export declare const AuditLogConfigLogType: {
    /**
     * Default case. Should never be this.
     */
    readonly LogTypeUnspecified: "LOG_TYPE_UNSPECIFIED";
    /**
     * Admin reads. Example: CloudIAM getIamPolicy
     */
    readonly AdminRead: "ADMIN_READ";
    /**
     * Data writes. Example: CloudSQL Users create
     */
    readonly DataWrite: "DATA_WRITE";
    /**
     * Data reads. Example: CloudSQL Users list
     */
    readonly DataRead: "DATA_READ";
};
/**
 * The log type that this config enables.
 */
export type AuditLogConfigLogType = (typeof AuditLogConfigLogType)[keyof typeof AuditLogConfigLogType];
export declare const AuthorizationLoggingOptionsPermissionType: {
    /**
     * Default. Should not be used.
     */
    readonly PermissionTypeUnspecified: "PERMISSION_TYPE_UNSPECIFIED";
    /**
     * A read of admin (meta) data.
     */
    readonly AdminRead: "ADMIN_READ";
    /**
     * A write of admin (meta) data.
     */
    readonly AdminWrite: "ADMIN_WRITE";
    /**
     * A read of standard data.
     */
    readonly DataRead: "DATA_READ";
    /**
     * A write of standard data.
     */
    readonly DataWrite: "DATA_WRITE";
};
/**
 * The type of the permission that was checked.
 */
export type AuthorizationLoggingOptionsPermissionType = (typeof AuthorizationLoggingOptionsPermissionType)[keyof typeof AuthorizationLoggingOptionsPermissionType];
export declare const CloudAuditOptionsLogName: {
    /**
     * Default. Should not be used.
     */
    readonly UnspecifiedLogName: "UNSPECIFIED_LOG_NAME";
    /**
     * Corresponds to "cloudaudit.googleapis.com/activity"
     */
    readonly AdminActivity: "ADMIN_ACTIVITY";
    /**
     * Corresponds to "cloudaudit.googleapis.com/data_access"
     */
    readonly DataAccess: "DATA_ACCESS";
};
/**
 * The log_name to populate in the Cloud Audit Record.
 */
export type CloudAuditOptionsLogName = (typeof CloudAuditOptionsLogName)[keyof typeof CloudAuditOptionsLogName];
export declare const ConditionIam: {
    /**
     * Default non-attribute.
     */
    readonly NoAttr: "NO_ATTR";
    /**
     * Either principal or (if present) authority selector.
     */
    readonly Authority: "AUTHORITY";
    /**
     * The principal (even if an authority selector is present), which must only be used for attribution, not authorization.
     */
    readonly Attribution: "ATTRIBUTION";
    /**
     * Any of the security realms in the IAMContext (go/security-realms). When used with IN, the condition indicates "any of the request's realms match one of the given values; with NOT_IN, "none of the realms match any of the given values". Note that a value can be: - 'self:campus' (i.e., clients that are in the same campus) - 'self:metro' (i.e., clients that are in the same metro) - 'self:cloud-region' (i.e., allow connections from clients that are in the same cloud region) - 'self:prod-region' (i.e., allow connections from clients that are in the same prod region) - 'guardians' (i.e., allow connections from its guardian realms. See go/security-realms-glossary#guardian for more information.) - 'self' [DEPRECATED] (i.e., allow connections from clients that are in the same security realm, which is currently but not guaranteed to be campus-sized) - a realm (e.g., 'campus-abc') - a realm group (e.g., 'realms-for-borg-cell-xx', see: go/realm-groups) A match is determined by a realm group membership check performed by a RealmAclRep object (go/realm-acl-howto). It is not permitted to grant access based on the *absence* of a realm, so realm conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).
     */
    readonly SecurityRealm: "SECURITY_REALM";
    /**
     * An approver (distinct from the requester) that has authorized this request. When used with IN, the condition indicates that one of the approvers associated with the request matches the specified principal, or is a member of the specified group. Approvers can only grant additional access, and are thus only used in a strictly positive context (e.g. ALLOW/IN or DENY/NOT_IN).
     */
    readonly Approver: "APPROVER";
    /**
     * What types of justifications have been supplied with this request. String values should match enum names from security.credentials.JustificationType, e.g. "MANUAL_STRING". It is not permitted to grant access based on the *absence* of a justification, so justification conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN). Multiple justifications, e.g., a Buganizer ID and a manually-entered reason, are normal and supported.
