var (
	RestrictAllowedResourcesRequest_RestrictionType_name = map[int32]string{
		0: "RESTRICTION_TYPE_UNSPECIFIED",
		1: "ALLOW_ALL_GCP_RESOURCES",
		2: "ALLOW_COMPLIANT_RESOURCES",
	}
	RestrictAllowedResourcesRequest_RestrictionType_value = map[string]int32{
		"RESTRICTION_TYPE_UNSPECIFIED": 0,
		"ALLOW_ALL_GCP_RESOURCES":      1,
		"ALLOW_COMPLIANT_RESOURCES":    2,
	}
)

var (
	Workload_ComplianceRegime_name = map[int32]string{
		0:  "COMPLIANCE_REGIME_UNSPECIFIED",
		1:  "IL4",
		2:  "CJIS",
		3:  "FEDRAMP_HIGH",
		4:  "FEDRAMP_MODERATE",
		5:  "US_REGIONAL_ACCESS",
		6:  "HIPAA",
		7:  "HITRUST",
		8:  "EU_REGIONS_AND_SUPPORT",
		9:  "CA_REGIONS_AND_SUPPORT",
		10: "ITAR",
		11: "AU_REGIONS_AND_US_SUPPORT",
	}
	Workload_ComplianceRegime_value = map[string]int32{
		"COMPLIANCE_REGIME_UNSPECIFIED": 0,
		"IL4":                           1,
		"CJIS":                          2,
		"FEDRAMP_HIGH":                  3,
		"FEDRAMP_MODERATE":              4,
		"US_REGIONAL_ACCESS":            5,
		"HIPAA":                         6,
		"HITRUST":                       7,
		"EU_REGIONS_AND_SUPPORT":        8,
		"CA_REGIONS_AND_SUPPORT":        9,
		"ITAR":                          10,
		"AU_REGIONS_AND_US_SUPPORT":     11,
	}
)

var (
	Workload_KajEnrollmentState_name = map[int32]string{
		0: "KAJ_ENROLLMENT_STATE_UNSPECIFIED",
		1: "KAJ_ENROLLMENT_STATE_PENDING",
		2: "KAJ_ENROLLMENT_STATE_COMPLETE",
	}
	Workload_KajEnrollmentState_value = map[string]int32{
		"KAJ_ENROLLMENT_STATE_UNSPECIFIED": 0,
		"KAJ_ENROLLMENT_STATE_PENDING":     1,
		"KAJ_ENROLLMENT_STATE_COMPLETE":    2,
	}
)

var (
	Workload_ResourceInfo_ResourceType_name = map[int32]string{
		0: "RESOURCE_TYPE_UNSPECIFIED",
		1: "CONSUMER_PROJECT",
		4: "CONSUMER_FOLDER",
		2: "ENCRYPTION_KEYS_PROJECT",
		3: "KEYRING",
	}
	Workload_ResourceInfo_ResourceType_value = map[string]int32{
		"RESOURCE_TYPE_UNSPECIFIED": 0,
		"CONSUMER_PROJECT":          1,
		"CONSUMER_FOLDER":           4,
		"ENCRYPTION_KEYS_PROJECT":   2,
		"KEYRING":                   3,
	}
)

var (
	Workload_SaaEnrollmentResponse_SetupState_name = map[int32]string{
		0: "SETUP_STATE_UNSPECIFIED",
		1: "STATUS_PENDING",
		2: "STATUS_COMPLETE",
	}
	Workload_SaaEnrollmentResponse_SetupState_value = map[string]int32{
		"SETUP_STATE_UNSPECIFIED": 0,
		"STATUS_PENDING":          1,
		"STATUS_COMPLETE":         2,
	}
)

