Skip to content

fix: add *.proto files to google-cloud-audit-log #14587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 29, 2025
Merged

fix: add *.proto files to google-cloud-audit-log #14587

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
376 changes: 376 additions & 0 deletions packages/google-cloud-audit-log/google/cloud/audit/audit_log.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,376 @@
// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.audit;

import "google/api/field_behavior.proto";
import "google/protobuf/any.proto";
import "google/protobuf/struct.proto";
import "google/rpc/context/attribute_context.proto";
import "google/rpc/status.proto";

option cc_enable_arenas = true;
option go_package = "google.golang.org/genproto/googleapis/cloud/audit;audit";
option java_multiple_files = true;
option java_outer_classname = "AuditLogProto";
option java_package = "com.google.cloud.audit";

// Common audit log format for Google Cloud Platform API operations.
message AuditLog {
// The name of the API service performing the operation. For example,
// `"compute.googleapis.com"`.
string service_name = 7;

// The name of the service method or operation.
// For API calls, this should be the name of the API method.
// For example,
//
// "google.cloud.bigquery.v2.TableService.InsertTable"
// "google.logging.v2.ConfigServiceV2.CreateSink"
string method_name = 8;

// The resource or collection that is the target of the operation.
// The name is a scheme-less URI, not including the API service name.
// For example:
//
// "projects/PROJECT_ID/zones/us-central1-a/instances"
// "projects/PROJECT_ID/datasets/DATASET_ID"
string resource_name = 11;

// The resource location information.
ResourceLocation resource_location = 20;

// The resource's original state before mutation. Present only for
// operations which have successfully modified the targeted resource(s).
// In general, this field should contain all changed fields, except those
// that are already been included in `request`, `response`, `metadata` or
// `service_data` fields.
// When the JSON object represented here has a proto equivalent,
// the proto name will be indicated in the `@type` property.
google.protobuf.Struct resource_original_state = 19;

// The number of items returned from a List or Query API method,
// if applicable.
int64 num_response_items = 12;

// The status of the overall operation.
google.rpc.Status status = 2;

// Authentication information.
AuthenticationInfo authentication_info = 3;

// Authorization information. If there are multiple
// resources or permissions involved, then there is
// one AuthorizationInfo element for each {resource, permission} tuple.
repeated AuthorizationInfo authorization_info = 9;

// Indicates the policy violations for this request. If the request
// is denied by the policy, violation information will be logged
// here.
PolicyViolationInfo policy_violation_info = 25;

// Metadata about the operation.
RequestMetadata request_metadata = 4;

// The operation request. This may not include all request parameters,
// such as those that are too large, privacy-sensitive, or duplicated
// elsewhere in the log record.
// It should never include user-generated data, such as file contents.
// When the JSON object represented here has a proto equivalent, the proto
// name will be indicated in the `@type` property.
google.protobuf.Struct request = 16;

// The operation response. This may not include all response elements,
// such as those that are too large, privacy-sensitive, or duplicated
// elsewhere in the log record.
// It should never include user-generated data, such as file contents.
// When the JSON object represented here has a proto equivalent, the proto
// name will be indicated in the `@type` property.
google.protobuf.Struct response = 17;

// Other service-specific data about the request, response, and other
// information associated with the current audited event.
google.protobuf.Struct metadata = 18;

// Deprecated. Use the `metadata` field instead.
// Other service-specific data about the request, response, and other
// activities.
google.protobuf.Any service_data = 15 [deprecated = true];
}

// Authentication information for the operation.
message AuthenticationInfo {
// The email address of the authenticated user (or service account on behalf
// of third party principal) making the request. For third party identity
// callers, the `principal_subject` field is populated instead of this field.
// For privacy reasons, the principal email address is sometimes redacted.
// For more information, see [Caller identities in audit
// logs](https://cloud.google.com/logging/docs/audit#user-id).
string principal_email = 1;

// The authority selector specified by the requestor, if any.
// It is not guaranteed that the principal was allowed to use this authority.
string authority_selector = 2;

// The third party identification (if any) of the authenticated user making
// the request.
// When the JSON object represented here has a proto equivalent, the proto
// name will be indicated in the `@type` property.
google.protobuf.Struct third_party_principal = 4;

