reference.conf

include "sam.conf"

akka.http.server.idle-timeout = 180 s
akka.http.server.request-timeout = 60 s

resourceTypes = {
  resource_type_admin = {
    actionPatterns = {
      read_policies = {
        description = "view all policies and policy details for this resource type"
      }
      alter_policies = {
        description = "create and delete policies for this resource type"
      }
      "share_policy::.+" = {
        description = "modify the membership of the specified policy"
      }
      "read_policy::.+" = {
        description = "view the membership of the specified policy"
      }
      set_public = {
        description = "set policies to public"
      }
      "set_public::.+" = {
        description = "set the specified policy to public"
      }
      admin_read_policies = {
        description = "view all policies and policy details on resources associated with this resource"
      }
      admin_add_member = {
        description = "add membership to policies on resources associated with this resource"
      }
      admin_remove_member = {
        description = "remove membership from policies on resources associated with this resource"
      }
      admin_read_summary_information = {
        description = "view summary information on resources of this resource type"
      }
      admin_specify_acting_user = {
        description = "specify a different user that is preforming a given action on the resource"
      }
    }

    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["read_policies", "alter_policies"]
      }
      admin = {
        roleActions = ["admin_read_policies", "admin_add_member", "admin_remove_member"]
      }
      support = {
        roleActions = ["admin_read_summary_information", "admin_read_policies"]
      }
    }
    reuseIds = false
  }
  workspace = {
    actionPatterns = {
      delete = {
        description = "delete this workspace"
      }
      read_policies = {
        description = "view all policies and policy details for this workspace"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this workspace"
      }
      "share_policy::application" = {
        description = "change the membership of the application policy for this workspace"
      }
      "share_policy::writer" = {
        description = "change the membership of the writer policy for this workspace"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this workspace"
      }
      "share_policy::discoverer" = {
        description = "change the membership of the discoverer policy for this workspace"
      }
      "share_policy::can-compute" = {
        description = "change the membership of the can-compute policy for this workspace"
      }
      "read_policy::owner" = {
        description = "view the details of the owner policy for this workspace"
      }
      "discover" = {
        description = "perform discoverer action on the workspace. This lets you see a subset of workspace compared to 'read'"
        authDomainConstrainable = true
      }
      "read" = {
        description = "perform reader actions on the workspace"
        authDomainConstrainable = true
      }
      "write" = {
        description = "perform writer actions on the workspace"
        authDomainConstrainable = true
      }
      "own" = {
        description = "perform owner actions on the workspace"
        authDomainConstrainable = true
      }
      "compute" = {
        description = "launch batch compute in the workspace"
      }
      "catalog" = {
        description = "catalog the workspace"
      }
      "read_auth_domain" = {
        description = "view the auth domain of the workspace"
      }
      "update_auth_domain" = {
        description = "update the groups in the auth domain of the workspace"
      }
      "create_controlled_user_private" = {
        description = "create controlled, user-owned private resources in the workspace"
      }
      "create_controlled_user_shared" = {
        description = "create controlled, user-owned shared resources in the workspace"
      }
      "create_controlled_application_private" = {
        description = "create controlled, application-owned private resources in the workspace"
      }
      "create_controlled_application_shared" = {
        description = "create controlled, application-owned shared resources in the workspace"
      }
      "create_referenced_resource" = {
        description = "create references to resources in the workspace"
      }
      "update_referenced_resource" = {
        description = "update references to resources in the workspace"
      }
      "delete_referenced_resource" = {
        description = "delete references to resources in the workspace"
      }
      add_child = {
        description = "add a child resource"
      }
      remove_child = {
        description = "remove a child resource"
      }
      list_children = {
        description = "list child resources"
      }
      migrate = {
        description = "allows migration of the workspace"
      }
      view_migration_status = {
        description = "allows viewing the status of a migration"
      },
      read_job_result = {
        description = "allows reading the result of a job"
      },
      read_spend_report = {
        description = "allows user to read spend report on the workspace"
      }
    }
    ownerRoleName = "owner"
    roles = {
      manager = {
        # Workspace Manager grants this role to its own service account for admin access to workspace resources. It never gives users this role.
        roleActions = ["read_policies", "share_policy::owner", "share_policy::application", "share_policy::writer", "share_policy::reader"]
      }
      project-owner = {
        # This role is used for display purposes and to prevent owners from removing project-owners,
        # but otherwise grants the same actions as the owner role on workspaces.
        roleActions = []
        includedRoles = ["owner"]
      }
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::application", "share_policy::writer", "share_policy::reader", "share_policy::discoverer", "own", "write", "read", "discover", "compute", "share_policy::share-reader", "share_policy::share-writer", "share_policy::can-compute", "share_policy::can-catalog", "read_auth_domain", "update_auth_domain", "create_controlled_user_shared", "create_controlled_user_private", "create_referenced_resource", "update_referenced_resource", "delete_referenced_resource", "list_children", "remove_child", "add_child", "migrate", "view_migration_status", "read_job_result", "read_spend_report"]
        # Workspace Manager also maintains a mapping of workspace roles to controlled resource roles. If you change this mapping, check that service's mapping as well.