var (
	Workload_SaaEnrollmentResponse_SetupError_name = map[int32]string{
		0: "SETUP_ERROR_UNSPECIFIED",
		1: "ERROR_INVALID_BASE_SETUP",
		2: "ERROR_MISSING_EXTERNAL_SIGNING_KEY",
		3: "ERROR_NOT_ALL_SERVICES_ENROLLED",
		4: "ERROR_SETUP_CHECK_FAILED",
	}
	Workload_SaaEnrollmentResponse_SetupError_value = map[string]int32{
		"SETUP_ERROR_UNSPECIFIED":            0,
		"ERROR_INVALID_BASE_SETUP":           1,
		"ERROR_MISSING_EXTERNAL_SIGNING_KEY": 2,
		"ERROR_NOT_ALL_SERVICES_ENROLLED":    3,
		"ERROR_SETUP_CHECK_FAILED":           4,
	}
)

var File_google_cloud_assuredworkloads_v1beta1_assuredworkloads_proto protoreflect.FileDescriptor

var File_google_cloud_assuredworkloads_v1beta1_assuredworkloads_service_proto protoreflect.FileDescriptor

type AnalyzeWorkloadMoveRequest struct {

	// The resource type to be moved to the destination workload. It can be either
	// an existing project or a project-based workload.
	//
	// Types that are assignable to ProjectOrWorkloadResource:
	//
	//	*AnalyzeWorkloadMoveRequest_Source
	//	*AnalyzeWorkloadMoveRequest_Project
	ProjectOrWorkloadResource isAnalyzeWorkloadMoveRequest_ProjectOrWorkloadResource `protobuf_oneof:"projectOrWorkloadResource"`
	// Required. The resource ID of the folder-based destination workload. This workload is
	// where the source project will hypothetically be moved to. Specify the
	// workload's relative resource name, formatted as:
	// "organizations/{ORGANIZATION_ID}/locations/{LOCATION_ID}/workloads/{WORKLOAD_ID}"
	// For example:
	// "organizations/123/locations/us-east1/workloads/assured-workload-2"
	Target string `protobuf:"bytes,2,opt,name=target,proto3" json:"target,omitempty"`
	// contains filtered or unexported fields
}

type AnalyzeWorkloadMoveRequest_Project struct {
	// The source type is a project. Specify the project's relative resource
	// name, formatted as either a project number or a project ID:
	// "projects/{PROJECT_NUMBER}" or "projects/{PROJECT_ID}"
	// For example:
	// "projects/951040570662" when specifying a project number, or
	// "projects/my-project-123" when specifying a project ID.
	Project string `protobuf:"bytes,3,opt,name=project,proto3,oneof"`
}

type AnalyzeWorkloadMoveRequest_Source struct {
	// The source type is a project-based workload. Specify the workloads's
	// relative resource name, formatted as:
	// "organizations/{ORGANIZATION_ID}/locations/{LOCATION_ID}/workloads/{WORKLOAD_ID}"
	// For example:
	// "organizations/123/locations/us-east1/workloads/assured-workload-1"
	Source string `protobuf:"bytes,1,opt,name=source,proto3,oneof"`
}

type AnalyzeWorkloadMoveResponse struct {

	// A list of blockers that should be addressed before moving the source
	// project or project-based workload to the destination folder-based workload.
	Blockers []string `protobuf:"bytes,1,rep,name=blockers,proto3" json:"blockers,omitempty"`
	// contains filtered or unexported fields
}

