As of January 1, 2020 this library no longer supports Python 2 on the latest released version. Library versions released prior to that date will continue to be available. For more information please visit Python 2 support on Google Cloud.

Types for Google Cloud Osconfig v1alpha API¶

class google.cloud.osconfig_v1alpha.types.CVSSv3(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

base_score¶

The base score is a function of the base metric scores. https://www.first.org/cvss/specification-document#Base-Metrics

Type: float

exploitability_score¶

The Exploitability sub-score equation is derived from the Base Exploitability metrics. https://www.first.org/cvss/specification-document#2-1-Exploitability-Metrics

Type: float

impact_score¶

The Impact sub-score equation is derived from the Base Impact metrics.

Type: float

attack_vector¶

This metric reflects the context by which vulnerability exploitation is possible.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.AttackVector

attack_complexity¶

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.AttackComplexity

privileges_required¶

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.PrivilegesRequired

user_interaction¶

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.UserInteraction

scope¶

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.Scope

confidentiality_impact¶

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.Impact

integrity_impact¶

This metric measures the impact to integrity of a successfully exploited vulnerability.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.Impact

availability_impact¶

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3.Impact

class AttackComplexity(value)[source]¶

Bases: proto.enums.Enum

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Values:

ATTACK_COMPLEXITY_UNSPECIFIED (0):: Invalid value.
ATTACK_COMPLEXITY_LOW (1):: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.
ATTACK_COMPLEXITY_HIGH (2):: A successful attack depends on conditions beyond the attacker’s control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

class AttackVector(value)[source]¶

Bases: proto.enums.Enum

This metric reflects the context by which vulnerability exploitation is possible.

Values:

ATTACK_VECTOR_UNSPECIFIED (0):: Invalid value.
ATTACK_VECTOR_NETWORK (1):: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet.
ATTACK_VECTOR_ADJACENT (2):: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology.
ATTACK_VECTOR_LOCAL (3):: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.
ATTACK_VECTOR_PHYSICAL (4):: The attack requires the attacker to physically touch or manipulate the vulnerable component.

class Impact(value)[source]¶

Bases: proto.enums.Enum

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack.

Values:

IMPACT_UNSPECIFIED (0):: Invalid value.
IMPACT_HIGH (1):: High impact.
IMPACT_LOW (2):: Low impact.
IMPACT_NONE (3):: No impact.

class PrivilegesRequired(value)[source]¶

Bases: proto.enums.Enum

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Values:

PRIVILEGES_REQUIRED_UNSPECIFIED (0):: Invalid value.
PRIVILEGES_REQUIRED_NONE (1):: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
PRIVILEGES_REQUIRED_LOW (2):: The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
PRIVILEGES_REQUIRED_HIGH (3):: The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable component allowing access to component-wide settings and files.

class Scope(value)[source]¶

Bases: proto.enums.Enum

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Values:

SCOPE_UNSPECIFIED (0):: Invalid value.
SCOPE_UNCHANGED (1):: An exploited vulnerability can only affect resources managed by the same security authority.
SCOPE_CHANGED (2):: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component.

class UserInteraction(value)[source]¶

Bases: proto.enums.Enum

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Values:

USER_INTERACTION_UNSPECIFIED (0):: Invalid value.
USER_INTERACTION_NONE (1):: The vulnerable system can be exploited without interaction from any user.
USER_INTERACTION_REQUIRED (2):: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.

class google.cloud.osconfig_v1alpha.types.CreateOSPolicyAssignmentRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message to create an OS policy assignment

parent¶

Required. The parent resource name in the form: projects/{project}/locations/{location}

Type: str

os_policy_assignment¶

Required. The OS policy assignment to be created.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignment

os_policy_assignment_id¶

Required. The logical name of the OS policy assignment in the project with the following restrictions:

Must contain only lowercase letters, numbers, and hyphens.
Must start with a letter.
Must be between 1-63 characters.
Must end with a number or a letter.
Must be unique within the project.

Type: str

class google.cloud.osconfig_v1alpha.types.DeleteOSPolicyAssignmentRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for deleting a OS policy assignment.

name¶

Required. The name of the OS policy assignment to be deleted

Type: str

class google.cloud.osconfig_v1alpha.types.FixedOrPercent(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Message encapsulating a value that can be either absolute (“fixed”) or relative (“percent”) to a value.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

fixed¶

Specifies a fixed value.

This field is a member of oneof mode.

Type: int

percent¶

Specifies the relative value defined as a percentage, which will be multiplied by a reference value.

This field is a member of oneof mode.

Type: int

class google.cloud.osconfig_v1alpha.types.GetInstanceOSPoliciesComplianceRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for getting OS policies compliance data for the given Compute Engine VM instance.

name¶

Required. API resource name for instance OS policies compliance resource.

Format: projects/{project}/locations/{location}/instanceOSPoliciesCompliances/{instance}

For {project}, either Compute Engine project-number or project-id can be provided. For {instance}, either Compute Engine VM instance-id or instance-name can be provided.

Type: str

class google.cloud.osconfig_v1alpha.types.GetInventoryRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for getting inventory data for the specified VM.

name¶

Required. API resource name for inventory resource.

Format: projects/{project}/locations/{location}/instances/{instance}/inventory

For {project}, either project-number or project-id can be provided. For {instance}, either Compute Engine instance-id or instance-name can be provided.

Type: str

view¶

Inventory view indicating what information should be included in the inventory resource. If unspecified, the default view is BASIC.

Type: google.cloud.osconfig_v1alpha.types.InventoryView

class google.cloud.osconfig_v1alpha.types.GetOSPolicyAssignmentReportRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Get a report of the OS policy assignment for a VM instance.

name¶

Required. API resource name for OS policy assignment report.

Format: /projects/{project}/locations/{location}/instances/{instance}/osPolicyAssignments/{assignment}/report

For {project}, either project-number or project-id can be provided. For {instance_id}, either Compute Engine instance-id or instance-name can be provided. For {assignment_id}, the OSPolicyAssignment id must be provided.

Type: str

class google.cloud.osconfig_v1alpha.types.GetOSPolicyAssignmentRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message to get an OS policy assignment

name¶

Required. The resource name of OS policy assignment.

Format: projects/{project}/locations/{location}/osPolicyAssignments/{os_policy_assignment}@{revisionId}

Type: str

class google.cloud.osconfig_v1alpha.types.GetVulnerabilityReportRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for getting the vulnerability report for the specified VM.

name¶

Required. API resource name for vulnerability resource.

Format: projects/{project}/locations/{location}/instances/{instance}/vulnerabilityReport

For {project}, either project-number or project-id can be provided. For {instance}, either Compute Engine instance-id or instance-name can be provided.

Type: str

class google.cloud.osconfig_v1alpha.types.InstanceOSPoliciesCompliance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

This API resource represents the OS policies compliance data for a Compute Engine virtual machine (VM) instance at a given point in time.