        descendantRoles = {
          google-project = ["owner"]
          controlled-user-shared-workspace-resource = ["editor", "writer", "reader"]
          controlled-user-private-workspace-resource = ["deleter"]
          controlled-application-shared-workspace-resource = ["writer", "reader"]
          wds-instance = ["owner"]
          kubernetes-app = ["manager"]
          kubernetes-app-shared = ["owner", "user"]
          notebook-cluster = ["manager"]
          persistent-disk = ["manager"]
        }
      }
      application = {
        roleActions = ["read_policies", "write", "read", "create_controlled_user_shared", "create_controlled_user_private", "create_controlled_application_shared", "create_controlled_application_private", "create_referenced_resource", "update_referenced_resource", "delete_referenced_resource", "list_children", "add_child", "remove_child", "read_auth_domain", "read_job_result"]
        descendantRoles = {
          google-project = ["pet-creator"]
        }
      }
      writer = {
        roleActions = ["read_policy::owner", "write", "read", "discover", "create_controlled_user_shared", "create_controlled_user_private", "create_referenced_resource", "update_referenced_resource", "delete_referenced_resource", "list_children", "add_child", "remove_child", "read_auth_domain", "view_migration_status", "read_job_result"]
        descendantRoles = {
          controlled-user-shared-workspace-resource = ["editor", "writer", "reader"]
          controlled-application-shared-workspace-resource = ["writer", "reader"]
          google-project = ["pet-creator"]
          wds-instance = ["writer"]
          kubernetes-app-shared = ["user"]
        }
      }
      reader = {
        roleActions = ["read_policy::owner", "read", "discover", "read_auth_domain", "view_migration_status", "read_job_result"]
        descendantRoles = {
          controlled-user-shared-workspace-resource = ["reader"]
          controlled-application-shared-workspace-resource = ["reader"]
          google-project = ["pet-creator"]
          wds-instance = ["reader"]
          kubernetes-app-shared = ["user"]
        }
      }
      discoverer = {
        roleActions = ["discover"]
      }
      share-reader = {
        roleActions = ["share_policy::reader", "read_policies"]
        descendantRoles = {
          google-project = ["pet-creator"]
        }
      }
      share-writer = {
        roleActions = ["share_policy::writer", "share_policy::reader", "read_policies"]
        descendantRoles = {
          google-project = ["pet-creator"]
        }
      }
      can-compute = {
        roleActions = ["compute"]
        descendantRoles = {
          google-project = ["notebook-user"]
          notebook-cluster = ["accessor"]
          kubernetes-app = ["accessor"]
          persistent-disk = ["accessor"]
        }
      }
      can-catalog = {
        roleActions = ["catalog"]
        descendantRoles = {
          google-project = ["pet-creator"]
        }
      }
      rawls = {
        roleActions = [
          # workspace clone and delete
          "read_job_result"
          # workspace clone - create WDS
          "create_controlled_user_private"
          # workspace clone - create storage container
          "create_controlled_user_shared"
          # workspace delete - leo checks for this action when deleting runtimes
          "delete"
          # workspace delete - WSM ensures there are no children before deleting
          "list_children"
          # workspace clone - create WDS
          "add_child"
          # workspace clone - get storage container, get cloud context and spend profile id
          "read"
        ]
      }
    }
    authDomainConstrainable = true
    allowLeaving = true
    reuseIds = false
  }
  controlled-user-shared-workspace-resource = {
    actionPatterns = {
      delete = {
        description = "delete this resource"
      }
      read_policies = {
        description = "view all policies and policy details for this resource"
      }
      set_parent = {
        description = "set the parent workspace of this resource"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this resource"
      }
      "share_policy::editor" = {
        description = "change the membership of the editor policy for this resource"
      }
      "share_policy::writer" = {
        description = "change the membership of the writer policy for this resource"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this resource"
      }
      "read" = {
        description = "perform reader actions on the resource"
      }
      "write" = {
        description = "perform writer actions on the resource"
      }
      "edit" = {
        description = "perform editor actions on the resource"
      }
      "own" = {
        description = "perform owner actions on the resource"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::editor", "share_policy::writer", "share_policy::reader", "own", "edit", "read", "write", "set_parent"]
      }
      editor = {
        roleActions = ["delete", "edit", "read", "write"]
      }
      writer = {
        roleActions = ["read", "write"]
      }
      reader = {
        roleActions = ["read"]
      }
      rawls = {
        roleActions = [
          # workspace clone - read source workspace storage containers
          "read"
          # wds clone needs to write db backup to target workspace storage container
          "write"
        ]
      }
    }
    reuseIds = false
  }
  controlled-user-private-workspace-resource = {
    actionPatterns = {
      delete = {
        description = "delete this resource"
      }
      read_policies = {
        description = "view all policies and policy details for this resource"
      }
      set_parent = {
        description = "set the parent workspace of this resource"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this resource"
      }
      "share_policy::editor" = {
        description = "change the membership of the editor policy for this resource"
      }
      "share_policy::writer" = {
        description = "change the membership of the writer policy for this resource"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this resource"
      }
      "read" = {
        description = "perform reader actions on the resource"
      }
      "write" = {
        description = "perform writer actions on the resource"
      }
      "edit" = {
        description = "perform editor actions on the resource"
      }
      "own" = {
        description = "perform owner actions on the resource"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::editor", "share_policy::writer", "share_policy::reader", "own", "edit", "set_parent", "read", "write"]
      }
      editor = {
        roleActions = ["delete", "edit", "read", "write"]
      }
      writer = {
        roleActions = ["read", "write"]
      }
      reader = {
        roleActions = ["read"]
      }
      deleter = {