type AssuredWorkloadsServiceClient interface {
	// Creates Assured Workload.
	CreateWorkload(ctx context.Context, in *CreateWorkloadRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Updates an existing workload.
	// Currently allows updating of workload display_name and labels.
	// For force updates don't set etag field in the Workload.
	// Only one update operation per workload can be in progress.
	UpdateWorkload(ctx context.Context, in *UpdateWorkloadRequest, opts ...grpc.CallOption) (*Workload, error)
	// Restrict the list of resources allowed in the Workload environment.
	// The current list of allowed products can be found at
	// https://cloud.google.com/assured-workloads/docs/supported-products
	// In addition to assuredworkloads.workload.update permission, the user should
	// also have orgpolicy.policy.set permission on the folder resource
	// to use this functionality.
	RestrictAllowedResources(ctx context.Context, in *RestrictAllowedResourcesRequest, opts ...grpc.CallOption) (*RestrictAllowedResourcesResponse, error)
	// Deletes the workload. Make sure that workload's direct children are already
	// in a deleted state, otherwise the request will fail with a
	// FAILED_PRECONDITION error.
	// In addition to assuredworkloads.workload.delete permission, the user should
	// also have orgpolicy.policy.set permission on the deleted folder to remove
	// Assured Workloads OrgPolicies.
	DeleteWorkload(ctx context.Context, in *DeleteWorkloadRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Gets Assured Workload associated with a CRM Node
	GetWorkload(ctx context.Context, in *GetWorkloadRequest, opts ...grpc.CallOption) (*Workload, error)
	// Analyze if the source Assured Workloads can be moved to the target Assured
	// Workload
	AnalyzeWorkloadMove(ctx context.Context, in *AnalyzeWorkloadMoveRequest, opts ...grpc.CallOption) (*AnalyzeWorkloadMoveResponse, error)
	// Lists Assured Workloads under a CRM Node.
	ListWorkloads(ctx context.Context, in *ListWorkloadsRequest, opts ...grpc.CallOption) (*ListWorkloadsResponse, error)
}

type AssuredWorkloadsServiceServer interface {
	// Creates Assured Workload.
	CreateWorkload(context.Context, *CreateWorkloadRequest) (*longrunningpb.Operation, error)
	// Updates an existing workload.
	// Currently allows updating of workload display_name and labels.
	// For force updates don't set etag field in the Workload.
	// Only one update operation per workload can be in progress.
	UpdateWorkload(context.Context, *UpdateWorkloadRequest) (*Workload, error)
	// Restrict the list of resources allowed in the Workload environment.
	// The current list of allowed products can be found at
	// https://cloud.google.com/assured-workloads/docs/supported-products
	// In addition to assuredworkloads.workload.update permission, the user should
	// also have orgpolicy.policy.set permission on the folder resource
	// to use this functionality.
	RestrictAllowedResources(context.Context, *RestrictAllowedResourcesRequest) (*RestrictAllowedResourcesResponse, error)
	// Deletes the workload. Make sure that workload's direct children are already
	// in a deleted state, otherwise the request will fail with a
	// FAILED_PRECONDITION error.
	// In addition to assuredworkloads.workload.delete permission, the user should
	// also have orgpolicy.policy.set permission on the deleted folder to remove
	// Assured Workloads OrgPolicies.
	DeleteWorkload(context.Context, *DeleteWorkloadRequest) (*emptypb.Empty, error)
	// Gets Assured Workload associated with a CRM Node
	GetWorkload(context.Context, *GetWorkloadRequest) (*Workload, error)
	// Analyze if the source Assured Workloads can be moved to the target Assured
	// Workload
	AnalyzeWorkloadMove(context.Context, *AnalyzeWorkloadMoveRequest) (*AnalyzeWorkloadMoveResponse, error)
	// Lists Assured Workloads under a CRM Node.
	ListWorkloads(context.Context, *ListWorkloadsRequest) (*ListWorkloadsResponse, error)
}

type CreateWorkloadOperationMetadata struct {

	// Optional. Time when the operation was created.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Optional. The display name of the workload.
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Optional. The parent of the workload.
	Parent string `protobuf:"bytes,3,opt,name=parent,proto3" json:"parent,omitempty"`
	// Optional. Compliance controls that should be applied to the resources managed by
	// the workload.
	ComplianceRegime Workload_ComplianceRegime `protobuf:"varint,4,opt,name=compliance_regime,json=complianceRegime,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_ComplianceRegime" json:"compliance_regime,omitempty"`
	// Optional. Resource properties in the input that are used for creating/customizing
	// workload resources.
	ResourceSettings []*Workload_ResourceSettings `protobuf:"bytes,5,rep,name=resource_settings,json=resourceSettings,proto3" json:"resource_settings,omitempty"`
	// contains filtered or unexported fields
}