     */
    readonly JustificationType: "JUSTIFICATION_TYPE";
    /**
     * What type of credentials have been supplied with this request. String values should match enum names from security_loas_l2.CredentialsType - currently, only CREDS_TYPE_EMERGENCY is supported. It is not permitted to grant access based on the *absence* of a credentials type, so the conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).
     */
    readonly CredentialsType: "CREDENTIALS_TYPE";
    /**
     * EXPERIMENTAL -- DO NOT USE. The conditions can only be used in a "positive" context (e.g., ALLOW/IN or DENY/NOT_IN).
     */
    readonly CredsAssertion: "CREDS_ASSERTION";
};
/**
 * Trusted attributes supplied by the IAM system.
 */
export type ConditionIam = (typeof ConditionIam)[keyof typeof ConditionIam];
export declare const ConditionOp: {
    /**
     * Default no-op.
     */
    readonly NoOp: "NO_OP";
    /**
     * DEPRECATED. Use IN instead.
     */
    readonly Equals: "EQUALS";
    /**
     * DEPRECATED. Use NOT_IN instead.
     */
    readonly NotEquals: "NOT_EQUALS";
    /**
     * The condition is true if the subject (or any element of it if it is a set) matches any of the supplied values.
     */
    readonly In: "IN";
    /**
     * The condition is true if the subject (or every element of it if it is a set) matches none of the supplied values.
     */
    readonly NotIn: "NOT_IN";
    /**
     * Subject is discharged
     */
    readonly Discharged: "DISCHARGED";
};
/**
 * An operator to apply the subject with.
 */
export type ConditionOp = (typeof ConditionOp)[keyof typeof ConditionOp];
export declare const ConditionSys: {
    /**
     * Default non-attribute type
     */
    readonly NoAttr: "NO_ATTR";
    /**
     * Region of the resource
     */
    readonly Region: "REGION";
    /**
     * Service name
     */
    readonly Service: "SERVICE";
    /**
     * Resource name
     */
    readonly Name: "NAME";
    /**
     * IP address of the caller
     */
    readonly Ip: "IP";
};
/**
 * Trusted attributes supplied by any service that owns resources and uses the IAM system for access control.
 */
export type ConditionSys = (typeof ConditionSys)[keyof typeof ConditionSys];
export declare const DataAccessOptionsLogMode: {
    /**
     * Client is not required to write a partial Gin log immediately after the authorization check. If client chooses to write one and it fails, client may either fail open (allow the operation to continue) or fail closed (handle as a DENY outcome).
     */
    readonly LogModeUnspecified: "LOG_MODE_UNSPECIFIED";
    /**
     * The application's operation in the context of which this authorization check is being made may only be performed if it is successfully logged to Gin. For instance, the authorization library may satisfy this obligation by emitting a partial log entry at authorization check time and only returning ALLOW to the application if it succeeds. If a matching Rule has this directive, but the client has not indicated that it will honor such requirements, then the IAM check will result in authorization failure by setting CheckPolicyResponse.success=false.
     */
    readonly LogFailClosed: "LOG_FAIL_CLOSED";
};
export type DataAccessOptionsLogMode = (typeof DataAccessOptionsLogMode)[keyof typeof DataAccessOptionsLogMode];
export declare const RuleAction: {
    /**
     * Default no action.
     */
    readonly NoAction: "NO_ACTION";
    /**
     * Matching 'Entries' grant access.
     */
    readonly Allow: "ALLOW";
    /**
     * Matching 'Entries' grant access and the caller promises to log the request per the returned log_configs.
     */
    readonly AllowWithLog: "ALLOW_WITH_LOG";
    /**
     * Matching 'Entries' deny access.
     */
    readonly Deny: "DENY";
    /**
     * Matching 'Entries' deny access and the caller promises to log the request per the returned log_configs.
     */
    readonly DenyWithLog: "DENY_WITH_LOG";
    /**
     * Matching 'Entries' tell IAM.Check callers to generate logs.
     */
    readonly Log: "LOG";
};
/**
 * Required
 */
export type RuleAction = (typeof RuleAction)[keyof typeof RuleAction];