unitycatalog_common/models/_gen/
unitycatalog.credentials.v1.rs

1// @generated
2// This file is @generated by prost-build.
3/// The Azure service principal configuration.
4#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
5#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
6pub struct AzureServicePrincipal {
7    /// The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.
8    #[prost(string, tag="1")]
9    pub directory_id: ::prost::alloc::string::String,
10    /// The application ID of the application registration within the referenced AAD tenant.
11    #[prost(string, tag="2")]
12    pub application_id: ::prost::alloc::string::String,
13    #[prost(oneof="azure_service_principal::Credential", tags="3, 5")]
14    pub credential: ::core::option::Option<azure_service_principal::Credential>,
15}
16/// Nested message and enum types in `AzureServicePrincipal`.
17pub mod azure_service_principal {
18    #[cfg_attr(feature = "python", ::pyo3::pyclass)]
19    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
20    pub enum Credential {
21        /// The client secret generated for the above app ID in AAD.
22        #[prost(string, tag="3")]
23        ClientSecret(::prost::alloc::string::String),
24        /// Location of the file containing a federated token.
25        ///
26        /// Specifically useful for workload identity federation.
27        #[prost(string, tag="5")]
28        FederatedTokenFile(::prost::alloc::string::String),
29    }
30}
31/// The Azure managed identity configuration.
32#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
33#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
34pub struct AzureManagedIdentity {
35    /// The Azure resource ID of the Azure Databricks Access Connector.
36    /// Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/
37    /// Microsoft.Databricks/accessConnectors/{connector-name}.
38    #[prost(string, tag="1")]
39    pub access_connector_id: ::prost::alloc::string::String,
40    /// The Databricks internal ID that represents this managed identity.
41    #[prost(string, optional, tag="2")]
42    pub credential_id: ::core::option::Option<::prost::alloc::string::String>,
43    /// The Azure resource ID of the managed identity.
44    /// Use the format /subscriptions/{guid}/resourceGroups/{rg-name}/providers/
45    /// Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}.
46    /// This is only available for user-assigned identities. For system-assigned
47    /// identities, the access_connector_id is used to identify the identity.
48    /// If this field is not provided, then the system-assigned identity of the
49    /// Access Connector is used.
50    #[prost(string, optional, tag="3")]
51    pub managed_identity_id: ::core::option::Option<::prost::alloc::string::String>,
52}
53/// The Azure storage key configuration.
54#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
55#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
56pub struct AzureStorageKey {
57    /// The name of the storage account.
58    #[prost(string, tag="1")]
59    pub account_name: ::prost::alloc::string::String,
60    /// The account key of the storage account.
61    #[prost(string, tag="2")]
62    pub account_key: ::prost::alloc::string::String,
63}
64/// The AWS IAM role configuration used server-side to call STS AssumeRole.
65///
66/// This is an internal configuration type, not exposed in the public API response.
67/// It stores the static credentials (or ambient credential fallback) used to
68/// authorize the STS:AssumeRole call when vending temporary credentials.
69#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
70#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
71pub struct AwsIamRoleConfig {
72    /// The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.
73    #[prost(string, tag="1")]
74    pub role_arn: ::prost::alloc::string::String,
75    /// The AWS region where STS calls are made. Defaults to "us-east-1" if absent.
76    #[prost(string, optional, tag="2")]
77    pub region: ::core::option::Option<::prost::alloc::string::String>,
78    /// AWS access key ID used to authorize the STS AssumeRole call.
79    ///
80    /// When set together with secret_access_key, these static credentials are used
81    /// as the base identity to call STS:AssumeRole. When omitted, the server falls
82    /// back to ambient credentials (instance profile, ECS task role, WebIdentity, etc.).
83    #[prost(string, optional, tag="3")]
84    pub access_key_id: ::core::option::Option<::prost::alloc::string::String>,
85    /// AWS secret access key paired with access_key_id.
86    #[prost(string, optional, tag="4")]
87    pub secret_access_key: ::core::option::Option<::prost::alloc::string::String>,
88    /// Optional AWS session token for temporary base credentials (e.g. when the
89    /// caller itself holds STS-vended credentials as the base identity).