A Compute Engine VM can have multiple OS policy assignments, and each assignment can have multiple OS policies. As a result, multiple OS policies could be applied to a single VM.

You can use this API resource to determine both the compliance state of your VM as well as the compliance state of an individual OS policy.

For more information, see View compliance.

name¶

Output only. The InstanceOSPoliciesCompliance API resource name.

Format: projects/{project_number}/locations/{location}/instanceOSPoliciesCompliances/{instance_id}

Type: str

instance¶

Output only. The Compute Engine VM instance name.

Type: str

state¶

Output only. Compliance state of the VM.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyComplianceState

detailed_state¶

Output only. Detailed compliance state of the VM. This field is populated only when compliance state is UNKNOWN.

It may contain one of the following values:

no-compliance-data: Compliance data is not available for this VM.
no-agent-detected: OS Config agent is not detected for this VM.
config-not-supported-by-agent: The version of the OS Config agent running on this VM does not support configuration management.
inactive: VM is not running.
internal-service-errors: There were internal service errors encountered while enforcing compliance.
agent-errors: OS config agent encountered errors while enforcing compliance.

Type: str

detailed_state_reason¶

Output only. The reason for the detailed_state of the VM (if any).

Type: str

os_policy_compliances¶

Output only. Compliance data for each OSPolicy that is applied to the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.InstanceOSPoliciesCompliance.OSPolicyCompliance]

last_compliance_check_time¶

Output only. Timestamp of the last compliance check for the VM.

Type: google.protobuf.timestamp_pb2.Timestamp

last_compliance_run_id¶

Output only. Unique identifier for the last compliance run. This id will be logged by the OS config agent during a compliance run and can be used for debugging and tracing purpose.

Type: str

class OSPolicyCompliance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Compliance data for an OS policy

os_policy_id¶

The OS policy id

Type: str

os_policy_assignment¶

Reference to the OSPolicyAssignment API resource that the OSPolicy belongs to.

Format: projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}

Type: str

state¶

Compliance state of the OS policy.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyComplianceState

os_policy_resource_compliances¶

Compliance data for each OSPolicyResource that is applied to the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyResourceCompliance]

class google.cloud.osconfig_v1alpha.types.Inventory(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

This API resource represents the available inventory data for a Compute Engine virtual machine (VM) instance at a given point in time.

You can use this API resource to determine the inventory data of your VM.

For more information, see Information provided by OS inventory management.

name¶

Output only. The Inventory API resource name.

Format: projects/{project_number}/locations/{location}/instances/{instance_id}/inventory

Type: str

os_info¶

Output only. Base level operating system information for the VM.

Type: google.cloud.osconfig_v1alpha.types.Inventory.OsInfo

items¶

Output only. Inventory items related to the VM keyed by an opaque unique identifier for each inventory item. The identifier is unique to each distinct and addressable inventory item and will change, when there is a new package version.

Type: MutableMapping[str, google.cloud.osconfig_v1alpha.types.Inventory.Item]

update_time¶

Output only. Timestamp of the last reported inventory for the VM.

Type: google.protobuf.timestamp_pb2.Timestamp

class Item(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A single piece of inventory on a VM.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

id¶

Identifier for this item, unique across items for this VM.

Type: str

origin_type¶

The origin of this inventory item.

Type: google.cloud.osconfig_v1alpha.types.Inventory.Item.OriginType

create_time¶

When this inventory item was first detected.

Type: google.protobuf.timestamp_pb2.Timestamp

update_time¶

When this inventory item was last modified.

Type: google.protobuf.timestamp_pb2.Timestamp

type_¶

The specific type of inventory, correlating to its specific details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.Item.Type

installed_package¶

Software package present on the VM instance.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.SoftwarePackage

available_package¶

Software package available to be installed on the VM instance.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.SoftwarePackage

class OriginType(value)[source]¶

Bases: proto.enums.Enum

The origin of a specific inventory item.

Values:

ORIGIN_TYPE_UNSPECIFIED (0):: Invalid. An origin type must be specified.
INVENTORY_REPORT (1):: This inventory item was discovered as the result of the agent reporting inventory via the reporting API.

class Type(value)[source]¶

Bases: proto.enums.Enum

The different types of inventory that are tracked on a VM.

Values:

TYPE_UNSPECIFIED (0):: Invalid. An type must be specified.
INSTALLED_PACKAGE (1):: This represents a package that is installed on the VM.
AVAILABLE_PACKAGE (2):: This represents an update that is available for a package.

class ItemsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶: Bases: proto.message.Message

class OsInfo(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Operating system information for the VM.

hostname¶

The VM hostname.

Type: str

long_name¶

The operating system long name. For example ‘Debian GNU/Linux 9’ or ‘Microsoft Window Server 2019 Datacenter’.

Type: str

short_name¶

The operating system short name. For example, ‘windows’ or ‘debian’.

Type: str

version¶

The version of the operating system.

Type: str

architecture¶

The system architecture of the operating system.

Type: str

kernel_version¶

The kernel version of the operating system.

Type: str

kernel_release¶

The kernel release of the operating system.

Type: str

osconfig_agent_version¶

The current version of the OS Config agent running on the VM.

Type: str

class SoftwarePackage(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Software package information of the operating system.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

yum_package¶

Yum package info. For details about the yum package manager, see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/ch-yum.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.VersionedPackage

apt_package¶

Details of an APT package. For details about the apt package manager, see https://wiki.debian.org/Apt.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.VersionedPackage

zypper_package¶

Details of a Zypper package. For details about the Zypper package manager, see https://en.opensuse.org/SDB:Zypper_manual.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.VersionedPackage

googet_package¶

Details of a Googet package. For details about the googet package manager, see https://github.com/google/googet.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.VersionedPackage

zypper_patch¶

Details of a Zypper patch. For details about the Zypper package manager, see https://en.opensuse.org/SDB:Zypper_manual.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.ZypperPatch

wua_package¶

Details of a Windows Update package. See https://docs.microsoft.com/en-us/windows/win32/api/_wua/ for information about Windows Update.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.WindowsUpdatePackage

qfe_package¶

Details of a Windows Quick Fix engineering package. See https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-quickfixengineering for info in Windows Quick Fix Engineering.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.WindowsQuickFixEngineeringPackage

cos_package¶

Details of a COS package.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.VersionedPackage

windows_application¶

Details of Windows Application.

This field is a member of oneof details.

Type: google.cloud.osconfig_v1alpha.types.Inventory.WindowsApplication

class VersionedPackage(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Information related to the a standard versioned package. This includes package info for APT, Yum, Zypper, and Googet package managers.

package_name¶

The name of the package.

Type: str

architecture¶

The system architecture this package is intended for.

Type: str

version¶

The version of the package.

Type: str

class WindowsApplication(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Contains information about a Windows application that is retrieved from the Windows Registry. For more information about these fields, see:

https://docs.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key

display_name¶

The name of the application or product.

Type: str

display_version¶

The version of the product or application in string format.

