ You must use an organization policy to [enforce the constraint](https://cloud.google.com/resource-manager/help/organization-policy/constraints/enforce). # Required. Metadata for the constraint.
                "actionType": "A String", # Whether to allow or deny the action.
                "condition": "A String", # A Common Expression Language (CEL) condition expression that must evaluate to `true` for the constraint to be enforced. The maximum length is 1000 characters. For example: + `resource.instanceName.matches('(production|test)_(.+_)?[\d]+')`: Evaluates to `true` if the resource's `instanceName` attribute contains the following: + The prefix `production` or `test` + An underscore (`_`) + Optional: One or more characters, followed by an underscore (`_`) + One or more digits + `resource.management.auto_upgrade == true`: Evaluates to `true` if the resource's `management.auto_upgrade` attribute is `true`.
                "description": "A String", # A description of the constraint. The maximum length is 2000 characters.
                "displayName": "A String", # A display name for the constraint. The maximum length is 200 characters.
                "methodTypes": [ # The types of operations that the constraint applies to.
                  "A String",
                ],
                "name": "A String", # Immutable. The name of the constraint, in the format `organizations/{organization_id}/customConstraints/custom.{custom_constraint_id}`. For example, `organizations/123456789012/customConstraints/custom.createOnlyE2TypeVms`. Must contain 1 to 62 characters, excluding the prefix `organizations/{organization_id}/customConstraints/custom.`.
                "resourceTypes": [ # Immutable. The resource type that the constraint applies to, in the format `{canonical_service_name}/{resource_type_name}`. For example, `compute.googleapis.com/Instance`.
                  "A String",
                ],
                "updateTime": "A String", # Output only. The last time at which the constraint was updated or created.
              },
              "policyRules": [ # Required. The rules enforced by the constraint.
                { # A rule that defines the allowed and denied values for an organization policy constraint.
                  "allowAll": True or False, # Whether to allow any value for a list constraint. Valid only for list constraints.
                  "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # A condition that determines whether this rule is used to evaluate the policy. When set, the google.type.Expr.expression field must contain 1 to 10 subexpressions, joined by the `||` or `&&` operators. Each subexpression must use the `resource.matchTag()` or `resource.matchTagId()` Common Expression Language (CEL) function. The `resource.matchTag()` function takes the following arguments: * `key_name`: the namespaced name of the tag key, with the organization ID and a slash (`/`) as a prefix; for example, `123456789012/environment` * `value_name`: the short name of the tag value For example: `resource.matchTag('123456789012/environment, 'prod')` The `resource.matchTagId()` function takes the following arguments: * `key_id`: the permanent ID of the tag key; for example, `tagKeys/123456789012` * `value_id`: the permanent ID of the tag value; for example, `tagValues/567890123456` For example: `resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456')`
                    "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                    "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                    "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                    "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                  },
                  "denyAll": True or False, # Whether to deny all values for a list constraint. Valid only for list constraints.
                  "enforce": True or False, # Whether to enforce the constraint. Valid only for boolean constraints.
                  "parameters": { # Optional. Required for GMCs if parameters defined in constraints. Pass parameter values when policy enforcement is enabled. Ensure that parameter value types match those defined in the constraint definition. For example: { "allowedLocations" : ["us-east1", "us-west1"], "allowAll" : true }
                    "a_key": "", # Properties of the object.
                  },
                  "resourceTypes": { # Set multiple resource types for one policy, eg: resourceTypes: included: - compute.googleapis.com/Instance - compute.googleapis.com/Disk Constraint definition contains an empty resource type in order to support multiple resource types in the policy. Only support Google managed constriaint and method type is GOVERN_TAGS Refer go/multi-resource-support-force-tags-gmc to get more details. # Optional. The resource types policy can support, only used for Google managed constraint and method type is GOVERN_TAGS.
                    "included": [ # Optional. The resource type we currently support. cloud/orgpolicy/customconstraintconfig/prod/resource_types.prototext
                      "A String",
                    ],
                  },
                  "values": { # The allowed and denied values for a list constraint. For all constraints, these fields can contain literal values. Optionally, you can add the `is:` prefix to these values. If the value contains a colon (`:`), then the `is:` prefix is required. Some constraints allow you to specify a portion of the resource hierarchy, known as a [_hierarchy subtree_](https://cloud.google.com/resource-manager/help/organization-policy/hierarchy-subtree), that the constraint applies to. To specify a hierarchy subtree, use the `under:` prefix, followed by a value with one of these formats: - `projects/{project_id}` (for example, `projects/tokyo-rain-123`) - `folders/{folder_id}` (for example, `folders/1234567890123`) - `organizations/{organization_id}` (for example, `organizations/123456789012`) A constraint's `supports_under` field indicates whether you can specify a hierarchy subtree. To learn which predefined constraints let you specify a hierarchy subtree, see the [constraints reference](https://cloud.google.com/resource-manager/help/organization-policy/constraints/reference). # The allowed and denied values for a list constraint. Valid only for list constraints.
                    "allowedValues": [ # The allowed values for the constraint.
                      "A String",
                    ],
                    "deniedValues": [ # The denied values for the constraint.
                      "A String",
                    ],