        roleActions = ["delete"]
      }
    }
    reuseIds = false
  }
  controlled-application-shared-workspace-resource = {
    actionPatterns = {
      delete = {
        description = "delete this resource"
      }
      read_policies = {
        description = "view all policies and policy details for this resource"
      }
      set_parent = {
        description = "set the parent workspace of this resource"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this resource"
      }
      "share_policy::editor" = {
        description = "change the membership of the editor policy for this resource"
      }
      "share_policy::writer" = {
        description = "change the membership of the writer policy for this resource"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this resource"
      }
      "read" = {
        description = "perform reader actions on the resource"
      }
      "write" = {
        description = "perform writer actions on the resource"
      }
      "edit" = {
        description = "perform editor actions on the resource"
      }
      "own" = {
        description = "perform owner actions on the resource"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::editor", "share_policy::writer", "share_policy::reader", "own", "edit", "set_parent", "read", "write"]
      }
      editor = {
        roleActions = ["delete", "edit", "read", "write"]
      }
      writer = {
        roleActions = ["read", "write"]
      }
      reader = {
        roleActions = ["read"]
      }
      rawls = {
        roleActions = [
          # workspace delete
          "delete"
        ]
      }
    }
    reuseIds = false
  }
  controlled-application-private-workspace-resource = {
    actionPatterns = {
      delete = {
        description = "delete this resource"
      }
      read_policies = {
        description = "view all policies and policy details for this resource"
      }
      set_parent = {
        description = "set the parent workspace of this resource"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this resource"
      }
      "share_policy::editor" = {
        description = "change the membership of the editor policy for this resource"
      }
      "share_policy::writer" = {
        description = "change the membership of the writer policy for this resource"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this resource"
      }
      "read" = {
        description = "perform reader actions on the resource"
      }
      "write" = {
        description = "perform writer actions on the resource"
      }
      "edit" = {
        description = "perform editor actions on the resource"
      }
      "own" = {
        description = "perform owner actions on the resource"
      }
      "manage_private_user" = {
        description = "assign, remove, and reassign the private user"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::editor", "share_policy::writer", "share_policy::reader", "own", "edit", "manage_private_user", "set_parent", "read", "write"]
      }
      editor = {
        roleActions = ["delete", "edit", "read", "write", "manage_private_user", "read_policies"]
      }
      deleter = {
        roleActions = ["delete"]
      }
      writer = {
        roleActions = ["read", "write"]
      }
      reader = {
        roleActions = ["read"]
      }
    }
    reuseIds = false
  }
  managed-group = {
    actionPatterns = {
      delete = {
        description = "Delete this group"
      }
      read_policies = {
        description = "view all policies and policy details for this group"
      }
      use = {
        description = "utilize this group in order to share or restrict access to other SAM entities"
      }
      "share_policy::admin" = {
        description = "change the membership of the admin policy for this group"
      }
      "share_policy::member" = {
        description = "change the membership of the member policy for this group"
      }
      "share_policy::admin-notifier" = {
        description = "change the membership of the admin-notifier policy for this group"
      }
      "read_policy::admin" = {
        # Doug Said this may be redundant with "read_policies" and could be removed
        description = "view the details of the admin policy for this group"
      }
      "read_policy::member" = {
        # Doug Said this may be redundant with "read_policies" and could be removed
        description = "view the details of the member policy for this group"
      }
      "read_policy::admin-notifier" = {
        description = "view the details of the admin-notifier policy for this group"
      }
      "notify_admins" = {
        description = "send notifications to the admins of this group"
      }
      "set_access_instructions" = {
        description = "set access instructions for this group"
      }
    }
    ownerRoleName = "admin"
    roles = {
      admin = {
        roleActions = ["delete", "read_policies", "use", "share_policy::admin", "share_policy::member", "share_policy::admin-notifier", "read_policy::admin", "read_policy::member", "read_policy::admin-notifier", "set_access_instructions"]
      }
      member = {
        roleActions = ["use"]
      }
      admin-notifier = {
        roleActions = ["notify_admins"]
      }
    }
    allowLeaving = true
    reuseIds = true
  }
  workflow-collection = {
    actionPatterns = {
      delete = {
        description = "delete this workflow-collection"
      }
      add = {
        description = "add workflows to this workflow-collection"
      }
      view = {
        description = "list workflows and workflow details in this workflow-collection"
      }
      abort = {
        description = "abort any workflow in this workflow-collection"
      }
      get_cost = {
        description = "get the cost of any workflow in this workflow-collection"
      }
      update = {
        description = "update any workflow in this workflow-collection"
      }
      alter_policies = {
        description = "create and delete policies on this workflow-collection"
      }
      read_policies = {
        description = "view all policies and policy details for this workflow-collection"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "add", "view", "abort", "get_cost", "update", "alter_policies", "read_policies"]
      }
      reader = {
        roleActions = ["view", "get_cost"]
      }
      writer = {
        roleActions = ["view", "add", "delete", "abort", "get_cost", "update"]
      }
    }
    reuseIds = false
  }
  caas = {
    actionPatterns = {
      get_whitelist = {
        description = "view the whitelist"
      }
      alter_policies = {
        description = "create and delete policies for this caas"
      }
      read_policies = {
        description = "view all policies and policy details for this caas"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["alter_policies", "read_policies"]
      }
      cromiam = {
        roleActions = ["get_whitelist"]