type CreateWorkloadRequest struct {

	// Required. The resource name of the new Workload's parent.
	// Must be of the form `organizations/{org_id}/locations/{location_id}`.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. Assured Workload to create
	Workload *Workload `protobuf:"bytes,2,opt,name=workload,proto3" json:"workload,omitempty"`
	// Optional. A identifier associated with the workload and underlying projects which
	// allows for the break down of billing costs for a workload. The value
	// provided for the identifier will add a label to the workload and contained
	// projects with the identifier as the value.
	ExternalId string `protobuf:"bytes,3,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
	// contains filtered or unexported fields
}

type DeleteWorkloadRequest struct {

	// Required. The `name` field is used to identify the workload.
	// Format:
	// organizations/{org_id}/locations/{location_id}/workloads/{workload_id}
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional. The etag of the workload.
	// If this is provided, it must match the server's etag.
	Etag string `protobuf:"bytes,2,opt,name=etag,proto3" json:"etag,omitempty"`
	// contains filtered or unexported fields
}

type GetWorkloadRequest struct {

	// Required. The resource name of the Workload to fetch. This is the workloads's
	// relative path in the API, formatted as
	// "organizations/{organization_id}/locations/{location_id}/workloads/{workload_id}".
	// For example,
	// "organizations/123/locations/us-east1/workloads/assured-workload-1".
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ListWorkloadsRequest struct {

	// Required. Parent Resource to list workloads from.
	// Must be of the form `organizations/{org_id}/locations/{location}`.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Page size.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Page token returned from previous request. Page token contains context from
	// previous request. Page token needs to be passed in the second and following
	// requests.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// A custom filter for filtering by properties of a workload. At this time,
	// only filtering by labels is supported.
	Filter string `protobuf:"bytes,4,opt,name=filter,proto3" json:"filter,omitempty"`
	// contains filtered or unexported fields
}

type ListWorkloadsResponse struct {

	// List of Workloads under a given parent.
	Workloads []*Workload `protobuf:"bytes,1,rep,name=workloads,proto3" json:"workloads,omitempty"`
	// The next page token. Return empty if reached the last page.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type RestrictAllowedResourcesRequest struct {

	// Required. The resource name of the Workload. This is the workloads's
	// relative path in the API, formatted as
	// "organizations/{organization_id}/locations/{location_id}/workloads/{workload_id}".
	// For example,
	// "organizations/123/locations/us-east1/workloads/assured-workload-1".
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Required. The type of restriction for using gcp products in the Workload environment.
	RestrictionType RestrictAllowedResourcesRequest_RestrictionType `protobuf:"varint,2,opt,name=restriction_type,json=restrictionType,proto3,enum=google.cloud.assuredworkloads.v1beta1.RestrictAllowedResourcesRequest_RestrictionType" json:"restriction_type,omitempty"`
	// contains filtered or unexported fields
}

type RestrictAllowedResourcesRequest_RestrictionType int32

const (
	// Unknown restriction type.
	RestrictAllowedResourcesRequest_RESTRICTION_TYPE_UNSPECIFIED RestrictAllowedResourcesRequest_RestrictionType = 0
	// Allow the use all of all gcp products, irrespective of the compliance
	// posture. This effectively removes gcp.restrictServiceUsage OrgPolicy
	// on the AssuredWorkloads Folder.
	RestrictAllowedResourcesRequest_ALLOW_ALL_GCP_RESOURCES RestrictAllowedResourcesRequest_RestrictionType = 1
	// Based on Workload's compliance regime, allowed list changes.
	// See - https://cloud.google.com/assured-workloads/docs/supported-products
	// for the list of supported resources.
	RestrictAllowedResourcesRequest_ALLOW_COMPLIANT_RESOURCES RestrictAllowedResourcesRequest_RestrictionType = 2
)

type RestrictAllowedResourcesResponse struct {
	// contains filtered or unexported fields
}

type UnimplementedAssuredWorkloadsServiceServer struct {
}

type UpdateWorkloadRequest struct {

	// Required. The workload to update.
	// The workload's `name` field is used to identify the workload to be updated.
	// Format:
	// organizations/{org_id}/locations/{location_id}/workloads/{workload_id}
	Workload *Workload `protobuf:"bytes,1,opt,name=workload,proto3" json:"workload,omitempty"`
	// Required. The list of fields to be updated.
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type Workload struct {