Type: str

publisher¶

The name of the manufacturer for the product or application.

Type: str

install_date¶

The last time this product received service. The value of this property is replaced each time a patch is applied or removed from the product or the command-line option is used to repair the product.

Type: google.type.date_pb2.Date

help_link¶

The internet address for technical support.

Type: str

class WindowsQuickFixEngineeringPackage(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Information related to a Quick Fix Engineering package. Fields are taken from Windows QuickFixEngineering Interface and match the source names:

https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-quickfixengineering

caption¶

A short textual description of the QFE update.

Type: str

description¶

A textual description of the QFE update.

Type: str

hot_fix_id¶

Unique identifier associated with a particular QFE update.

Type: str

install_time¶

Date that the QFE update was installed. Mapped from installed_on field.

Type: google.protobuf.timestamp_pb2.Timestamp

class WindowsUpdatePackage(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Details related to a Windows Update package. Field data and names are taken from Windows Update API IUpdate Interface: https://docs.microsoft.com/en-us/windows/win32/api/_wua/ Descriptive fields like title, and description are localized based on the locale of the VM being updated.

title¶

The localized title of the update package.

Type: str

description¶

The localized description of the update package.

Type: str

categories¶

The categories that are associated with this update package.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.Inventory.WindowsUpdatePackage.WindowsUpdateCategory]

kb_article_ids¶

A collection of Microsoft Knowledge Base article IDs that are associated with the update package.

Type: MutableSequence[str]

support_url¶

A hyperlink to the language-specific support information for the update.

Type: str

more_info_urls¶

A collection of URLs that provide more information about the update package.

Type: MutableSequence[str]

update_id¶

Gets the identifier of an update package. Stays the same across revisions.

Type: str

revision_number¶

The revision number of this update package.

Type: int

last_deployment_change_time¶

The last published date of the update, in (UTC) date and time.

Type: google.protobuf.timestamp_pb2.Timestamp

class WindowsUpdateCategory(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Categories specified by the Windows Update.

id¶

The identifier of the windows update category.

Type: str

name¶

The name of the windows update category.

Type: str

class ZypperPatch(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Details related to a Zypper Patch.

patch_name¶

The name of the patch.

Type: str

category¶

The category of the patch.

Type: str

severity¶

The severity specified for this patch

Type: str

summary¶

Any summary information provided about this patch.

Type: str

class google.cloud.osconfig_v1alpha.types.InventoryView(value)[source]¶

Bases: proto.enums.Enum

The view for inventory objects.

Values:

INVENTORY_VIEW_UNSPECIFIED (0):: The default value. The API defaults to the BASIC view.
BASIC (1):: Returns the basic inventory information that includes os_info.
FULL (2):: Returns all fields.

class google.cloud.osconfig_v1alpha.types.ListInstanceOSPoliciesCompliancesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for listing OS policies compliance data for all Compute Engine VMs in the given location.

parent¶

Required. The parent resource name.

Format: projects/{project}/locations/{location}

For {project}, either Compute Engine project-number or project-id can be provided.

Type: str

page_size¶

The maximum number of results to return.

Type: int

page_token¶

A pagination token returned from a previous call to ListInstanceOSPoliciesCompliances that indicates where this listing should continue from.

Type: str

filter¶

If provided, this field specifies the criteria that must be met by a InstanceOSPoliciesCompliance API resource to be included in the response.

Type: str

class google.cloud.osconfig_v1alpha.types.ListInstanceOSPoliciesCompliancesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A response message for listing OS policies compliance data for all Compute Engine VMs in the given location.

instance_os_policies_compliances¶

List of instance OS policies compliance objects.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.InstanceOSPoliciesCompliance]

next_page_token¶

The pagination token to retrieve the next page of instance OS policies compliance objects.

Type: str

class google.cloud.osconfig_v1alpha.types.ListInventoriesRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for listing inventory data for all VMs in the specified location.

parent¶

Required. The parent resource name.

Format: projects/{project}/locations/{location}/instances/-

For {project}, either project-number or project-id can be provided.

Type: str

view¶

Inventory view indicating what information should be included in the inventory resource. If unspecified, the default view is BASIC.

Type: google.cloud.osconfig_v1alpha.types.InventoryView

page_size¶

The maximum number of results to return.

Type: int

page_token¶

A pagination token returned from a previous call to ListInventories that indicates where this listing should continue from.

Type: str

filter¶

If provided, this field specifies the criteria that must be met by a Inventory API resource to be included in the response.

Type: str

class google.cloud.osconfig_v1alpha.types.ListInventoriesResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A response message for listing inventory data for all VMs in a specified location.

inventories¶

List of inventory objects.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.Inventory]

next_page_token¶

The pagination token to retrieve the next page of inventory objects.

Type: str

class google.cloud.osconfig_v1alpha.types.ListOSPolicyAssignmentReportsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

List the OS policy assignment reports for VM instances.

parent¶

Required. The parent resource name.

Format: projects/{project}/locations/{location}/instances/{instance}/osPolicyAssignments/{assignment}/reports

For {project}, either project-number or project-id can be provided. For {instance}, either instance-name, instance-id, or - can be provided. If ‘-’ is provided, the response will include OSPolicyAssignmentReports for all instances in the project/location. For {assignment}, either assignment-id or - can be provided. If ‘-’ is provided, the response will include OSPolicyAssignmentReports for all OSPolicyAssignments in the project/location. Either {instance} or {assignment} must be -.

For example: projects/{project}/locations/{location}/instances/{instance}/osPolicyAssignments/-/reports returns all reports for the instance projects/{project}/locations/{location}/instances/-/osPolicyAssignments/{assignment-id}/reports returns all the reports for the given assignment across all instances. projects/{project}/locations/{location}/instances/-/osPolicyAssignments/-/reports returns all the reports for all assignments across all instances.

Type: str

page_size¶

The maximum number of results to return.

Type: int

filter¶

If provided, this field specifies the criteria that must be met by the OSPolicyAssignmentReport API resource that is included in the response.

Type: str

page_token¶

A pagination token returned from a previous call to the ListOSPolicyAssignmentReports method that indicates where this listing should continue from.

Type: str

class google.cloud.osconfig_v1alpha.types.ListOSPolicyAssignmentReportsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A response message for listing OS Policy assignment reports including the page of results and page token.

os_policy_assignment_reports¶

List of OS policy assignment reports.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport]

next_page_token¶

The pagination token to retrieve the next page of OS policy assignment report objects.

Type: str

class google.cloud.osconfig_v1alpha.types.ListOSPolicyAssignmentRevisionsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message to list revisions for a OS policy assignment

name¶

Required. The name of the OS policy assignment to list revisions for.

Type: str

page_size¶

The maximum number of revisions to return.

Type: int

page_token¶

A pagination token returned from a previous call to ListOSPolicyAssignmentRevisions that indicates where this listing should continue from.