      }
    }
    reuseIds = false
  }
  google-project = {
    # TODO: remove the following actions when notebook-cluster and persistent-disk have migrated to have parent resources.
    # - list_notebook_cluster
    # - delete_notebook_cluster
    # - stop_start_notebook_cluster
    # - list_persistent_disk
    # - delete_persistent_disk
    actionPatterns = {
      read_policies = {
        description = "list all policies and policy details for this google-project"
      }
      list_notebook_cluster = {
        description = "list all notebook clusters in this google-project"
      }
      launch_notebook_cluster = {
        description = "launch a new notebook cluster in this google-project"
      }
      delete_notebook_cluster = {
        description = ""
      }
      stop_start_notebook_cluster = {
        description = "stop and start notebook clusters in this google-project"
      }
      list_persistent_disk = {
        description = "list all persistent disks in this google-project"
      }
      create_persistent_disk = {
        description = "create persistent disk in this google-project"
      }
      delete_persistent_disk = {
        description = "delete persistent disk in this google-project"
      }
      create_kubernetes_app = {
        description = "create kubernetes application in this google-project"
      }
      delete = {
        description = "delete this google-project"
      }
      get_parent = {
        description = "get the parent resource of this google-project"
      }
      set_parent = {
        description = "set the parent resource of this google-project"
      }
      add_child = {
        description = "add child to google project"
      }
      list_children = {
        description = "list child resources"
      }
      create-pet = {
        description = "create a pet service account in this google-project"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["read_policies", "list_notebook_cluster", "delete_notebook_cluster", "list_persistent_disk", "delete_persistent_disk", "delete", "get_parent", "set_parent", "list_children"]
        includedRoles = ["notebook-user", "pet-creator"]
        descendantRoles = {
          kubernetes-app = ["manager"]
          notebook-cluster = ["manager"]
          persistent-disk = ["manager"]
        }
      }
      notebook-user = {
        roleActions = ["launch_notebook_cluster", "create_persistent_disk", "create_kubernetes_app", "add_child"]
        includedRoles = ["pet-creator"]
      }
      pet-creator = {
        roleActions = ["create-pet"]
      }
    }
    reuseIds = true
  }
  billing-project = {
    actionPatterns = {
      create_workspace = {
        description = "create new workspaces in this billing-project"
      }
      alter_policies = {
        description = "create and delete policies for this billing-project"
      }
      read_policies = {
        description = "list all policies and policy details for this billing-project"
      }
      launch_batch_compute = {
        description = "launch workflows in this billing-project"
      }
      list_notebook_cluster = {
        description = "list all notebook clusters in this billing-project"
      }
      launch_notebook_cluster = {
        description = "launch a new notebook cluster in this billing-project"
      }
      delete_notebook_cluster = {
        description = ""
      }
      stop_start_notebook_cluster = {
        description = "stop and start notebook clusters in this billing-project"
      }
      list_persistent_disk = {
        description = "list all persistent disks in this billing-project"
      }
      create_persistent_disk = {
        description = "create persistent disk in this billing-project"
      }
      delete_persistent_disk = {
        description = "delete persistent disk in this billing-project"
      }
      create_kubernetes_app = {
        description = "create kubernetes application in this billing-project"
      }
      alter_google_role = {
        description = "modify the role of users on the google project (only a fixed set of roles are permitted)"
      }
      "share_policy::.+" = {
        description = "modify the membership of the specified policy"
      }
      "read_policy::.+" = {
        description = "view the membership of the specified policy"
      }
      view_status = {
        description = "view status of a billing-project"
      }
      add_to_service_perimeter = {
        description = "add this billing-project to a service-perimeter"
      }
      delete = {
        description = "delete this billing-project"
      }
      update_billing_account = {
        description = "update the billing account on this billing-project"
      }
      alter_spend_report_configuration = {
        description = "alter the spend report config (i.e. the BigQuery dataset for spend reports) for this billing-project"
      }
      read_spend_report_configuration = {
        description = "read the spend report config (i.e. the BigQuery dataset for spend reports) for this billing-project"
      }
      read_spend_report = {
        description = "read spend report which contains data pulled from BigQuery dataset for this billing-project"
      }
      add_child = {
        description = "add children, e.g. google-project"
      }
      remove_child = {
        description = "remove children, e.g. google-project"
      }
      list_children = {
        description = "list children, e.g. google-project"
      }
      own = {
        description = "perform owner actions on this billing project"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["view_status", "create_workspace", "alter_policies", "read_policies", "launch_batch_compute", "list_notebook_cluster", "launch_notebook_cluster", "delete_notebook_cluster", "list_persistent_disk", "create_persistent_disk", "delete_persistent_disk", "create_kubernetes_app", "alter_google_role", "add_to_service_perimeter", "delete", "update_billing_account", "alter_spend_report_configuration", "read_spend_report_configuration", "read_spend_report", "list_children", "remove_child", "add_child", "own"]
        descendantRoles = {
          google-project = ["owner"]
        }
      }
      workspace-creator = {
        roleActions = ["view_status", "create_workspace", "share_policy::can-compute-user", "read_policy::can-compute-user", "read_policy::owner"]
      }
      batch-compute-user = {
        roleActions = ["launch_batch_compute"]
      }
      notebook-user = {
        roleActions = ["launch_notebook_cluster", "create_persistent_disk", "create_kubernetes_app"]
        descendantRoles = {
          google-project = ["notebook-user"]
        }
      }
      rawls = {
        roleActions = [
          # billing project delete
          "delete"
        ]
      }
    }
    allowLeaving = true
    reuseIds = true
  }
  notebook-cluster = {
    actionPatterns = {
      can_access = {
        description = "necessary but not sufficient to perform any action on the notebook cluster"
      }
      status = {
        description = "view notebook cluster status details and configuration"
      }
      connect = {
        description = "connect to the Jupyter notebook running on the notebook cluster"
        authDomainConstrainable = true
      }
      delete = {
        description = "delete the notebook cluster"
      }
      read_policies = {
        description = "view all policies and policy details for the notebook cluster"
