github.com/cloudwan/edgelq-sdk@v1.15.4/iam/proto/v1/member_assignment.proto

syntax = "proto3";

package ntt.iam.v1;

import "edgelq-sdk/iam/proto/v1/common.proto";
import "google/api/resource.proto";
import "goten-sdk/types/meta.proto";

option go_package = "github.com/cloudwan/edgelq-sdk/iam/resources/v1/member_assignment;member_assignment";
option java_multiple_files = true;
option java_outer_classname = "MemberAssignmentProto";
option java_package = "com.ntt.iam.pb.v1";

// MemberAssignment - it is an internal resource, not for end users. It tracks
// REGIONAL RoleBindings per combination of scope/member for organization and
// project RoleBindings.
//
// If multiple RoleBindings point to same project/org and member, they will all
// share single MemberAssignment.
//
// MemberAssignment are managed by IAM Server, they are created/updated/deleted
// in TX when RoleBinding is created/updated/deleted. MemberAssignment shares
// same region as RoleBinding, otherwise tx-level synchronization would not be
// possible.
//
// For example: We create RoleBinding { project = "X", member = "M", role =
// "r1"}. It will create MemberAssignment { scope = "projects/x", member = "M"
// }. If another RoleBinding with same project and member would be created, then
// no additional MemberAssignment is created. When last RoleBinding per
// scope/member is deleted, MemberAssignment is deleted.
//
// Not all RoleBindings however have MemberAssignment instances. We track only
// organization and project RoleBindings! Therefore, system and service
// RoleBindings don't get their MemberAssignment. However, there is some caveat
// about this...
//
// When lets say project enables Service "S", and we create RoleBinding WHERE:
// {project = "X", member = "M", role = "r1", metadata.services.allowedServices
// CONTAINS "S"}, then special MemberAssignment is created with params: { scope
// = "services/S", member = "M" }, apart of { scope = "projects/x", member = "M"
// } mentioned previously. We create those service MemberAssignment only for 3rd
// party services (non core EdgeLQ), so we know if User/ServiceAccount is
// eligible user of some service.
//
// Main task of MemberAssignment is to track participations of all users/service
// accounts in projects/organizations. We use it for things like ListMyProjects,
// ListMyOrganizations. We also use those special service MemberAssignment
// instances to track who is using Service by proxy of Project/Organization!
// With this we can forbid/allow specific users using particular service.
//
// System RoleBindings are managed only by EdgeLQ admins for internal cases, and
// we dont need this tracking.
message MemberAssignment {
  option (google.api.resource) = {
    type : "iam.edgelq.com/MemberAssignment"
    pattern : "regions/{region}/memberAssignments/{member_assignment}"
  };

  // Name of MemberAssignment
  // First letter is source indicator (p, o, s for project, org, service).
  // Then we have proper scope identifier (projectId etc), then member
  // identifier (like user:$EMAIL).
  string name = 1;

  // Metadata is an object with information like create, update and delete time
  // (for async deleted resources), has user labels/annotations, sharding
  // information, multi-region syncing information and may have non-schema
  // owners (useful for taking ownership of resources belonging to lower level
  // services by higher ones).
  goten.types.Meta metadata = 2;

  // Points to Organization/Project of RoleBindings, OR service for those
  // special MemberAssignments. It is already part of name, but we track
  // in field for filter purpose.
  string scope = 3;

  // Populated for organization/project scopes. Skipped for service ones.
  string scope_title = 4;

  // Populated for organization/project scopes. Skipped for service ones.
  string parent_organization = 5;

  // It has PARTIAL metadata inherited from scope (labels, annotations, tags).
  // Populated for organization/project scopes. Skipped for service ones.
  goten.types.Meta scope_metadata = 6;

  // Populated for organization/project scopes. Skipped for service ones.
  // Contains multi_region_policy.default_control_region
  string multi_region_control_region = 7;

  // Populated for organization/project scopes. Skipped for service ones.
  // Contains multi_region_policy.enabled_regions
  repeated string multi_region_enabled_regions = 8;

  // Populated for organization/project scopes. Skipped for service ones.
  // Contains allowed or enabled services.
  repeated string scope_services = 9;

  // Populated for organization/project scopes. Skipped for service ones.
  BusinessTier business_tier = 10;

  // Member pointed by RoleBinding. Part of name, but we also need for filtering
  // purposes.
  string member = 11;

  // Region ID holding member resource (User, ServiceAccount...)
  string member_region = 12;

  WorkStatus ctrl_status = 13;

  message WorkStatus {
    // if controller has some work on this resource
    bool pending = 1;

    // If this resource should be deleted.
    bool pending_deletion = 2;
  }
}