Type: str

class google.cloud.osconfig_v1alpha.types.ListOSPolicyAssignmentRevisionsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A response message for listing all revisions for a OS policy assignment.

os_policy_assignments¶

The OS policy assignment revisions

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignment]

next_page_token¶

The pagination token to retrieve the next page of OS policy assignment revisions.

Type: str

class google.cloud.osconfig_v1alpha.types.ListOSPolicyAssignmentsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message to list OS policy assignments for a parent resource

parent¶

Required. The parent resource name.

Type: str

page_size¶

The maximum number of assignments to return.

Type: int

page_token¶

A pagination token returned from a previous call to ListOSPolicyAssignments that indicates where this listing should continue from.

Type: str

class google.cloud.osconfig_v1alpha.types.ListOSPolicyAssignmentsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A response message for listing all assignments under given parent.

os_policy_assignments¶

The list of assignments

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignment]

next_page_token¶

The pagination token to retrieve the next page of OS policy assignments.

Type: str

class google.cloud.osconfig_v1alpha.types.ListVulnerabilityReportsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message for listing vulnerability reports for all VM instances in the specified location.

parent¶

Required. The parent resource name.

Format: projects/{project}/locations/{location}/instances/-

For {project}, either project-number or project-id can be provided.

Type: str

page_size¶

The maximum number of results to return.

Type: int

page_token¶

A pagination token returned from a previous call to ListVulnerabilityReports that indicates where this listing should continue from.

Type: str

filter¶

If provided, this field specifies the criteria that must be met by a vulnerabilityReport API resource to be included in the response.

Type: str

class google.cloud.osconfig_v1alpha.types.ListVulnerabilityReportsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A response message for listing vulnerability reports for all VM instances in the specified location.

vulnerability_reports¶

List of vulnerabilityReport objects.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.VulnerabilityReport]

next_page_token¶

The pagination token to retrieve the next page of vulnerabilityReports object.

Type: str

class google.cloud.osconfig_v1alpha.types.OSPolicy(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

An OS policy defines the desired state configuration for a VM.

id¶

Required. The id of the OS policy with the following restrictions:

Must contain only lowercase letters, numbers, and hyphens.
Must start with a letter.
Must be between 1-63 characters.
Must end with a number or a letter.
Must be unique within the assignment.

Type: str

description¶

Policy description. Length of the description is limited to 1024 characters.

Type: str

mode¶

Required. Policy mode

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Mode

resource_groups¶

Required. List of resource groups for the policy. For a particular VM, resource groups are evaluated in the order specified and the first resource group that is applicable is selected and the rest are ignored.

If none of the resource groups are applicable for a VM, the VM is considered to be non-compliant w.r.t this policy. This behavior can be toggled by the flag allow_no_resource_group_match

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicy.ResourceGroup]

allow_no_resource_group_match¶

This flag determines the OS policy compliance status when none of the resource groups within the policy are applicable for a VM. Set this value to true if the policy needs to be reported as compliant even if the policy has nothing to validate or enforce.

Type: bool

class InventoryFilter(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Filtering criteria to select VMs based on inventory details.

os_short_name¶

Required. The OS short name

Type: str

os_version¶

The OS version

Prefix matches are supported if asterisk(*) is provided as the last character. For example, to match all versions with a major version of 7, specify the following value for this field 7.*

An empty string matches all OS versions.

Type: str

class Mode(value)[source]¶

Bases: proto.enums.Enum

Policy mode

Values:

MODE_UNSPECIFIED (0):: Invalid mode
VALIDATION (1):: This mode checks if the configuration resources in the policy are in their desired state. No actions are performed if they are not in the desired state. This mode is used for reporting purposes.
ENFORCEMENT (2):: This mode checks if the configuration resources in the policy are in their desired state, and if not, enforces the desired state.

class OSFilter(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Filtering criteria to select VMs based on OS details.

os_short_name¶

This should match OS short name emitted by the OS inventory agent. An empty value matches any OS.

Type: str

os_version¶

This value should match the version emitted by the OS inventory agent. Prefix matches are supported if asterisk(*) is provided as the last character. For example, to match all versions with a major version of 7, specify the following value for this field 7.*

Type: str

class Resource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

An OS policy resource is used to define the desired state configuration and provides a specific functionality like installing/removing packages, executing a script etc.

The system ensures that resources are always in their desired state by taking necessary actions if they have drifted from their desired state.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

id¶

Required. The id of the resource with the following restrictions:

Must contain only lowercase letters, numbers, and hyphens.
Must start with a letter.
Must be between 1-63 characters.
Must end with a number or a letter.
Must be unique within the OS policy.

Type: str

pkg¶

Package resource

This field is a member of oneof resource_type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource

repository¶

Package repository resource

This field is a member of oneof resource_type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.RepositoryResource

exec_¶

Exec resource

This field is a member of oneof resource_type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.ExecResource

file¶

File resource

This field is a member of oneof resource_type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.FileResource

class ExecResource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A resource that allows executing scripts on the VM.

The ExecResource has 2 stages: validate and enforce and both stages accept a script as an argument to execute.

When the ExecResource is applied by the agent, it first executes the script in the validate stage. The validate stage can signal that the ExecResource is already in the desired state by returning an exit code of 100. If the ExecResource is not in the desired state, it should return an exit code of 101. Any other exit code returned by this stage is considered an error.

If the ExecResource is not in the desired state based on the exit code from the validate stage, the agent proceeds to execute the script from the enforce stage. If the ExecResource is already in the desired state, the enforce stage will not be run. Similar to validate stage, the enforce stage should return an exit code of 100 to indicate that the resource in now in its desired state. Any other exit code is considered an error.

NOTE: An exit code of 100 was chosen over 0 (and 101 vs 1) to have an explicit indicator of in desired state, not in desired state and errors. Because, for example, Powershell will always return an exit code of 0 unless an exit statement is provided in the script. So, for reasons of consistency and being explicit, exit codes 100 and 101 were chosen.

validate¶

Required. What to run to validate this resource is in the desired state. An exit code of 100 indicates “in desired state”, and exit code of 101 indicates “not in desired state”. Any other exit code indicates a failure running validate.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.ExecResource.Exec

enforce¶

What to run to bring this resource into the desired state. An exit code of 100 indicates “success”, any other exit code indicates a failure running enforce.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.ExecResource.Exec

class Exec(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A file or script to execute.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

file¶

A remote or local file.

This field is a member of oneof source.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File

script¶

An inline script. The size of the script is limited to 1024 characters.

This field is a member of oneof source.

Type: str

args¶

Optional arguments to pass to the source during execution.

Type: MutableSequence[str]

interpreter¶

Required. The script interpreter to use.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.ExecResource.Exec.Interpreter

output_file_path¶

Only recorded for enforce Exec. Path to an output file (that is created by this Exec) whose content will be recorded in OSPolicyResourceCompliance after a successful run. Absence or failure to read this file will result in this ExecResource being non-compliant. Output file size is limited to 100K bytes.