      }
      stop_start = {
        description = "stop and start the notebook cluster VMs"
      }
      modify = {
        description = "modify attributes of the cluster"
      }
      set_parent = {
        description = "set parent of notebook cluster"
      }
      get_parent = {
        description = "get parent of notebook cluster"
      }
    }
    ownerRoleName = "creator"
    roles = {
      # the creator role is assigned directly to the notebook-cluster resource and does not include can_access
      # but can_access is required to perform any action so must be granted via the parent resource using
      # either the manager or accessor role
      creator = {
        roleActions = ["status", "connect", "delete", "read_policies", "stop_start", "modify", "set_parent", "get_parent"]
      }
      manager = {
        roleActions = ["status", "delete", "read_policies", "can_access"]
      }
      accessor = {
        roleActions = ["can_access"]
      }
    }
    reuseIds = false
    prerequisiteAction = "can_access"
  }
  persistent-disk = {
    actionPatterns = {
      can_access = {
        description = "necessary but not sufficient to perform any action on the persistent disk"
      }
      read = {
        description = "read metadata of persistent disk"
      }
      attach = {
        description = "attach persistent disk to a VM"
        authDomainConstrainable = true
      }
      modify = {
        description = "modify persistent disk"
      }
      delete = {
        description = "delete persistent disk"
      }
      read_policies = {
        description = "view all policies and policy details for the persistent disk"
      }
      set_parent = {
        description = "set parent of persistent disk"
      }
      get_parent = {
        description = "get parent of persistent disk"
      }
    }
    ownerRoleName = "creator"
    roles = {
      # the creator role is assigned directly to the persistent-disk resource and does not include can_access
      # but can_access is required to perform any action so must be granted via the parent resource using
      # either the manager or accessor role
      creator = {
        roleActions = ["read", "attach", "modify", "delete", "read_policies", "set_parent", "get_parent"]
      }
      manager = {
        roleActions = ["delete", "read", "read_policies", "can_access"]
      }
      accessor = {
        roleActions = ["can_access"]
      }
    }
    reuseIds = false
    prerequisiteAction = "can_access"
  }
  kubernetes-app = {
    actionPatterns = {
      can_access = {
        description = "necessary but not sufficient to perform any action on the kubernetes app"
      }
      delete = {
        description = "delete kubernetes application"
      }
      connect = {
        description = "connect to kubernetes application"
        authDomainConstrainable = true
      }
      update = {
        description = "update kubernetes application"
      }
      status = {
        description = "view details and configuration of the kubernetes application"
      }
      stop = {
        description = "stop kubernetes application"
      }
      start = {
        description = "start kubernetes application"
      }
      read_policies = {
        description = "view all policies and policy details for the kubernetes application"
      }
      set_parent = {
        description = "set parent of kubernetes app"
      }
    }
    ownerRoleName = "creator"
    roles = {
      # the creator role is assigned directly to the kubernetes-app resource and does not include can_access
      # but can_access is required to perform any action so must be granted via the parent resource using
      # either the manager or accessor role
      creator = {
        roleActions = ["delete", "connect", "update", "status", "stop", "start", "read_policies", "set_parent"]
      }
      accessor = {
        roleActions = ["can_access"]
      }
      manager = {
        roleActions = ["delete", "status", "read_policies", "can_access"]
      }
    }
    reuseIds = false
    prerequisiteAction = "can_access"
  }
  kubernetes-app-shared = {
    actionPatterns = {
      delete = {
        description = "delete kubernetes application"
      }
      connect = {
        description = "connect to kubernetes application"
        authDomainConstrainable = true
      }
      update = {
        description = "update kubernetes application"
      }
      status = {
        description = "view details and configuration of the kubernetes application"
      }
      stop = {
        description = "stop kubernetes application"
      }
      start = {
        description = "start kubernetes application"
      }
      read_policies = {
        description = "view all policies and policy details for the kubernetes application"
      }
      set_parent = {
        description = "set parent of kubernetes app"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "connect", "update", "status", "stop", "start", "read_policies", "set_parent"]
      }
      user = {
        roleActions = ["connect", "status"]
      }
    }
    reuseIds = false
  }
  cloud-extension = {
    actionPatterns = {
      get_pet_private_key = {
        description = ""
      }
      get_pet_managed_identity = {
        description = ""
      }
      alter_policies = {
        description = ""
      }
      read_policies = {
        description = ""
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["alter_policies", "read_policies"]
      }
      google = {
        roleActions = ["get_pet_private_key"]
      }
      azure = {
        roleActions = ["get_pet_managed_identity"]
      }
    }
    reuseIds = false
  }
  dockstore-tool = {
    actionPatterns = {
      "delete" = {
        description = "delete a tool"
      },
      "read_policies" = {
        description = "read tool policies"
      },
      "alter_policies" = {
        description = "alter tool policies"
      },
      "write" = {
        description = "modify tool"
      },
      "read" = {
        description = "read tool"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "alter_policies", "write", "read"]
      },
      writer = {
        roleActions = ["write", "read"]
      },
      reader = {
        roleActions = ["read"]
      }
    }
    reuseIds = true

  }
  entity-collection = {
    actionPatterns = {
      "delete" = {
        description = "delete this entity collection"
      },
      "write" = {
        description = "create/update/delete entities in this collection"
      },
      "read" = {
        description = "read entities in this collection"
      },
      "alter_policies" = {
        description = "alter entity collection policies"
      },
      "read_policies" = {
        description = "read entity collection policies"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "write", "read", "alter_policies", "read_policies"]
      },
      writer = {
        roleActions = ["write", "read"]
      },
      reader = {
        roleActions = ["read"]
      }
    }
    reuseIds = false
  }
  catalog = {
    actionPatterns = {
      "read_policies" = {
        description = "Can read policies"
      },
      "alter_policies" = {
        description = "Can alter policies"
      },
      "create_metadata" = {
        description = "Can create catalog metadata"
      },
      "read_any_metadata" = {
        description = "Can read catalog metadata"