	// Optional. The resource name of the workload.
	// Format:
	// organizations/{organization}/locations/{location}/workloads/{workload}
	//
	// Read-only.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Required. The user-assigned display name of the Workload.
	// When present it must be between 4 to 30 characters.
	// Allowed characters are: lowercase and uppercase letters, numbers,
	// hyphen, and spaces.
	//
	// Example: My Workload
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Output only. The resources associated with this workload.
	// These resources will be created when creating the workload.
	// If any of the projects already exist, the workload creation will fail.
	// Always read only.
	Resources []*Workload_ResourceInfo `protobuf:"bytes,3,rep,name=resources,proto3" json:"resources,omitempty"`
	// Required. Immutable. Compliance Regime associated with this workload.
	ComplianceRegime Workload_ComplianceRegime `protobuf:"varint,4,opt,name=compliance_regime,json=complianceRegime,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_ComplianceRegime" json:"compliance_regime,omitempty"`
	// Output only. Immutable. The Workload creation timestamp.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. The billing account used for the resources which are
	// direct children of workload. This billing account is initially associated
	// with the resources created as part of Workload creation.
	// After the initial creation of these resources, the customer can change
	// the assigned billing account.
	// The resource name has the form
	// `billingAccounts/{billing_account_id}`. For example,
	// `billingAccounts/012345-567890-ABCDEF`.
	BillingAccount string `protobuf:"bytes,6,opt,name=billing_account,json=billingAccount,proto3" json:"billing_account,omitempty"`
	// Settings specific to the selected [compliance_regime]
	//
	// Types that are assignable to ComplianceRegimeSettings:
	//
	//	*Workload_Il4Settings
	//	*Workload_CjisSettings
	//	*Workload_FedrampHighSettings_
	//	*Workload_FedrampModerateSettings_
	ComplianceRegimeSettings isWorkload_ComplianceRegimeSettings `protobuf_oneof:"compliance_regime_settings"`
	// Optional. ETag of the workload, it is calculated on the basis
	// of the Workload contents. It will be used in Update & Delete operations.
	Etag string `protobuf:"bytes,9,opt,name=etag,proto3" json:"etag,omitempty"`
	// Optional. Labels applied to the workload.
	Labels map[string]string `protobuf:"bytes,10,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// Input only. The parent resource for the resources managed by this Assured Workload. May
	// be either empty or a folder resource which is a child of the
	// Workload parent. If not specified all resources are created under the
	// parent organization.
	// Format:
	// folders/{folder_id}
	ProvisionedResourcesParent string `protobuf:"bytes,13,opt,name=provisioned_resources_parent,json=provisionedResourcesParent,proto3" json:"provisioned_resources_parent,omitempty"`
	// Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS
	// CMEK key is provisioned.
	// This field is deprecated as of Feb 28, 2022.
	// In order to create a Keyring, callers should specify,
	// ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field.
	//
	// Deprecated: Marked as deprecated in google/cloud/assuredworkloads/v1beta1/assuredworkloads.proto.
	KmsSettings *Workload_KMSSettings `protobuf:"bytes,14,opt,name=kms_settings,json=kmsSettings,proto3" json:"kms_settings,omitempty"`
	// Input only. Resource properties that are used to customize workload resources.
	// These properties (such as custom project id) will be used to create
	// workload resources if possible. This field is optional.
	ResourceSettings []*Workload_ResourceSettings `protobuf:"bytes,15,rep,name=resource_settings,json=resourceSettings,proto3" json:"resource_settings,omitempty"`
	// Output only. Represents the KAJ enrollment state of the given workload.
	KajEnrollmentState Workload_KajEnrollmentState `protobuf:"varint,17,opt,name=kaj_enrollment_state,json=kajEnrollmentState,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_KajEnrollmentState" json:"kaj_enrollment_state,omitempty"`
	// Optional. Indicates the sovereignty status of the given workload.
	// Currently meant to be used by Europe/Canada customers.
	EnableSovereignControls bool `protobuf:"varint,18,opt,name=enable_sovereign_controls,json=enableSovereignControls,proto3" json:"enable_sovereign_controls,omitempty"`
	// Output only. Represents the SAA enrollment response of the given workload.
	// SAA enrollment response is queried during GetWorkload call.
	// In failure cases, user friendly error message is shown in SAA details page.
	SaaEnrollmentResponse *Workload_SaaEnrollmentResponse `protobuf:"bytes,20,opt,name=saa_enrollment_response,json=saaEnrollmentResponse,proto3" json:"saa_enrollment_response,omitempty"`
	// Output only. Urls for services which are compliant for this Assured Workload, but which
	// are currently disallowed by the ResourceUsageRestriction org policy.
	// Invoke RestrictAllowedResources endpoint to allow your project developers
	// to use these services in their environment."
	CompliantButDisallowedServices []string `protobuf:"bytes,24,rep,name=compliant_but_disallowed_services,json=compliantButDisallowedServices,proto3" json:"compliant_but_disallowed_services,omitempty"`
	// contains filtered or unexported fields
}