Type: str

class Interpreter(value)[source]¶

Bases: proto.enums.Enum

The interpreter to use.

Values:

INTERPRETER_UNSPECIFIED (0):: Invalid value, the request will return validation error.
NONE (1):: If an interpreter is not specified, the source is executed directly. This execution, without an interpreter, only succeeds for executables and scripts that have shebang lines.
SHELL (2):: Indicates that the script runs with /bin/sh on Linux and cmd.exe on Windows.
POWERSHELL (3):: Indicates that the script runs with PowerShell.

class File(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A remote or local file.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

remote¶

A generic remote file.

This field is a member of oneof type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File.Remote

gcs¶

A Cloud Storage object.

This field is a member of oneof type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File.Gcs

local_path¶

A local path within the VM to use.

This field is a member of oneof type.

Type: str

allow_insecure¶

Defaults to false. When false, files are subject to validations based on the file type:

Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

Type: bool

class Gcs(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Specifies a file available as a Cloud Storage Object.

bucket¶

Required. Bucket of the Cloud Storage object.

Type: str

object_¶

Required. Name of the Cloud Storage object.

Type: str

generation¶

Generation number of the Cloud Storage object.

Type: int

class Remote(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Specifies a file available via some URI.

uri¶

Required. URI from which to fetch the object. It should contain both the protocol and path following the format {protocol}://{location}.

Type: str

sha256_checksum¶

SHA256 checksum of the remote file.

Type: str

class FileResource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A resource that manages the state of a file.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

file¶

A remote or local source.

This field is a member of oneof source.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File

content¶

A a file with this content. The size of the content is limited to 1024 characters.

This field is a member of oneof source.

Type: str

path¶

Required. The absolute path of the file within the VM.

Type: str

state¶

Required. Desired state of the file.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.FileResource.DesiredState

permissions¶

Consists of three octal digits which represent, in order, the permissions of the owner, group, and other users for the file (similarly to the numeric mode used in the linux chmod utility). Each digit represents a three bit number with the 4 bit corresponding to the read permissions, the 2 bit corresponds to the write bit, and the one bit corresponds to the execute permission. Default behavior is 755.

Below are some examples of permissions and their associated values:

read, write, and execute: 7 read and execute: 5 read and write: 6 read only: 4

Type: str

class DesiredState(value)[source]¶

Bases: proto.enums.Enum

Desired state of the file.

Values:

DESIRED_STATE_UNSPECIFIED (0):: Unspecified is invalid.
PRESENT (1):: Ensure file at path is present.
ABSENT (2):: Ensure file at path is absent.
CONTENTS_MATCH (3):: Ensure the contents of the file at path matches. If the file does not exist it will be created.

class PackageResource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A resource that manages a system package.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

desired_state¶

Required. The desired state the agent should maintain for this package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.DesiredState

apt¶

A package managed by Apt.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.APT

deb¶

A deb package file.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.Deb

yum¶

A package managed by YUM.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.YUM

zypper¶

A package managed by Zypper.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.Zypper

rpm¶

An rpm package file.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.RPM

googet¶

A package managed by GooGet.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.GooGet

msi¶

An MSI package.

This field is a member of oneof system_package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.PackageResource.MSI

class APT(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A package managed by APT.

install: apt-get update && apt-get -y install [name]
remove: apt-get -y remove [name]

name¶

Required. Package name.

Type: str

class Deb(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A deb package file. dpkg packages only support INSTALLED state.

source¶

Required. A deb package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File

pull_deps¶

Whether dependencies should also be installed.

install when false: dpkg -i package
install when true: apt-get update && apt-get -y install package.deb

Type: bool

class DesiredState(value)[source]¶

Bases: proto.enums.Enum

The desired state that the OS Config agent maintains on the VM.

Values:

DESIRED_STATE_UNSPECIFIED (0):: Unspecified is invalid.
INSTALLED (1):: Ensure that the package is installed.
REMOVED (2):: The agent ensures that the package is not installed and uninstalls it if detected.

class GooGet(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A package managed by GooGet.

install: googet -noconfirm install package
remove: googet -noconfirm remove package

name¶

Required. Package name.

Type: str

class MSI(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

An MSI package. MSI packages only support INSTALLED state.

source¶

Required. The MSI package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File

properties¶

Additional properties to use during installation. This should be in the format of Property=Setting. Appended to the defaults of ACTION=INSTALL REBOOT=ReallySuppress.

Type: MutableSequence[str]

class RPM(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

An RPM package file. RPM packages only support INSTALLED state.

source¶

Required. An rpm package.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.File

pull_deps¶

Whether dependencies should also be installed.

install when false: rpm --upgrade --replacepkgs package.rpm
install when true: yum -y install package.rpm or zypper -y install package.rpm

Type: bool

class YUM(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A package managed by YUM.

install: yum -y install package
remove: yum -y remove package

name¶

Required. Package name.

Type: str

class Zypper(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A package managed by Zypper.

install: zypper -y install package
remove: zypper -y rm package

name¶

Required. Package name.

Type: str

class RepositoryResource(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A resource that manages a package repository.

This message has oneof fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

apt¶

An Apt Repository.

This field is a member of oneof repository.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.RepositoryResource.AptRepository

yum¶

A Yum Repository.

This field is a member of oneof repository.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.RepositoryResource.YumRepository

zypper¶

A Zypper Repository.

This field is a member of oneof repository.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.RepositoryResource.ZypperRepository

goo¶

A Goo Repository.

This field is a member of oneof repository.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.RepositoryResource.GooRepository

class AptRepository(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Represents a single apt package repository. These will be added to a repo file that will be managed at /etc/apt/sources.list.d/google_osconfig.list.

archive_type¶

Required. Type of archive files in this repository.

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.Resource.RepositoryResource.AptRepository.ArchiveType

uri¶

Required. URI for this repository.

Type: str

distribution¶

Required. Distribution of this repository.

Type: str

components¶

Required. List of components for this repository. Must contain at least one item.

Type: MutableSequence[str]

gpg_key¶

URI of the key file for this repository. The agent maintains a keyring at /etc/apt/trusted.gpg.d/osconfig_agent_managed.gpg.

Type: str

class ArchiveType(value)[source]¶

Bases: proto.enums.Enum

Type of archive.

Values:

ARCHIVE_TYPE_UNSPECIFIED (0):: Unspecified is invalid.
DEB (1):: Deb indicates that the archive contains binary files.
DEB_SRC (2):: Deb-src indicates that the archive contains source files.

class GooRepository(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Represents a Goo package repository. These are added to a repo file that is managed at C:/ProgramData/GooGet/repos/google_osconfig.repo.

name¶

Required. The name of the repository.

Type: str

url¶

Required. The url of the repository.

Type: str

class YumRepository(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Represents a single yum package repository. These are added to a repo file that is managed at /etc/yum.repos.d/google_osconfig.repo.

id¶

Required. A one word, unique name for this repository. This is the repo id in the yum config file and also the display_name if display_name is omitted. This id is also used as the unique identifier when checking for resource conflicts.