      },
      "update_any_metadata" = {
        description = "Can update catalog metadata"
      },
      "delete_any_metadata" = {
        description = "Can delete catalog metadata"
      }
    }
    ownerRoleName = "admin"
    roles = {
      admin = {
        roleActions = ["read_policies", "alter_policies", "create_metadata", "read_any_metadata", "update_any_metadata", "delete_any_metadata"]
      }
    }
    reuseIds = true
  }
  datarepo = {
    actionPatterns = {
      "create_dataset" = {
        description = "Has permission to create a dataset"
      }
      "configure" = {
        description = "Edit and read the live configuration on a datarepo instance"
      }
      "register_drs_aliases" = {
        description = "Can register drs aliases"
      }
      "run_upgrade_flight" = {
        description = "Can run an upgrade flight"
      }
      "sync_duos_users" = {
        description = "Can sync a DUOS dataset's authorized users to TDR-managed Firecloud groups"
      }
      "share_policy::admin" = {
        description = "Can grant and revoke a users' admin permission"
      }
      "share_policy::steward" = {
        description = "Can grant and revoke a users' steward permission"
      }
      "share_policy::duos_integration_admin" = {
        description = "Can grant and revoke a users' DUOS integration admin permission"
      }
      "read_policies" = {
        description = "Can read policies"
      }
      "read_policy::steward" = {
        description = "Can read the steward policy"
      }
      "alter_policies" = {
        description = "Can alter policies"
      }
      "list_jobs" = {
        description = "Can list repo jobs"
      }
      "delete_jobs" = {
        description = "Can delete repo jobs"
      }
      "delete" = {
        description = "Can delete policies/resources"
      }
    }
    ownerRoleName = "admin"
    roles = {
      admin = {
        roleActions = ["list_jobs", "delete_jobs", "delete", "share_policy::steward", "share_policy::admin", "share_policy::duos_integration_admin", "read_policies", "alter_policies", "configure", "register_drs_aliases", "run_upgrade_flight"]
        includedRoles = ["duos_integration_admin"]
      }
      steward = {
        roleActions = ["list_jobs", "delete_jobs", "create_dataset", "share_policy::steward", "read_policy::steward"]
      }
      duos_integration_admin = {
        roleActions = ["sync_duos_users"]
      }
    }
    reuseIds = true
  }
  spend-profile = {
    actionPatterns = {
      "read_policies" = {
        description = "Can read policies"
      }
      "update_billing_account" = {
        description = "Ability to update the spend profile to use a different billing account"
      }
      "update_metadata" = {
        description = "Ability to update the spend profile's metadata, including name and description"
      }
      "delete" = {
        description = "Ability to delete profiles"
      }
      "link" = {
        description = "Ability to link a spend profile to an object, thus allowing the object to spend funds from the designated billing account"
      }
      "share_policy::owner" = {
        description = "Ability to grant and revoke a users' owner permission"
      }
      "share_policy::user" = {
        description = "Ability to grant and revoke a users' user permission"
      }
      "alter_policies" = {
        description = "Can alter policies"
      }
      "add_child" = {
        description = "add a child resource"
      }
      "list_children" = {
        description = "list child resources"
      }
      "view_journal" = {
        description = "View a spend profile's journal entries"
      }
      "set_managed_resource_group" = {
        description = "Associate this spend profile to an Azure managed resource group"
      }
      "create-pet" = {
        description = "create pet identity using this spend profile"
      }
      "read_spend_report" = {
        description = "read spend report for this spend profile"
      }
      "read_job_result" = {
        description = "allows reading the result of a job"
      }
      "read_profile" = {
        description = "read spend profile"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        descendantRoles = {
          landing-zone = ["owner"]
        }
        roleActions = ["update_billing_account", "update_metadata", "delete", "link", "share_policy::owner", "share_policy::user", "share_policy::pet-creator", "read_policies", "add_child", "list_children", "view_journal", "set_managed_resource_group", "create-pet", "read_spend_report", "read_job_result", "read_profile"]
      }
      user = {
        descendantRoles = {
          landing-zone = ["user"]
        }
        roleActions = ["link", "share_policy::user", "share_policy::pet-creator", "read_policy::pet-creator", "add_child", "create-pet", "read_job_result", "read_profile"]
      }
      admin = {
        roleActions = ["share_policy::owner", "read_policies", "alter_policies", "delete", "read_profile"]
      }
      pet-creator = {
        roleActions = ["create-pet", "share_policy::pet-creator", "read_policy::pet-creator", "read_profile"]
      }
      system = {
        roleActions = ["read_profile"]
      }
      rawls = {
        roleActions = [
          # landing zone creation, billing project delete
          "read_job_result"
          # billing project delete
          "delete"
          # leonardo creates a pet even for a shared app
          "create-pet"
        ]
      }
    }
    allowLeaving = true
    reuseIds = true
  }
  study = {
    actionPatterns = {
      delete = {
        description = "delete old type study"
      }
    }
    ownerRoleName = "steward"
    roles = {
      steward = {
        roleActions = ["delete", "read_policies", "alter_policies"]
      }
    }
    reuseIds = true
  }
  dataset = {
    actionPatterns = {
      read_dataset = {
        description = "Read dataset metadata"
      }
      edit_dataset = {
        description = "(deprecated) Change dataset metadata"
      }
      manage_schema = {
        description = "Change dataset metadata"
      }
      delete = {
        description = "Delete dataset"
      }
      read_data = {
        description = "Read dataset data"
      }
      ingest_data = {
        description = "Add data to a dataset"
      }
      soft_delete = {
        description = "Soft delete dataset data"
      }
      hard_delete = {
        description = "Hard delete dataset data"
      }
      update_data = {
        description = "(deprecated) Add or delete data for a dataset"
      }
      create_datasnapshot = {
        description = "(deprecated) Create a datasnapshot that includes this dataset"
      }
      link_snapshot = {
        description = "Create a snapshot that uses this dataset"
      }
      unlink_snapshot = {
        description = "Delete a snapshot that uses this dataset"
      }
      list_snapshots = {
        description = "List snapshots that are linked to this dataset"
      }
      "share_policy::steward" = {
        description = "Can grant and revoke a users' steward permission"
      }
      "share_policy::custodian" = {
        description = "Can grant and revoke a users' custodian permission"
      }
      "share_policy::ingester" = {
        description = "Can grant and revoke a users' ingester permission"
      }
      "read_policies" = {
        description = "Can read policies"
      }