                  },
                },
              ],
            },
            "securityHealthAnalyticsCustomModule": { # A custom module for Security Health Analytics. # Optional. A custom module for Security Health Analytics.
              "config": { # A custom module configuration for Security Health Analytics. Use `CustomConfig` to create custom detectors that generate custom findings for resources that you specify. # Required. Configuration settings for the custom module.
                "customOutput": { # Definitions of custom source properties that can appear in findings. # Optional. Definitions of custom source properties to include in findings.
                  "properties": [ # Optional. The custom source properties that can appear in findings.
                    { # A name-value pair used as a custom source property.
                      "name": "A String", # Required. The name of the custom source property.
                      "valueExpression": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Optional. The CEL expression for the value of the custom source property. For resource properties, you can return the value of the property or a string enclosed in quotation marks.
                        "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                        "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                        "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                        "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                      },
                    },
                  ],
                },
                "description": "A String", # Optional. A description of the vulnerability or misconfiguration that the custom module detects. The description appears in each finding. Provide enough information to help an investigator understand the finding. The value must be enclosed in quotation marks.
                "predicate": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # Required. The Common Expression Language (CEL) expression to evaluate. When the expression evaluates to `true` for a resource, a finding is generated.
                  "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
                  "expression": "A String", # Textual representation of an expression in Common Expression Language syntax.
                  "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
                  "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
                },
                "recommendation": "A String", # Required. An explanation of the steps that security teams can take to resolve the detected issue. The explanation appears in each finding.
                "resourceSelector": { # A selector for the resource types to run the detector on. # Required. The resource types that the custom module operates on.
                  "resourceTypes": [ # Required. The resource types to run the detector on. Each custom module can specify up to 5 resource types.
                    "A String",
                  ],
                },
                "severity": "A String", # Required. The severity of findings generated by the custom module.
              },
              "displayName": "A String", # Optional. The display name of the custom module. This value is used as the finding category for all the asset violation findings that the custom module returns. The display name must contain between 1 and 128 alphanumeric characters or underscores, and it must start with a lowercase letter.
              "id": "A String", # Output only. Immutable. The unique identifier for the custom module. Contains 1 to 20 digits.
              "moduleEnablementState": "A String", # Whether the custom module is enabled at a specified level of the resource hierarchy.
            },
            "securityHealthAnalyticsModule": { # A built-in detector for Security Health Analytics. # Optional. A built-in detector for Security Health Analytics.
              "moduleEnablementState": "A String", # Whether the detector is enabled at a specified level of the resource hierarchy.
              "moduleName": "A String", # Required. The name of the detector. For example, `BIGQUERY_TABLE_CMEK_DISABLED`. This field is also used as the finding category for all the asset violation findings that the detector returns.
            },
          },
          "description": "A String", # Optional. A description of the policy.
          "policyId": "A String", # Required. A user-specified identifier for the policy. In a PolicySet, each policy must have a unique identifier.
        },
      ],
      "policySetId": "A String", # Required. An identifier for the policy set.
    },
  ],
  "reconciling": True or False, # Output only. Whether the posture is in the process of being updated.
  "revisionId": "A String", # Output only. Immutable. An opaque eight-character string that identifies the revision of the posture. A posture can have multiple revisions; when you deploy a posture, you deploy a specific revision of the posture.
  "state": "A String", # Required. The state of the posture at the specified `revision_id`.
  "updateTime": "A String", # Output only. The time at which the posture was last updated.
}

  revisionId: string, Required. The revision ID of the posture to update. If the posture revision that you update is currently deployed, then a new revision of the posture is created.
  updateMask: string, Required. The fields in the Posture to update. You can update only the following fields: * Posture.description * Posture.policy_sets * Posture.state
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # This resource represents a long-running operation that is the result of a network API call.
  "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
  "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
    "code": 42, # The status code, which should be an enum value of google.rpc.Code.
    "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
      {
        "a_key": "", # Properties of the object. Contains field @type with type URL.
      },
    ],
    "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
  },
  "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
    "a_key": "", # Properties of the object. Contains field @type with type URL.
  },
  "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
  "response": { # The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
    "a_key": "", # Properties of the object. Contains field @type with type URL.
  },
}

Security Posture API . organizations . locations . postures

Instance Methods

Method Details