Type: str

display_name¶

The display name of the repository.

Type: str

base_url¶

Required. The location of the repository directory.

Type: str

gpg_keys¶

URIs of GPG keys.

Type: MutableSequence[str]

class ZypperRepository(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Represents a single zypper package repository. These are added to a repo file that is managed at /etc/zypp/repos.d/google_osconfig.repo.

id¶

Required. A one word, unique name for this repository. This is the repo id in the zypper config file and also the display_name if display_name is omitted. This id is also used as the unique identifier when checking for GuestPolicy conflicts.

Type: str

display_name¶

The display name of the repository.

Type: str

base_url¶

Required. The location of the repository directory.

Type: str

gpg_keys¶

URIs of GPG keys.

Type: MutableSequence[str]

class ResourceGroup(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Resource groups provide a mechanism to group OS policy resources.

Resource groups enable OS policy authors to create a single OS policy to be applied to VMs running different operating Systems.

When the OS policy is applied to a target VM, the appropriate resource group within the OS policy is selected based on the OSFilter specified within the resource group.

os_filter¶

Deprecated. Use the inventory_filters field instead. Used to specify the OS filter for a resource group

Type: google.cloud.osconfig_v1alpha.types.OSPolicy.OSFilter

inventory_filters¶

List of inventory filters for the resource group.

The resources in this resource group are applied to the target VM if it satisfies at least one of the following inventory filters.

For example, to apply this resource group to VMs running either RHEL or CentOS operating systems, specify 2 items for the list with following values: inventory_filters[0].os_short_name=’rhel’ and inventory_filters[1].os_short_name=’centos’

If the list is empty, this resource group will be applied to the target VM unconditionally.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicy.InventoryFilter]

resources¶

Required. List of resources configured for this resource group. The resources are executed in the exact order specified here.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicy.Resource]

class google.cloud.osconfig_v1alpha.types.OSPolicyAssignment(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

OS policy assignment is an API resource that is used to apply a set of OS policies to a dynamically targeted group of Compute Engine VM instances.

An OS policy is used to define the desired state configuration for a Compute Engine VM instance through a set of configuration resources that provide capabilities such as installing or removing software packages, or executing a script.

For more information, see OS policy and OS policy assignment.

name¶

Resource name.

Format: projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id}

This field is ignored when you create an OS policy assignment.

Type: str

description¶

OS policy assignment description. Length of the description is limited to 1024 characters.

Type: str

os_policies¶

Required. List of OS policies to be applied to the VMs.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicy]

instance_filter¶

Required. Filter to select VMs.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignment.InstanceFilter

rollout¶

Required. Rollout to deploy the OS policy assignment. A rollout is triggered in the following situations:

OSPolicyAssignment is created.
OSPolicyAssignment is updated and the update contains changes to one of the following fields:
- instance_filter
- os_policies
OSPolicyAssignment is deleted.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignment.Rollout

revision_id¶

Output only. The assignment revision ID A new revision is committed whenever a rollout is triggered for a OS policy assignment

Type: str

revision_create_time¶

Output only. The timestamp that the revision was created.

Type: google.protobuf.timestamp_pb2.Timestamp

etag¶

The etag for this OS policy assignment. If this is provided on update, it must match the server’s etag.

Type: str

rollout_state¶

Output only. OS policy assignment rollout state

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignment.RolloutState

baseline¶

Output only. Indicates that this revision has been successfully rolled out in this zone and new VMs will be assigned OS policies from this revision.

For a given OS policy assignment, there is only one revision with a value of true for this field.

Type: bool

deleted¶

Output only. Indicates that this revision deletes the OS policy assignment.

Type: bool

reconciling¶

Output only. Indicates that reconciliation is in progress for the revision. This value is true when the rollout_state is one of:

IN_PROGRESS
CANCELLING

Type: bool

uid¶

Output only. Server generated unique id for the OS policy assignment resource.

Type: str

class InstanceFilter(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Filters to select target VMs for an assignment.

If more than one filter criteria is specified below, a VM will be selected if and only if it satisfies all of them.

all_¶

Target all VMs in the project. If true, no other criteria is permitted.

Type: bool

os_short_names¶

Deprecated. Use the inventories field instead. A VM is selected if it’s OS short name matches with any of the values provided in this list.

Type: MutableSequence[str]

inclusion_labels¶

List of label sets used for VM inclusion.

If the list has more than one LabelSet, the VM is included if any of the label sets are applicable for the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignment.LabelSet]

exclusion_labels¶

List of label sets used for VM exclusion.

If the list has more than one label set, the VM is excluded if any of the label sets are applicable for the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignment.LabelSet]

inventories¶

List of inventories to select VMs.

A VM is selected if its inventory data matches at least one of the following inventories.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignment.InstanceFilter.Inventory]

class Inventory(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

VM inventory details.

os_short_name¶

Required. The OS short name

Type: str

os_version¶

The OS version

Prefix matches are supported if asterisk(*) is provided as the last character. For example, to match all versions with a major version of 7, specify the following value for this field 7.*

An empty string matches all OS versions.

Type: str

class LabelSet(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Message representing label set.

A label is a key value pair set for a VM.
A LabelSet is a set of labels.
Labels within a LabelSet are ANDed. In other words, a LabelSet is applicable for a VM only if it matches all the labels in the LabelSet.
Example: A LabelSet with 2 labels: env=prod and type=webserver will only be applicable for those VMs with both labels present.

labels¶

Labels are identified by key/value pairs in this map. A VM should contain all the key/value pairs specified in this map to be selected.

Type: MutableMapping[str, str]

class LabelsEntry(mapping=None, *, ignore_unknown_fields=False, **kwargs)¶: Bases: proto.message.Message

class Rollout(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Message to configure the rollout at the zonal level for the OS policy assignment.

disruption_budget¶

Required. The maximum number (or percentage) of VMs per zone to disrupt at any given moment.

Type: google.cloud.osconfig_v1alpha.types.FixedOrPercent

min_wait_duration¶

Required. This determines the minimum duration of time to wait after the configuration changes are applied through the current rollout. A VM continues to count towards the disruption_budget at least until this duration of time has passed after configuration changes are applied.

Type: google.protobuf.duration_pb2.Duration

class RolloutState(value)[source]¶

Bases: proto.enums.Enum

OS policy assignment rollout state

Values:

ROLLOUT_STATE_UNSPECIFIED (0):: Invalid value
IN_PROGRESS (1):: The rollout is in progress.
CANCELLING (2):: The rollout is being cancelled.
CANCELLED (3):: The rollout is cancelled.
SUCCEEDED (4):: The rollout has completed successfully.

class google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentOperationMetadata(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

OS policy assignment operation metadata provided by OS policy assignment API methods that return long running operations.

os_policy_assignment¶

Reference to the OSPolicyAssignment API resource.