type Workload_CJISSettings struct {

	// Input only. Immutable. Settings used to create a CMEK crypto key.
	KmsSettings *Workload_KMSSettings `protobuf:"bytes,1,opt,name=kms_settings,json=kmsSettings,proto3" json:"kms_settings,omitempty"`
	// contains filtered or unexported fields
}

type Workload_CjisSettings struct {
	// Input only. Immutable. Settings specific to resources needed for CJIS.
	//
	// Deprecated: Marked as deprecated in google/cloud/assuredworkloads/v1beta1/assuredworkloads.proto.
	CjisSettings *Workload_CJISSettings `protobuf:"bytes,8,opt,name=cjis_settings,json=cjisSettings,proto3,oneof"`
}

type Workload_ComplianceRegime int32

const (
	// Unknown compliance regime.
	Workload_COMPLIANCE_REGIME_UNSPECIFIED Workload_ComplianceRegime = 0
	// Information protection as per DoD IL4 requirements.
	Workload_IL4 Workload_ComplianceRegime = 1
	// Criminal Justice Information Services (CJIS) Security policies.
	Workload_CJIS Workload_ComplianceRegime = 2
	// FedRAMP High data protection controls
	Workload_FEDRAMP_HIGH Workload_ComplianceRegime = 3
	// FedRAMP Moderate data protection controls
	Workload_FEDRAMP_MODERATE Workload_ComplianceRegime = 4
	// Assured Workloads For US Regions data protection controls
	Workload_US_REGIONAL_ACCESS Workload_ComplianceRegime = 5
	// Health Insurance Portability and Accountability Act controls
	Workload_HIPAA Workload_ComplianceRegime = 6
	// Health Information Trust Alliance controls
	Workload_HITRUST Workload_ComplianceRegime = 7
	// Assured Workloads For EU Regions and Support controls
	Workload_EU_REGIONS_AND_SUPPORT Workload_ComplianceRegime = 8
	// Assured Workloads For Canada Regions and Support controls
	Workload_CA_REGIONS_AND_SUPPORT Workload_ComplianceRegime = 9
	// International Traffic in Arms Regulations
	Workload_ITAR Workload_ComplianceRegime = 10
	// Assured Workloads for Australia Regions and Support controls
	Workload_AU_REGIONS_AND_US_SUPPORT Workload_ComplianceRegime = 11
)

type Workload_FedrampHighSettings struct {

	// Input only. Immutable. Settings used to create a CMEK crypto key.
	KmsSettings *Workload_KMSSettings `protobuf:"bytes,1,opt,name=kms_settings,json=kmsSettings,proto3" json:"kms_settings,omitempty"`
	// contains filtered or unexported fields
}

