mmv1/products/accesscontextmanager/AccessLevel.yaml [103:227]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    properties:
      - name: 'combiningFunction'
        type: Enum
        description: |
          How the conditions list should be combined to determine if a request
          is granted this AccessLevel. If AND is used, each Condition in
          conditions must be satisfied for the AccessLevel to be applied. If
          OR is used, at least one Condition in conditions must be satisfied
          for the AccessLevel to be applied.
        custom_flatten: 'templates/terraform/custom_flatten/default_if_empty.tmpl'
        default_value: "AND"
        enum_values:
          - 'AND'
          - 'OR'
      # All of the false defaults below here are omitted on purpose.
      # Let's keep this as simple as possible, since they will all be set by the API.
      - name: 'conditions'
        type: Array
        description: |
          A set of requirements for the AccessLevel to be granted.
        required: true
        item_type:
          type: NestedObject
          properties:
            - name: 'ipSubnetworks'
              type: Array
              description: |
                A list of CIDR block IP subnetwork specification. May be IPv4
                or IPv6.
                Note that for a CIDR IP address block, the specified IP address
                portion must be properly truncated (i.e. all the host bits must
                be zero) or the input is considered malformed. For example,
                "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,
                for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"
                is not. The originating IP of a request must be in one of the
                listed subnets in order for this Condition to be true.
                If empty, all IP addresses are allowed.
              item_type:
                type: String
            - name: 'requiredAccessLevels'
              type: Array
              description: |
                A list of other access levels defined in the same Policy,
                referenced by resource name. Referencing an AccessLevel which
                does not exist is an error. All access levels listed must be
                granted for the Condition to be true.
                Format: accessPolicies/{policy_id}/accessLevels/{short_name}
              item_type:
                type: String
            - name: 'members'
              type: Array
              description: |
                An allowed list of members (users, service accounts).
                Using groups is not supported yet.

                The signed-in user originating the request must be a part of one
                of the provided members. If not specified, a request may come
                from any user (logged in/not logged in, not present in any
                groups, etc.).
                Formats: `user:{emailid}`, `serviceAccount:{emailid}`
              item_type:
                type: String
            - name: 'negate'
              type: Boolean
              description: |
                Whether to negate the Condition. If true, the Condition becomes
                a NAND over its non-empty fields, each field must be false for
                the Condition overall to be satisfied. Defaults to false.
            - name: 'devicePolicy'
              type: NestedObject
              description: |
                Device specific restrictions, all restrictions must hold for
                the Condition to be true. If not specified, all devices are
                allowed.
              properties:
                - name: 'requireScreenLock'
                  type: Boolean
                  description: |
                    Whether or not screenlock is required for the DevicePolicy
                    to be true. Defaults to false.
                  api_name: requireScreenlock
                - name: 'allowedEncryptionStatuses'
                  type: Array
                  description: |
                    A list of allowed encryptions statuses.
                    An empty list allows all statuses.
                  item_type:
                    type: Enum
                    description: |
                      This field only has a name and description because of MM
                      limitations. It should not appear in downstreams.
                    enum_values:
                      - 'ENCRYPTION_UNSPECIFIED'
                      - 'ENCRYPTION_UNSUPPORTED'
                      - 'UNENCRYPTED'
                      - 'ENCRYPTED'
                - name: 'allowedDeviceManagementLevels'
                  type: Array
                  description: |
                    A list of allowed device management levels.
                    An empty list allows all management levels.
                  item_type:
                    type: Enum
                    description: |
                      This field only has a name and description because of MM
                      limitations. It should not appear in downstreams.
                    enum_values:
                      - 'MANAGEMENT_UNSPECIFIED'
                      - 'NONE'
                      - 'BASIC'
                      - 'COMPLETE'
                - name: 'osConstraints'
                  type: Array
                  description: |
                    A list of allowed OS versions.
                    An empty list allows all types and all versions.
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'minimumVersion'
                        type: String
                        description: |
                          The minimum allowed OS version. If not set, any version
                          of this OS satisfies the constraint.
                          Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