// The name of the service account key used to create or exchange
// credentials for authenticating the service account making the request.
// This is a scheme-less URI full resource name. For example:
//
// "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}"
string service_account_key_name = 5;

// Identity delegation history of an authenticated service account that makes
// the request. It contains information on the real authorities that try to
// access GCP resources by delegating on a service account. When multiple
// authorities present, they are guaranteed to be sorted based on the original
// ordering of the identity delegation events.
repeated ServiceAccountDelegationInfo service_account_delegation_info = 6;

// String representation of identity of requesting party.
// Populated for both first and third party identities.
string principal_subject = 8;
}

// Authorization information for the operation.
message AuthorizationInfo {
// The list of valid permission types that can be checked.
enum PermissionType {
// Default. Should not be used.
PERMISSION_TYPE_UNSPECIFIED = 0;

// Permissions that gate reading resource configuration or metadata.
ADMIN_READ = 1;

// Permissions that gate modification of resource configuration or metadata.
ADMIN_WRITE = 2;

// Permissions that gate reading user-provided data.
DATA_READ = 3;

// Permissions that gate writing user-provided data.
DATA_WRITE = 4;
}

// The resource being accessed, as a REST-style or cloud resource string.
// For example:
//
// bigquery.googleapis.com/projects/PROJECTID/datasets/DATASETID
// or
// projects/PROJECTID/datasets/DATASETID
string resource = 1;

// The required IAM permission.
string permission = 2;

// Whether or not authorization for `resource` and `permission`
// was granted.
bool granted = 3;

// Resource attributes used in IAM condition evaluation. This field contains
// resource attributes like resource type and resource name.
//
// To get the whole view of the attributes used in IAM
// condition evaluation, the user must also look into
// `AuditLog.request_metadata.request_attributes`.
google.rpc.context.AttributeContext.Resource resource_attributes = 5;

// The type of the permission that was checked. For data access audit logs
// this corresponds with the permission type that must be enabled in the
// project/folder/organization IAM policy in order for the log to be written.
PermissionType permission_type = 7;
}

// Metadata about the request.
message RequestMetadata {
// The IP address of the caller.
// For a caller from the internet, this will be the public IPv4 or IPv6
// address. For calls made from inside Google's internal production network
// from one GCP service to another, `caller_ip` will be redacted to "private".
// For a caller from a Compute Engine VM with a external IP address,
// `caller_ip` will be the VM's external IP address. For a caller from a
// Compute Engine VM without a external IP address, if the VM is in the same
// organization (or project) as the accessed resource, `caller_ip` will be the
// VM's internal IPv4 address, otherwise `caller_ip` will be redacted to
// "gce-internal-ip". See https://cloud.google.com/compute/docs/vpc/ for more
// information.
string caller_ip = 1;

// The user agent of the caller.
// This information is not authenticated and should be treated accordingly.
// For example:
//
// + `google-api-python-client/1.4.0`:
// The request was made by the Google API client for Python.
// + `Cloud SDK Command Line Tool apitools-client/1.0 gcloud/0.9.62`:
// The request was made by the Google Cloud SDK CLI (gcloud).
// + `AppEngine-Google; (+http://code.google.com/appengine; appid:
// s~my-project`:
// The request was made from the `my-project` App Engine app.
string caller_supplied_user_agent = 2;

// The network of the caller.
// Set only if the network host project is part of the same GCP organization
// (or project) as the accessed resource.
// See https://cloud.google.com/compute/docs/vpc/ for more information.
// This is a scheme-less URI full resource name. For example:
//
// "//compute.googleapis.com/projects/PROJECT_ID/global/networks/NETWORK_ID"
string caller_network = 3;

// Request attributes used in IAM condition evaluation. This field contains
// request attributes like request time and access levels associated with
// the request.
//
//
// To get the whole view of the attributes used in IAM
// condition evaluation, the user must also look into
// `AuditLog.authentication_info.resource_attributes`.
google.rpc.context.AttributeContext.Request request_attributes = 7;