Format: projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}

Type: str

api_method¶

The OS policy assignment API method.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentOperationMetadata.APIMethod

rollout_state¶

State of the rollout

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentOperationMetadata.RolloutState

rollout_start_time¶

Rollout start time

Type: google.protobuf.timestamp_pb2.Timestamp

rollout_update_time¶

Rollout update time

Type: google.protobuf.timestamp_pb2.Timestamp

class APIMethod(value)[source]¶

Bases: proto.enums.Enum

The OS policy assignment API method.

Values:

API_METHOD_UNSPECIFIED (0):: Invalid value
CREATE (1):: Create OS policy assignment API method
UPDATE (2):: Update OS policy assignment API method
DELETE (3):: Delete OS policy assignment API method

class RolloutState(value)[source]¶

Bases: proto.enums.Enum

State of the rollout

Values:

ROLLOUT_STATE_UNSPECIFIED (0):: Invalid value
IN_PROGRESS (1):: The rollout is in progress.
CANCELLING (2):: The rollout is being cancelled.
CANCELLED (3):: The rollout is cancelled.
SUCCEEDED (4):: The rollout has completed successfully.

class google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A report of the OS policy assignment status for a given instance.

name¶

The OSPolicyAssignmentReport API resource name.

Format: projects/{project_number}/locations/{location}/instances/{instance_id}/osPolicyAssignments/{os_policy_assignment_id}/report

Type: str

instance¶

The Compute Engine VM instance name.

Type: str

os_policy_assignment¶

Reference to the OSPolicyAssignment API resource that the OSPolicy belongs to.

Format: projects/{project_number}/locations/{location}/osPolicyAssignments/{os_policy_assignment_id@revision_id}

Type: str

os_policy_compliances¶

Compliance data for each OSPolicy that is applied to the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance]

update_time¶

Timestamp for when the report was last generated.

Type: google.protobuf.timestamp_pb2.Timestamp

last_run_id¶

Unique identifier of the last attempted run to apply the OS policies associated with this assignment on the VM.

This ID is logged by the OS Config agent while applying the OS policies associated with this assignment on the VM. NOTE: If the service is unable to successfully connect to the agent for this run, then this id will not be available in the agent logs.

Type: str

class OSPolicyCompliance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Compliance data for an OS policy

os_policy_id¶

The OS policy id

Type: str

compliance_state¶

The compliance state of the OS policy.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance.ComplianceState

compliance_state_reason¶

The reason for the OS policy to be in an unknown compliance state. This field is always populated when compliance_state is UNKNOWN.

If populated, the field can contain one of the following values:

vm-not-running: The VM was not running.
os-policies-not-supported-by-agent: The version of the OS Config agent running on the VM does not support running OS policies.
no-agent-detected: The OS Config agent is not detected for the VM.
resource-execution-errors: The OS Config agent encountered errors while executing one or more resources in the policy. See os_policy_resource_compliances for details.
task-timeout: The task sent to the agent to apply the policy timed out.
unexpected-agent-state: The OS Config agent did not report the final status of the task that attempted to apply the policy. Instead, the agent unexpectedly started working on a different task. This mostly happens when the agent or VM unexpectedly restarts while applying OS policies.
internal-service-errors: Internal service errors were encountered while attempting to apply the policy.

Type: str

os_policy_resource_compliances¶

Compliance data for each resource within the policy that is applied to the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance.OSPolicyResourceCompliance]

class ComplianceState(value)[source]¶

Bases: proto.enums.Enum

Possible compliance states for an os policy.

Values:

UNKNOWN (0):

The policy is in an unknown compliance state.

Refer to the field compliance_state_reason to learn the exact reason for the policy to be in this compliance state.

COMPLIANT (1):

Policy is compliant.

The policy is compliant if all the underlying resources are also compliant.

NON_COMPLIANT (2):

Policy is non-compliant.

The policy is non-compliant if one or more underlying resources are non-compliant.

class OSPolicyResourceCompliance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Compliance data for an OS policy resource.

os_policy_resource_id¶

The ID of the OS policy resource.

Type: str

config_steps¶

Ordered list of configuration completed by the agent for the OS policy resource.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance.OSPolicyResourceCompliance.OSPolicyResourceConfigStep]

compliance_state¶

The compliance state of the resource.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance.OSPolicyResourceCompliance.ComplianceState

compliance_state_reason¶

A reason for the resource to be in the given compliance state. This field is always populated when compliance_state is UNKNOWN.

The following values are supported when compliance_state == UNKNOWN

execution-errors: Errors were encountered by the agent while executing the resource and the compliance state couldn’t be determined.
execution-skipped-by-agent: Resource execution was skipped by the agent because errors were encountered while executing prior resources in the OS policy.
os-policy-execution-attempt-failed: The execution of the OS policy containing this resource failed and the compliance state couldn’t be determined.

Type: str

exec_resource_output¶

ExecResource specific output.

This field is a member of oneof output.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance.OSPolicyResourceCompliance.ExecResourceOutput

class ComplianceState(value)[source]¶

Bases: proto.enums.Enum

Possible compliance states for a resource.

Values:

UNKNOWN (0):

The resource is in an unknown compliance state.

To get more details about why the policy is in this state, review the output of the compliance_state_reason field.

COMPLIANT (1):

Resource is compliant.

NON_COMPLIANT (2):

Resource is non-compliant.

class ExecResourceOutput(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

ExecResource specific output.

enforcement_output¶

Output from enforcement phase output file (if run). Output size is limited to 100K bytes.

Type: bytes

class OSPolicyResourceConfigStep(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Step performed by the OS Config agent for configuring an OSPolicy resource to its desired state.

type_¶

Configuration step type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignmentReport.OSPolicyCompliance.OSPolicyResourceCompliance.OSPolicyResourceConfigStep.Type

error_message¶

An error message recorded during the execution of this step. Only populated if errors were encountered during this step execution.

Type: str

class Type(value)[source]¶

Bases: proto.enums.Enum

Supported configuration step types

Values:

TYPE_UNSPECIFIED (0):

Default value. This value is unused.

VALIDATION (1):

Checks for resource conflicts such as schema errors.

DESIRED_STATE_CHECK (2):

Checks the current status of the desired state for a resource.

DESIRED_STATE_ENFORCEMENT (3):

Enforces the desired state for a resource that is not in desired state.

DESIRED_STATE_CHECK_POST_ENFORCEMENT (4):

Re-checks the status of the desired state. This check is done for a resource after the enforcement of all OS policies.

This step is used to determine the final desired state status for the resource. It accounts for any resources that might have drifted from their desired state due to side effects from executing other resources.

class google.cloud.osconfig_v1alpha.types.OSPolicyComplianceState(value)[source]¶

Bases: proto.enums.Enum

Supported OSPolicy compliance states.