mmv1/products/accesscontextmanager/AccessLevels.yaml [109:233]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          properties:
            - name: 'combiningFunction'
              type: Enum
              description: |
                How the conditions list should be combined to determine if a request
                is granted this AccessLevel. If AND is used, each Condition in
                conditions must be satisfied for the AccessLevel to be applied. If
                OR is used, at least one Condition in conditions must be satisfied
                for the AccessLevel to be applied.
              custom_flatten: 'templates/terraform/custom_flatten/default_if_empty.tmpl'
              default_value: "AND"
              enum_values:
                - 'AND'
                - 'OR'
            # All of the false defaults below here are omitted on purpose.
            # Let's keep this as simple as possible, since they will all be set by the API.
            - name: 'conditions'
              type: Array
              description: |
                A set of requirements for the AccessLevel to be granted.
              required: true
              item_type:
                type: NestedObject
                properties:
                  - name: 'ipSubnetworks'
                    type: Array
                    description: |
                      A list of CIDR block IP subnetwork specification. May be IPv4
                      or IPv6.
                      Note that for a CIDR IP address block, the specified IP address
                      portion must be properly truncated (i.e. all the host bits must
                      be zero) or the input is considered malformed. For example,
                      "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,
                      for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"
                      is not. The originating IP of a request must be in one of the
                      listed subnets in order for this Condition to be true.
                      If empty, all IP addresses are allowed.
                    item_type:
                      type: String
                  - name: 'requiredAccessLevels'
                    type: Array
                    description: |
                      A list of other access levels defined in the same Policy,
                      referenced by resource name. Referencing an AccessLevel which
                      does not exist is an error. All access levels listed must be
                      granted for the Condition to be true.
                      Format: accessPolicies/{policy_id}/accessLevels/{short_name}
                    item_type:
                      type: String
                  - name: 'members'
                    type: Array
                    description: |
                      An allowed list of members (users, service accounts).
                      Using groups is not supported yet.

                      The signed-in user originating the request must be a part of one
                      of the provided members. If not specified, a request may come
                      from any user (logged in/not logged in, not present in any
                      groups, etc.).
                      Formats: `user:{emailid}`, `serviceAccount:{emailid}`
                    item_type:
                      type: String
                  - name: 'negate'
                    type: Boolean
                    description: |
                      Whether to negate the Condition. If true, the Condition becomes
                      a NAND over its non-empty fields, each field must be false for
                      the Condition overall to be satisfied. Defaults to false.
                  - name: 'devicePolicy'
                    type: NestedObject
                    description: |
                      Device specific restrictions, all restrictions must hold for
                      the Condition to be true. If not specified, all devices are
                      allowed.
                    properties:
                      - name: 'requireScreenLock'
                        type: Boolean
                        description: |
                          Whether or not screenlock is required for the DevicePolicy
                          to be true. Defaults to false.
                        api_name: requireScreenlock
                      - name: 'allowedEncryptionStatuses'
                        type: Array
                        description: |
                          A list of allowed encryptions statuses.
                          An empty list allows all statuses.
                        item_type:
                          type: Enum
                          description: |
                            This field only has a name and description because of MM
                            limitations. It should not appear in downstreams.
                          enum_values:
                            - 'ENCRYPTION_UNSPECIFIED'
                            - 'ENCRYPTION_UNSUPPORTED'
                            - 'UNENCRYPTED'
                            - 'ENCRYPTED'
                      - name: 'allowedDeviceManagementLevels'
                        type: Array
                        description: |
                          A list of allowed device management levels.
                          An empty list allows all management levels.
                        item_type:
                          type: Enum
                          description: |
                            This field only has a name and description because of MM
                            limitations. It should not appear in downstreams.
                          enum_values:
                            - 'MANAGEMENT_UNSPECIFIED'
                            - 'NONE'
                            - 'BASIC'
                            - 'COMPLETE'
                      - name: 'osConstraints'
                        type: Array
                        description: |
                          A list of allowed OS versions.
                          An empty list allows all types and all versions.
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'minimumVersion'
                              type: String
                              description: |
                                The minimum allowed OS version. If not set, any version
                                of this OS satisfies the constraint.
                                Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



