1// Copyright 2020 Google LLC 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// http://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14 15syntax = "proto3"; 16 17package google.cloud.secrets.v1beta1; 18 19import "google/api/field_behavior.proto"; 20import "google/api/resource.proto"; 21import "google/protobuf/timestamp.proto"; 22 23option cc_enable_arenas = true; 24option csharp_namespace = "Google.Cloud.SecretManager.V1Beta1"; 25option go_package = "cloud.google.com/go/secrets/apiv1beta1/secretspb;secretspb"; 26option java_multiple_files = true; 27option java_outer_classname = "ResourcesProto"; 28option java_package = "com.google.cloud.secretmanager.v1beta1"; 29option objc_class_prefix = "GSM"; 30option php_namespace = "Google\\Cloud\\SecretManager\\V1beta1"; 31option ruby_package = "Google::Cloud::SecretManager::V1beta1"; 32 33// A [Secret][google.cloud.secrets.v1beta1.Secret] is a logical secret whose value and versions can 34// be accessed. 35// 36// A [Secret][google.cloud.secrets.v1beta1.Secret] is made up of zero or more [SecretVersions][google.cloud.secrets.v1beta1.SecretVersion] that 37// represent the secret data. 38message Secret { 39 option (google.api.resource) = { 40 type: "secretmanager.googleapis.com/Secret" 41 pattern: "projects/{project}/secrets/{secret}" 42 }; 43 44 // Output only. The resource name of the [Secret][google.cloud.secrets.v1beta1.Secret] in the format `projects/*/secrets/*`. 45 string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY]; 46 47 // Required. Immutable. The replication policy of the secret data attached to the [Secret][google.cloud.secrets.v1beta1.Secret]. 48 // 49 // The replication policy cannot be changed after the Secret has been created. 50 Replication replication = 2 [ 51 (google.api.field_behavior) = IMMUTABLE, 52 (google.api.field_behavior) = REQUIRED 53 ]; 54 55 // Output only. The time at which the [Secret][google.cloud.secrets.v1beta1.Secret] was created. 56 google.protobuf.Timestamp create_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY]; 57 58 // The labels assigned to this Secret. 59 // 60 // Label keys must be between 1 and 63 characters long, have a UTF-8 encoding 61 // of maximum 128 bytes, and must conform to the following PCRE regular 62 // expression: `[\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}` 63 // 64 // Label values must be between 0 and 63 characters long, have a UTF-8 65 // encoding of maximum 128 bytes, and must conform to the following PCRE 66 // regular expression: `[\p{Ll}\p{Lo}\p{N}_-]{0,63}` 67 // 68 // No more than 64 labels can be assigned to a given resource. 69 map<string, string> labels = 4; 70} 71 72// A secret version resource in the Secret Manager API. 73message SecretVersion { 74 option (google.api.resource) = { 75 type: "secretmanager.googleapis.com/SecretVersion" 76 pattern: "projects/{project}/secrets/{secret}/versions/{secret_version}" 77 }; 78 79 // The state of a [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion], indicating if it can be accessed. 80 enum State { 81 // Not specified. This value is unused and invalid. 82 STATE_UNSPECIFIED = 0; 83 84 // The [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] may be accessed. 85 ENABLED = 1; 86 87 // The [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] may not be accessed, but the secret data 88 // is still available and can be placed back into the [ENABLED][google.cloud.secrets.v1beta1.SecretVersion.State.ENABLED] 89 // state. 90 DISABLED = 2; 91 92 // The [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] is destroyed and the secret data is no longer 93 // stored. A version may not leave this state once entered. 94 DESTROYED = 3; 95 } 96 97 // Output only. The resource name of the [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] in the 98 // format `projects/*/secrets/*/versions/*`. 99 // 100 // [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] IDs in a [Secret][google.cloud.secrets.v1beta1.Secret] start at 1 and 101 // are incremented for each subsequent version of the secret. 102 string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY]; 103 104 // Output only. The time at which the [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] was created. 105 google.protobuf.Timestamp create_time = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; 106 107 // Output only. The time this [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] was destroyed. 108 // Only present if [state][google.cloud.secrets.v1beta1.SecretVersion.state] is 109 // [DESTROYED][google.cloud.secrets.v1beta1.SecretVersion.State.DESTROYED]. 110 google.protobuf.Timestamp destroy_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY]; 111 112 // Output only. The current state of the [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion]. 113 State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY]; 114} 115 116// A policy that defines the replication configuration of data. 117message Replication { 118 // A replication policy that replicates the [Secret][google.cloud.secrets.v1beta1.Secret] payload without any 119 // restrictions. 120 message Automatic { 121 122 } 123 124 // A replication policy that replicates the [Secret][google.cloud.secrets.v1beta1.Secret] payload into the 125 // locations specified in [Secret.replication.user_managed.replicas][] 126 message UserManaged { 127 // Represents a Replica for this [Secret][google.cloud.secrets.v1beta1.Secret]. 128 message Replica { 129 // The canonical IDs of the location to replicate data. 130 // For example: `"us-east1"`. 131 string location = 1; 132 } 133 134 // Required. The list of Replicas for this [Secret][google.cloud.secrets.v1beta1.Secret]. 135 // 136 // Cannot be empty. 137 repeated Replica replicas = 1 [(google.api.field_behavior) = REQUIRED]; 138 } 139 140 // The replication policy for this secret. 141 oneof replication { 142 // The [Secret][google.cloud.secrets.v1beta1.Secret] will automatically be replicated without any restrictions. 143 Automatic automatic = 1; 144 145 // The [Secret][google.cloud.secrets.v1beta1.Secret] will only be replicated into the locations specified. 146 UserManaged user_managed = 2; 147 } 148} 149 150// A secret payload resource in the Secret Manager API. This contains the 151// sensitive secret data that is associated with a [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion]. 152message SecretPayload { 153 // The secret data. Must be no larger than 64KiB. 154 bytes data = 1; 155} 156