// The destination of a network activity, such as accepting a TCP connection.
// In a multi hop network activity, the destination represents the receiver of
// the last hop. Only two fields are used in this message, Peer.port and
// Peer.ip. These fields are optionally populated by those services utilizing
// the IAM condition feature.
google.rpc.context.AttributeContext.Peer destination_attributes = 8;
}

// Location information about a resource.
message ResourceLocation {
// The locations of a resource after the execution of the operation.
// Requests to create or delete a location based resource must populate
// the 'current_locations' field and not the 'original_locations' field.
// For example:
//
// "europe-west1-a"
// "us-east1"
// "nam3"
repeated string current_locations = 1;

// The locations of a resource prior to the execution of the operation.
// Requests that mutate the resource's location must populate both the
// 'original_locations' as well as the 'current_locations' fields.
// For example:
//
// "europe-west1-a"
// "us-east1"
// "nam3"
repeated string original_locations = 2;
}

// Identity delegation history of an authenticated service account.
message ServiceAccountDelegationInfo {
// First party identity principal.
message FirstPartyPrincipal {
// The email address of a Google account.
string principal_email = 1;

// Metadata about the service that uses the service account.
google.protobuf.Struct service_metadata = 2;
}

// Third party identity principal.
message ThirdPartyPrincipal {
// Metadata about third party identity.
google.protobuf.Struct third_party_claims = 1;
}

// A string representing the principal_subject associated with the identity.
// For most identities, the format will be
// `principal://iam.googleapis.com/{identity pool name}/subject/{subject)`
// except for some GKE identities (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD)
// that are still in the legacy format `serviceAccount:{identity pool
// name}[{subject}]`
string principal_subject = 3;

// Entity that creates credentials for service account and assumes its
// identity for authentication.
oneof Authority {
// First party (Google) identity as the real authority.
FirstPartyPrincipal first_party_principal = 1;

// Third party identity as the real authority.
ThirdPartyPrincipal third_party_principal = 2;
}
}

// Information related to policy violations for this request.
message PolicyViolationInfo {
// Indicates the orgpolicy violations for this resource.
OrgPolicyViolationInfo org_policy_violation_info = 1;
}

// Represents OrgPolicy Violation information.
message OrgPolicyViolationInfo {
// Optional. Resource payload that is currently in scope and is subjected to orgpolicy
// conditions. This payload may be the subset of the actual Resource that may
// come in the request. This payload should not contain any core content.
google.protobuf.Struct payload = 1 [(google.api.field_behavior) = OPTIONAL];

// Optional. Resource type that the orgpolicy is checked against.
// Example: compute.googleapis.com/Instance, store.googleapis.com/bucket
string resource_type = 2 [(google.api.field_behavior) = OPTIONAL];

// Optional. Tags referenced on the resource at the time of evaluation. These also
// include the federated tags, if they are supplied in the CheckOrgPolicy
// or CheckCustomConstraints Requests.
//
// Optional field as of now. These tags are the Cloud tags that are
// available on the resource during the policy evaluation and will
// be available as part of the OrgPolicy check response for logging purposes.
map<string, string> resource_tags = 3 [(google.api.field_behavior) = OPTIONAL];

// Optional. Policy violations
repeated ViolationInfo violation_info = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Provides information about the Policy violation info for this request.
message ViolationInfo {
// Policy Type enum
enum PolicyType {
// Default value. This value should not be used.
POLICY_TYPE_UNSPECIFIED = 0;

// Indicates boolean policy constraint
BOOLEAN_CONSTRAINT = 1;

// Indicates list policy constraint
LIST_CONSTRAINT = 2;

// Indicates custom policy constraint
CUSTOM_CONSTRAINT = 3;
}

// Optional. Constraint name
string constraint = 1 [(google.api.field_behavior) = OPTIONAL];

// Optional. Error message that policy is indicating.
string error_message = 2 [(google.api.field_behavior) = OPTIONAL];

// Optional. Value that is being checked for the policy.
// This could be in encrypted form (if pii sensitive).
// This field will only be emitted in LIST_POLICY types
string checked_value = 3 [(google.api.field_behavior) = OPTIONAL];

// Optional. Indicates the type of the policy.
PolicyType policy_type = 4 [(google.api.field_behavior) = OPTIONAL];
}
Loading
Loading