Values:

OS_POLICY_COMPLIANCE_STATE_UNSPECIFIED (0):: Default value. This value is unused.
COMPLIANT (1):: Compliant state.
NON_COMPLIANT (2):: Non-compliant state
UNKNOWN (3):: Unknown compliance state.
NO_OS_POLICIES_APPLICABLE (4):: No applicable OS policies were found for the instance. This state is only applicable to the instance.

class google.cloud.osconfig_v1alpha.types.OSPolicyResourceCompliance(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Compliance data for an OS policy resource.

os_policy_resource_id¶

The id of the OS policy resource.

Type: str

config_steps¶

Ordered list of configuration steps taken by the agent for the OS policy resource.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.OSPolicyResourceConfigStep]

state¶

Compliance state of the OS policy resource.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyComplianceState

exec_resource_output¶

ExecResource specific output.

This field is a member of oneof output.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyResourceCompliance.ExecResourceOutput

class ExecResourceOutput(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

ExecResource specific output.

enforcement_output¶

Output from Enforcement phase output file (if run). Output size is limited to 100K bytes.

Type: bytes

class google.cloud.osconfig_v1alpha.types.OSPolicyResourceConfigStep(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Step performed by the OS Config agent for configuring an OSPolicyResource to its desired state.

type_¶

Configuration step type.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyResourceConfigStep.Type

outcome¶

Outcome of the configuration step.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyResourceConfigStep.Outcome

error_message¶

An error message recorded during the execution of this step. Only populated when outcome is FAILED.

Type: str

class Outcome(value)[source]¶

Bases: proto.enums.Enum

Supported outcomes for a configuration step.

Values:

OUTCOME_UNSPECIFIED (0):: Default value. This value is unused.
SUCCEEDED (1):: The step succeeded.
FAILED (2):: The step failed.

class Type(value)[source]¶

Bases: proto.enums.Enum

Supported configuration step types

Values:

TYPE_UNSPECIFIED (0):

Default value. This value is unused.

VALIDATION (1):

Validation to detect resource conflicts, schema errors, etc.

DESIRED_STATE_CHECK (2):

Check the current desired state status of the resource.

DESIRED_STATE_ENFORCEMENT (3):

Enforce the desired state for a resource that is not in desired state.

DESIRED_STATE_CHECK_POST_ENFORCEMENT (4):

Re-check desired state status for a resource after enforcement of all resources in the current configuration run.

This step is used to determine the final desired state status for the resource. It accounts for any resources that might have drifted from their desired state due to side effects from configuring other resources during the current configuration run.

class google.cloud.osconfig_v1alpha.types.UpdateOSPolicyAssignmentRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A request message to update an OS policy assignment

os_policy_assignment¶

Required. The updated OS policy assignment.

Type: google.cloud.osconfig_v1alpha.types.OSPolicyAssignment

update_mask¶

Optional. Field mask that controls which fields of the assignment should be updated.

Type: google.protobuf.field_mask_pb2.FieldMask

class google.cloud.osconfig_v1alpha.types.VulnerabilityReport(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

This API resource represents the vulnerability report for a specified Compute Engine virtual machine (VM) instance at a given point in time.

For more information, see Vulnerability reports.

name¶

Output only. The vulnerabilityReport API resource name.

Format: projects/{project_number}/locations/{location}/instances/{instance_id}/vulnerabilityReport

Type: str

vulnerabilities¶

Output only. List of vulnerabilities affecting the VM.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.VulnerabilityReport.Vulnerability]

update_time¶

Output only. The timestamp for when the last vulnerability report was generated for the VM.

Type: google.protobuf.timestamp_pb2.Timestamp

class Vulnerability(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A vulnerability affecting the VM instance.

details¶

Contains metadata as per the upstream feed of the operating system and NVD.

Type: google.cloud.osconfig_v1alpha.types.VulnerabilityReport.Vulnerability.Details

installed_inventory_item_ids¶

Corresponds to the INSTALLED_PACKAGE inventory item on the VM. This field displays the inventory items affected by this vulnerability. If the vulnerability report was not updated after the VM inventory update, these values might not display in VM inventory. For some distros, this field may be empty.

Type: MutableSequence[str]

available_inventory_item_ids¶

Corresponds to the AVAILABLE_PACKAGE inventory item on the VM. If the vulnerability report was not updated after the VM inventory update, these values might not display in VM inventory. If there is no available fix, the field is empty. The inventory_item value specifies the latest SoftwarePackage available to the VM that fixes the vulnerability.

Type: MutableSequence[str]

create_time¶

The timestamp for when the vulnerability was first detected.

Type: google.protobuf.timestamp_pb2.Timestamp

update_time¶

The timestamp for when the vulnerability was last modified.

Type: google.protobuf.timestamp_pb2.Timestamp

items¶

List of items affected by the vulnerability.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.VulnerabilityReport.Vulnerability.Item]

class Details(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

Contains metadata information for the vulnerability. This information is collected from the upstream feed of the operating system.

cve¶

The CVE of the vulnerability. CVE cannot be empty and the combination of <cve, classification> should be unique across vulnerabilities for a VM.

Type: str

cvss_v2_score¶

The CVSS V2 score of this vulnerability. CVSS V2 score is on a scale of 0 - 10 where 0 indicates low severity and 10 indicates high severity.

Type: float

cvss_v3¶

The full description of the CVSSv3 for this vulnerability from NVD.

Type: google.cloud.osconfig_v1alpha.types.CVSSv3

severity¶

Assigned severity/impact ranking from the distro.

Type: str

description¶

The note or description describing the vulnerability from the distro.

Type: str

references¶

Corresponds to the references attached to the VulnerabilityDetails.

Type: MutableSequence[google.cloud.osconfig_v1alpha.types.VulnerabilityReport.Vulnerability.Details.Reference]

class Reference(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

A reference for this vulnerability.

url¶

The url of the reference.

Type: str

source¶

The source of the reference e.g. NVD.

Type: str

class Item(mapping=None, *, ignore_unknown_fields=False, **kwargs)[source]¶

Bases: proto.message.Message

OS inventory item that is affected by a vulnerability or fixed as a result of a vulnerability.

installed_inventory_item_id¶

Corresponds to the INSTALLED_PACKAGE inventory item on the VM. This field displays the inventory items affected by this vulnerability. If the vulnerability report was not updated after the VM inventory update, these values might not display in VM inventory. For some operating systems, this field might be empty.

Type: str

available_inventory_item_id¶

Corresponds to the AVAILABLE_PACKAGE inventory item on the VM. If the vulnerability report was not updated after the VM inventory update, these values might not display in VM inventory. If there is no available fix, the field is empty. The inventory_item value specifies the latest SoftwarePackage available to the VM that fixes the vulnerability.

Type: str

fixed_cpe_uri¶

The recommended CPE URI update that contains a fix for this vulnerability.

Type: str

upstream_fix¶

The upstream OS patch, packages or KB that fixes the vulnerability.

Type: str

Types for Google Cloud Osconfig v1alpha API¶

google-cloud-os-config

Navigation

Related Topics