type Workload_FedrampHighSettings_ struct {
	// Input only. Immutable. Settings specific to resources needed for FedRAMP High.
	//
	// Deprecated: Marked as deprecated in google/cloud/assuredworkloads/v1beta1/assuredworkloads.proto.
	FedrampHighSettings *Workload_FedrampHighSettings `protobuf:"bytes,11,opt,name=fedramp_high_settings,json=fedrampHighSettings,proto3,oneof"`
}

type Workload_FedrampModerateSettings struct {

	// Input only. Immutable. Settings used to create a CMEK crypto key.
	KmsSettings *Workload_KMSSettings `protobuf:"bytes,1,opt,name=kms_settings,json=kmsSettings,proto3" json:"kms_settings,omitempty"`
	// contains filtered or unexported fields
}

type Workload_FedrampModerateSettings_ struct {
	// Input only. Immutable. Settings specific to resources needed for FedRAMP Moderate.
	//
	// Deprecated: Marked as deprecated in google/cloud/assuredworkloads/v1beta1/assuredworkloads.proto.
	FedrampModerateSettings *Workload_FedrampModerateSettings `protobuf:"bytes,12,opt,name=fedramp_moderate_settings,json=fedrampModerateSettings,proto3,oneof"`
}

type Workload_IL4Settings struct {

	// Input only. Immutable. Settings used to create a CMEK crypto key.
	KmsSettings *Workload_KMSSettings `protobuf:"bytes,1,opt,name=kms_settings,json=kmsSettings,proto3" json:"kms_settings,omitempty"`
	// contains filtered or unexported fields
}

type Workload_Il4Settings struct {
	// Input only. Immutable. Settings specific to resources needed for IL4.
	//
	// Deprecated: Marked as deprecated in google/cloud/assuredworkloads/v1beta1/assuredworkloads.proto.
	Il4Settings *Workload_IL4Settings `protobuf:"bytes,7,opt,name=il4_settings,json=il4Settings,proto3,oneof"`
}

type Workload_KMSSettings struct {

	// Required. Input only. Immutable. The time at which the Key Management Service will automatically create a
	// new version of the crypto key and mark it as the primary.
	NextRotationTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=next_rotation_time,json=nextRotationTime,proto3" json:"next_rotation_time,omitempty"`
	// Required. Input only. Immutable. [next_rotation_time] will be advanced by this period when the Key
	// Management Service automatically rotates a key. Must be at least 24 hours
	// and at most 876,000 hours.
	RotationPeriod *durationpb.Duration `protobuf:"bytes,2,opt,name=rotation_period,json=rotationPeriod,proto3" json:"rotation_period,omitempty"`
	// contains filtered or unexported fields
}

type Workload_KajEnrollmentState int32

const (
	// Default State for KAJ Enrollment.
	Workload_KAJ_ENROLLMENT_STATE_UNSPECIFIED Workload_KajEnrollmentState = 0
	// Pending State for KAJ Enrollment.
	Workload_KAJ_ENROLLMENT_STATE_PENDING Workload_KajEnrollmentState = 1
	// Complete State for KAJ Enrollment.
	Workload_KAJ_ENROLLMENT_STATE_COMPLETE Workload_KajEnrollmentState = 2
)

type Workload_ResourceInfo struct {

	// Resource identifier.
	// For a project this represents project_number.
	ResourceId int64 `protobuf:"varint,1,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"`
	// Indicates the type of resource.
	ResourceType Workload_ResourceInfo_ResourceType `protobuf:"varint,2,opt,name=resource_type,json=resourceType,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_ResourceInfo_ResourceType" json:"resource_type,omitempty"`
	// contains filtered or unexported fields
}