      "alter_policies" = {
        description = "Can alter policies"
      }
      update_passport_identifier = {
        description = "Can update a dataset's passport identifier (e.g. PHS ID)"
      }
      view_journal = {
        description = "View dataset journal entries"
      }
      "lock_resource" = {
        description = "Can lock a resource"
      }
      "unlock_resource" = {
        description = "Can unlock a resource"
      }
    }
    ownerRoleName = "steward"
    roles = {
      steward = {
        roleActions = ["delete", "read_dataset", "read_data", "edit_dataset", "manage_schema", "ingest_data",  "update_data", "soft_delete", "hard_delete", "create_datasnapshot",  "share_policy::steward", "share_policy::custodian", "share_policy::ingester", "share_policy::snapshot_creator", "read_policies", "link_snapshot", "unlink_snapshot", "list_snapshots", "update_passport_identifier", "view_journal", "lock_resource", "unlock_resource"]
      }
      custodian = {
        roleActions = ["read_dataset", "read_data", "manage_schema", "create_datasnapshot", "ingest_data", "soft_delete", "hard_delete", "read_policies", "link_snapshot", "unlink_snapshot", "list_snapshots", "lock_resource", "unlock_resource"]
      }
      ingester = {
        roleActions = ["read_dataset", "read_data", "ingest_data"]
      }
      snapshot_creator = {
        roleActions = ["read_dataset", "read_data", "read_policies", "link_snapshot"]
      }
      admin = {
        roleActions = ["share_policy::steward", "read_policies", "alter_policies", "unlock_resource"]
      }
    }
    reuseIds = true
  }
  datasnapshot = {
    actionPatterns = {
      delete = {
        description = "Delete datasnapshot"
      }
      edit_datasnapshot = {
        description = "(deprecated) Change datasnapshot name and description"
      }
      update_snapshot = {
        description = "Update snapshot information"
      }
      read_data = {
        description = "Read data from the datasnapshot"
        authDomainConstrainable = true
      }
      discover_data = {
        description = "Discover data about the datasnapshot"
      }
      "share_policy::steward" = {
        description = "Can grant and revoke a users' steward permission"
      }
      "share_policy::custodian" = {
        description = "Can grant and revoke a users' custodian permission"
      }
      "read_policy::custodian" = {
        description = "Can see the custodians of a dataset"
      }
      "share_policy::reader" = {
        description = "Can grant and revoke a users' read permission"
      }
      "share_policy::aggregate_data_reader" = {
        description = "Can grant and revoke a users' aggregate data read permission"
      }
      "share_policy::discoverer" = {
        description = "Can grant and revoke a users' discover permission"
      }
      "read_policies" = {
        description = "Can read policies"
      }
      "alter_policies" = {
        description = "Can alter policies"
      }
      set_public = {
        description = "set policies to public"
      }
      update_passport_identifier = {
        description = "Can update a datasnapshot's passport identifier (e.g. consent code)"
      }
      export_snapshot = {
        description = "Export snapshot to a Terra workspace"
        authDomainConstrainable = true
      }
      view_journal = {
        description = "View datasnapshot journal entries"
      }
      read_auth_domain = {
        description = "view the auth domain of the snapshot"
      }
      update_auth_domain = {
        description = "update the auth domain of the snapshot"
      }
      "lock_resource" = {
        description = "Can lock a resource"
      }
      "unlock_resource" = {
        description = "Can unlock a resource"
      }
      "read_aggregate_data" = {
        description = "Can read aggregate data about a snapshot"
      }
      "create_snapshot_request" = {
        description = "Can create a snapshot request for this snapshot"
      }
      "get_snapshot_builder_settings" = {
        description = "Can get the snapshot builder settings for this snapshot"
      }
      add_child = {
        description = "add a child resource"
      }
    }
    ownerRoleName = "steward"
    roles = {
      steward = {
        roleActions = ["share_policy::steward", "share_policy::custodian", "update_passport_identifier", "view_journal"]
        includedRoles = ["custodian"]
        descendantRoles = {
          snapshot-builder-request = ["approver"]
        }
      }
      custodian = {
        roleActions = ["delete", "edit_datasnapshot", "update_snapshot", "share_policy::reader", "share_policy::aggregate_data_reader", "share_policy::discoverer", "read_policies", "set_public", "update_auth_domain", "lock_resource", "unlock_resource"]
        includedRoles = ["reader"]
      }
      reader = {
        roleActions = ["read_data", "read_policy::custodian","export_snapshot"]
        includedRoles = ["aggregate_data_reader"]
      }
      aggregate_data_reader = {
        roleActions = ["read_aggregate_data", "create_snapshot_request", "add_child"]
        includedRoles = ["discoverer"]
      }
      discoverer = {
        roleActions = ["discover_data", "read_policy::steward", "read_policy::discoverer", "read_auth_domain", "get_snapshot_builder_settings"]
      }
      admin = {
        roleActions = ["read_policies", "share_policy::steward", "alter_policies", "read_auth_domain", "update_auth_domain", "unlock_resource"]
      }
    }
    reuseIds = false
    authDomainConstrainable = true
  }
  snapshot-builder-request = {
    actionPatterns = {
      get = {
        description = "Get or list the snapshot builder request"
      }
      update = {
        description = "Update the snapshot builder request"
      }
      delete = {
        description = "Delete the snapshot builder request"
      }
      approve = {
        description = "Approve or reject the snapshot builder request"
      }
      create_with_parent = {
        description = "Enables creating the request object with a parent"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["get", "update", "delete", "create_with_parent"]
      }
      approver = {
        roleActions = ["get", "approve", "delete"]
      }
    }
    reuseIds = false
  }
  service-perimeter = {
    actionPatterns = {
      alter_policies = {
        description = "create and delete policies for this service-perimeter"
      }
      read_policies = {
        description = "list all policies and policy details for this service-perimeter"
      }
      add_project = {
        description = "add a project to this service-perimeter"
      }
      add_account_to_whitelist = {
        description = "add a user or service-account to this service-perimeter's access level"
      }
      remove_account_from_whitelist = {
        description = "remove a user or service-account to this service-perimeter's access level"
      }
      remove_project = {
        description = "remove a project from this service-perimeter"
      }
      delete = {
        description = "delete this service-perimeter"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["alter_policies", "read_policies", "add_project", "add_account_to_whitelist", "remove_account_from_whitelist", "remove_project", "delete"]
      }
    }
    reuseIds = true
  }
  landing-zone = {
    actionPatterns = {
      delete = {
        description = "delete this landing zone"
