|
| 1 | +syntax = "proto3"; |
| 2 | + |
| 3 | +package yandex.cloud.access; |
| 4 | + |
| 5 | +import "ydb/public/api/client/yc_public/common/validation.proto"; |
| 6 | + |
| 7 | +option go_package = "github.com/ydb-platform/ydb/ydb/public/api/client/yc_public/access;access"; |
| 8 | +option java_package = "yandex.cloud.api.access"; |
| 9 | + |
| 10 | +message Subject { |
| 11 | + // ID of the subject. |
| 12 | + // |
| 13 | + // It can contain one of the following values: |
| 14 | + // * `allAuthenticatedUsers`: A special system identifier that represents anyone |
| 15 | + // who is authenticated. It can be used only if the [type] is `system`. |
| 16 | + // * `allUsers`: A special system identifier that represents anyone. No authentication is required. |
| 17 | + // For example, you don't need to specify the IAM token in an API query. |
| 18 | + // * `<cloud generated id>`: An identifier that represents a user account. |
| 19 | + // It can be used only if the [type] is `userAccount`, `federatedUser` or `serviceAccount`. |
| 20 | + string id = 1 [(required) = true, (length) = "<=50"]; |
| 21 | + |
| 22 | + // Type of the subject. |
| 23 | + // |
| 24 | + // It can contain one of the following values: |
| 25 | + // * `userAccount`: An account on Yandex or Yandex Connect, added to Yandex Cloud. |
| 26 | + // * `serviceAccount`: A service account. This type represents the [yandex.cloud.iam.v1.ServiceAccount] resource. |
| 27 | + // * `federatedUser`: A federated account. This type represents a user from an identity federation, like Active Directory. |
| 28 | + // * `system`: System group. This type represents several accounts with a common system identifier. |
| 29 | + // |
| 30 | + // For more information, see [Subject to which the role is assigned](/docs/iam/concepts/access-control/#subject). |
| 31 | + string type = 2 [(required) = true, (length) = "<=100"]; |
| 32 | +} |
| 33 | + |
| 34 | +message AccessBinding { |
| 35 | + // ID of the [yandex.cloud.iam.v1.Role] that is assigned to the [subject]. |
| 36 | + string role_id = 1 [(required) = true, (length) = "<=50"]; |
| 37 | + |
| 38 | + // Identity for which access binding is being created. |
| 39 | + // It can represent an account with a unique ID or several accounts with a system identifier. |
| 40 | + Subject subject = 2 [(required) = true]; |
| 41 | +} |
| 42 | + |
| 43 | +message ListAccessBindingsRequest { |
| 44 | + // ID of the resource to list access bindings for. |
| 45 | + // |
| 46 | + // To get the resource ID, use a corresponding List request. |
| 47 | + // For example, use the [yandex.cloud.resourcemanager.v1.CloudService.List] request to get the Cloud resource ID. |
| 48 | + string resource_id = 1 [(required) = true, (length) = "<=50"]; |
| 49 | + |
| 50 | + // The maximum number of results per page that should be returned. If the number of available |
| 51 | + // results is larger than [page_size], |
| 52 | + // the service returns a [ListAccessBindingsResponse.next_page_token] |
| 53 | + // that can be used to get the next page of results in subsequent list requests. |
| 54 | + // Default value: 100. |
| 55 | + int64 page_size = 2 [(value) = "<=1000"]; |
| 56 | + |
| 57 | + // Page token. Set [page_token] |
| 58 | + // to the [ListAccessBindingsResponse.next_page_token] |
| 59 | + // returned by a previous list request to get the next page of results. |
| 60 | + string page_token = 3 [(length) = "<=100"]; |
| 61 | +} |
| 62 | + |
| 63 | +message ListAccessBindingsResponse { |
| 64 | + // List of access bindings for the specified resource. |
| 65 | + repeated AccessBinding access_bindings = 1; |
| 66 | + |
| 67 | + // This token allows you to get the next page of results for list requests. If the number of results |
| 68 | + // is larger than [ListAccessBindingsRequest.page_size], use |
| 69 | + // the [next_page_token] as the value |
| 70 | + // for the [ListAccessBindingsRequest.page_token] query parameter |
| 71 | + // in the next list request. Each subsequent list request will have its own |
| 72 | + // [next_page_token] to continue paging through the results. |
| 73 | + string next_page_token = 2; |
| 74 | +} |
| 75 | + |
| 76 | +message SetAccessBindingsRequest { |
| 77 | + // ID of the resource for which access bindings are being set. |
| 78 | + // |
| 79 | + // To get the resource ID, use a corresponding List request. |
| 80 | + string resource_id = 1 [(required) = true, (length) = "<=50"]; |
| 81 | + |
| 82 | + // Access bindings to be set. For more information, see [Access Bindings](/docs/iam/concepts/access-control/#access-bindings). |
| 83 | + repeated AccessBinding access_bindings = 2 [(size) = "<=1000"]; |
| 84 | +} |
| 85 | + |
| 86 | +message SetAccessBindingsMetadata { |
| 87 | + // ID of the resource for which access bindings are being set. |
| 88 | + string resource_id = 1; |
| 89 | +} |
| 90 | + |
| 91 | +message UpdateAccessBindingsRequest { |
| 92 | + // ID of the resource for which access bindings are being updated. |
| 93 | + string resource_id = 1 [(required) = true, (length) = "<=50"]; |
| 94 | + |
| 95 | + // Updates to access bindings. |
| 96 | + repeated AccessBindingDelta access_binding_deltas = 2 [(size) = "1-1000"]; |
| 97 | +} |
| 98 | + |
| 99 | +message UpdateAccessBindingsMetadata { |
| 100 | + // ID of the resource for which access bindings are being updated. |
| 101 | + string resource_id = 1; |
| 102 | +} |
| 103 | + |
| 104 | +enum AccessBindingAction { |
| 105 | + ACCESS_BINDING_ACTION_UNSPECIFIED = 0; |
| 106 | + |
| 107 | + // Addition of an access binding. |
| 108 | + ADD = 1; |
| 109 | + |
| 110 | + // Removal of an access binding. |
| 111 | + REMOVE = 2; |
| 112 | +} |
| 113 | + |
| 114 | +message AccessBindingDelta { |
| 115 | + // The action that is being performed on an access binding. |
| 116 | + AccessBindingAction action = 1 [(required) = true]; |
| 117 | + |
| 118 | + // Access binding. For more information, see [Access Bindings](/docs/iam/concepts/access-control/#access-bindings). |
| 119 | + AccessBinding access_binding = 2 [(required) = true]; |
| 120 | +} |
| 121 | + |
| 122 | +message AccessBindingsOperationResult { |
| 123 | + // Result access binding deltas. |
| 124 | + repeated AccessBindingDelta effective_deltas = 1; |
| 125 | +} |
0 commit comments