type Workload_ResourceInfo_ResourceType int32

const (
	// Unknown resource type.
	Workload_ResourceInfo_RESOURCE_TYPE_UNSPECIFIED Workload_ResourceInfo_ResourceType = 0
	// Deprecated. Existing workloads will continue to support this, but new
	// CreateWorkloadRequests should not specify this as an input value.
	//
	// Deprecated: Marked as deprecated in google/cloud/assuredworkloads/v1beta1/assuredworkloads.proto.
	Workload_ResourceInfo_CONSUMER_PROJECT Workload_ResourceInfo_ResourceType = 1
	// Consumer Folder.
	Workload_ResourceInfo_CONSUMER_FOLDER Workload_ResourceInfo_ResourceType = 4
	// Consumer project containing encryption keys.
	Workload_ResourceInfo_ENCRYPTION_KEYS_PROJECT Workload_ResourceInfo_ResourceType = 2
	// Keyring resource that hosts encryption keys.
	Workload_ResourceInfo_KEYRING Workload_ResourceInfo_ResourceType = 3
)

type Workload_ResourceSettings struct {

	// Resource identifier.
	// For a project this represents project_id. If the project is already
	// taken, the workload creation will fail.
	// For KeyRing, this represents the keyring_id.
	// For a folder, don't set this value as folder_id is assigned by Google.
	ResourceId string `protobuf:"bytes,1,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"`
	// Indicates the type of resource. This field should be specified to
	// correspond the id to the right project type (CONSUMER_PROJECT or
	// ENCRYPTION_KEYS_PROJECT)
	ResourceType Workload_ResourceInfo_ResourceType `protobuf:"varint,2,opt,name=resource_type,json=resourceType,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_ResourceInfo_ResourceType" json:"resource_type,omitempty"`
	// User-assigned resource display name.
	// If not empty it will be used to create a resource with the specified
	// name.
	DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// contains filtered or unexported fields
}

type Workload_SaaEnrollmentResponse struct {

	// Indicates SAA enrollment status of a given workload.
	SetupStatus *Workload_SaaEnrollmentResponse_SetupState `protobuf:"varint,1,opt,name=setup_status,json=setupStatus,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_SaaEnrollmentResponse_SetupState,oneof" json:"setup_status,omitempty"`
	// Indicates SAA enrollment setup error if any.
	SetupErrors []Workload_SaaEnrollmentResponse_SetupError `protobuf:"varint,2,rep,packed,name=setup_errors,json=setupErrors,proto3,enum=google.cloud.assuredworkloads.v1beta1.Workload_SaaEnrollmentResponse_SetupError" json:"setup_errors,omitempty"`
	// contains filtered or unexported fields
}

type Workload_SaaEnrollmentResponse_SetupError int32

const (
	// Unspecified.
	Workload_SaaEnrollmentResponse_SETUP_ERROR_UNSPECIFIED Workload_SaaEnrollmentResponse_SetupError = 0
	// Invalid states for all customers, to be redirected to AA UI for
	// additional details.
	Workload_SaaEnrollmentResponse_ERROR_INVALID_BASE_SETUP Workload_SaaEnrollmentResponse_SetupError = 1
	// Returned when there is not an EKM key configured.
	Workload_SaaEnrollmentResponse_ERROR_MISSING_EXTERNAL_SIGNING_KEY Workload_SaaEnrollmentResponse_SetupError = 2
	// Returned when there are no enrolled services or the customer is
	// enrolled in CAA only for a subset of services.
	Workload_SaaEnrollmentResponse_ERROR_NOT_ALL_SERVICES_ENROLLED Workload_SaaEnrollmentResponse_SetupError = 3
	// Returned when exception was encountered during evaluation of other
	// criteria.
	Workload_SaaEnrollmentResponse_ERROR_SETUP_CHECK_FAILED Workload_SaaEnrollmentResponse_SetupError = 4
)

type Workload_SaaEnrollmentResponse_SetupState int32

const (
	// Unspecified.
	Workload_SaaEnrollmentResponse_SETUP_STATE_UNSPECIFIED Workload_SaaEnrollmentResponse_SetupState = 0
	// SAA enrollment pending.
	Workload_SaaEnrollmentResponse_STATUS_PENDING Workload_SaaEnrollmentResponse_SetupState = 1
	// SAA enrollment comopleted.
	Workload_SaaEnrollmentResponse_STATUS_COMPLETE Workload_SaaEnrollmentResponse_SetupState = 2
)