      }
      list_resources = {
        description = "list resources in this landing zone"
      }
      read_policies = {
        description = "view all policies and policy details for this landing zone"
      }
      set_parent = {
        description = "set the parent spend-profile of this landing zone"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "list_resources", "read_policies", "set_parent"]
      }
      user = {
        roleActions = ["list_resources"]
      }
      rawls = {
        roleActions = [
          # billing project delete
          "list_resources"
        ]
      }
    }
    reuseIds = ${?LANDINGZONES_REUSE_IDS}
  }
  wds-instance = {
    actionPatterns = {
      read = {
        description = "read data from this WDS instance"
      }
      write = {
        description = "add, update, delete data in this WDS instance"
      }
      delete = {
        description = "delete this WDS instance"
      }
      get_parent = {
        description = "get the parent workspace of this WDS instance"
      }
      set_parent = {
        description = "set the parent workspace of this WDS instance"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["set_parent", "delete", "write", "read", "get_parent"]
      }
      writer = {
        roleActions = ["write", "read", "get_parent"]
      }
      reader = {
        roleActions = ["read", "get_parent"]
      }
    }
    reuseIds = true
  }
  mct_mapping = {
    actionPatterns = {
      own = {
        description = "perform owner actions on the resource"
      }
      delete = {
        description = "delete this resource"
      }
      read_policies = {
        description = "view all policies and policy details for this resource"
      }
      write = {
        description = "perform writer actions on the resource"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this resource"
      }
      "share_policy::editor" = {
        description = "change the membership of the editor policy for this resource"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::editor", "own", "write"]
      }
      editor = {
        roleActions = ["write"]
      }
    }
    reuseIds = false
  }
  mct_target = {
    actionPatterns = {
      own = {
        description = "perform owner actions on the resource"
      }
      delete = {
        description = "delete this resource"
      }
      read_policies = {
        description = "view all policies and policy details for this resource"
      }
      write = {
        description = "perform writer actions on the resource"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this resource"
      }
      "share_policy::editor" = {
        description = "change the membership of the editor policy for this resource"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::editor", "own", "write"]
      }
      editor = {
        roleActions = ["write"]
      }
    }
    reuseIds = false
  }
  enterprise-feature = {
    actionPatterns = {
      delete = {
        description = "Delete this enterprise feature"
      }
      read_policies = {
        description = "view all policies and policy details for this enterprise feature"
      }
      use = {
        description = "utilize this enterprise feature"
      }
      "share_policy::admin" = {
        description = "change the membership of the admin policy for this enterprise feature"
      }
      "share_policy::user" = {
        description = "change the membership of the user policy for this enterprise feature"
      }
    }
    ownerRoleName = "admin"
    roles = {
      admin = {
        roleActions = ["delete", "read_policies", "use", "share_policy::admin", "share_policy::user"]
      }
      user = {
        roleActions = ["use"]
      }
    }
    allowLeaving = false
    reuseIds = true
  }

  resource-access-constraint = {
    actionPatterns = {
      use = {
        description = "use this RAC for a SAM resource"
      }
      add_lock = {
        description = "add a lock to this RAC"
      }
      delete = {
        description = "delete this RAC"
      }
      read_policies = {
        description = "view all policies and policy details for this RAC"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this RAC"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["use", "add_lock", "delete", "read_policies", "share_policy::owner"]
      }
    }
    allowLeaving = false
    reuseIds = true
  }

  lock = {
    actionPatterns = {
      use = {
        description = "use this lock for a resource access constraint"
      }
      delete = {
        description = "delete this lock"
      }
      read_policies = {
        description = "view all policies and policy details for this lock"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this lock"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["use", "delete", "read_policies", "share_policy::owner"]
      }
    }
    allowLeaving = false
    reuseIds = true
  }

  private_azure_container_registry = {
    actionPatterns = {
      delete = {
        description = "Delete this private azure container registry"
      }
      read_policies = {
        description = "view all policies and policy details for this private azure container registry"
      }
      pull_image = {
        description = "pull an image from the private azure container registry"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this private azure container registry"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this private azure container registry"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "use", "share_policy::owner", "share_policy::reader", "pull_image"]
      }
      reader = {
        roleActions = ["pull_image"]
      }
    }
    allowLeaving = false
    reuseIds = true
  }

  private_azure_storage_account = {
    actionPatterns = {
      delete = {
        description = "Delete this private azure storage account"
      }
      read_policies = {
        description = "view all policies and policy details for this private azure storage account"
      }
      read = {
        description = "read from the private azure storage account"
      }
      write = {
        description = "write to the private azure storage account"
      }
      "share_policy::owner" = {
        description = "change the membership of the owner policy for this private azure storage account"
      }
      "share_policy::reader" = {
        description = "change the membership of the reader policy for this private azure storage account"
      }
      "share_policy::writer" = {
        description = "change the membership of the writer policy for this private azure storage account"
      }
    }
    ownerRoleName = "owner"
    roles = {
      owner = {
        roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::reader", "share_policy::writer", "read", "write"]
      }
      reader = {
        roleActions = ["read"]
      }
      writer = {
        roleActions = ["write"]
      }
    }
    allowLeaving = false
    reuseIds = true
  }

  user = {
    actionPatterns = {}
    ownerRoleName = "admin"
    roles = {
      admin = {
        roleActions = []
      }
    }
    allowLeaving = false
    reuseIds = false
  }
}


distributedLock {
  retryInterval: 5s
  maxRetry: 10
}

blockedEmailDomains = ["qwiklabs-gsuite.net", "qwiklabs.net"]

termsOfService {
  isGracePeriodEnabled = false
  baseUrl: "classpath:tos"
}

prometheus {
  endpointPort = 9098
}