90    #[prost(string, optional, tag="5")]
91    pub session_token: ::core::option::Option<::prost::alloc::string::String>,
92}
93/// The AWS IAM role configuration returned in credential responses.
94#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
95#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
96pub struct AwsIamRole {
97    /// The external ID used in role assumption to prevent the confused deputy problem.
98    #[prost(string, tag="1")]
99    pub external_id: ::prost::alloc::string::String,
100    /// The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.
101    #[prost(string, tag="2")]
102    pub role_arn: ::prost::alloc::string::String,
103    /// The Amazon Resource Name (ARN) of the AWS IAM user managed by Databricks.
104    /// This is the identity that is going to assume the AWS IAM role.
105    #[prost(string, tag="3")]
106    pub unity_catalog_iam_arn: ::prost::alloc::string::String,
107}
108/// The Databricks managed GCP service account configuration.
109#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
110#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
111pub struct DatabricksGcpServiceAccount {
112    /// The Databricks internal ID that represents this managed identity.
113    #[prost(string, optional, tag="1")]
114    pub credential_id: ::core::option::Option<::prost::alloc::string::String>,
115    /// The email of the service account.
116    #[prost(string, optional, tag="2")]
117    pub email: ::core::option::Option<::prost::alloc::string::String>,
118    /// The ID that represents the private key for this Service Account.
119    #[prost(string, optional, tag="3")]
120    pub private_key_id: ::core::option::Option<::prost::alloc::string::String>,
121}
122/// A credential used to access external data sources or services.
123#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
124#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
125pub struct Credential {
126    /// The credential name.
127    ///
128    /// The name must be unique among storage and service credentials within the metastore.
129    #[prost(string, tag="1")]
130    pub name: ::prost::alloc::string::String,
131    /// The unique identifier of the credential.
132    #[prost(string, optional, tag="2")]
133    pub id: ::core::option::Option<::prost::alloc::string::String>,
134    /// Indicates the purpose of the credential.
135    #[prost(enumeration="Purpose", tag="3")]
136    pub purpose: i32,
137    /// Whether the credential is usable only for read operations.
138    ///
139    /// Only applicable when purpose is STORAGE.
140    #[prost(bool, tag="4")]
141    pub read_only: bool,
142    /// Comment associated with the credential.
143    #[prost(string, optional, tag="5")]
144    pub comment: ::core::option::Option<::prost::alloc::string::String>,
145    /// Username of current owner of credential.
146    #[prost(string, optional, tag="6")]
147    pub owner: ::core::option::Option<::prost::alloc::string::String>,
148    /// Time at which this credential was created, in epoch milliseconds.
149    #[prost(int64, optional, tag="7")]
150    pub created_at: ::core::option::Option<i64>,
151    /// Username of credential creator.
152    #[prost(string, optional, tag="8")]
153    pub created_by: ::core::option::Option<::prost::alloc::string::String>,
154    /// Time at which this credential was last modified, in epoch milliseconds.
155    #[prost(int64, optional, tag="9")]
156    pub updated_at: ::core::option::Option<i64>,
157    /// Username of user who last modified the credential.
158    #[prost(string, optional, tag="10")]
159    pub updated_by: ::core::option::Option<::prost::alloc::string::String>,
160    /// Whether this credential is the current metastore's root storage credential.
161    ///
162    /// Only applicable when purpose is STORAGE.
163    #[prost(bool, tag="11")]
164    pub used_for_managed_storage: bool,
165    /// The full name of the credential.
166    #[prost(string, optional, tag="12")]
167    pub full_name: ::core::option::Option<::prost::alloc::string::String>,
168    /// The Azure service principal configuration.
169    #[prost(message, optional, tag="100")]
170    pub azure_service_principal: ::core::option::Option<AzureServicePrincipal>,
171    /// The Azure managed identity configuration.
172    #[prost(message, optional, tag="101")]
173    pub azure_managed_identity: ::core::option::Option<AzureManagedIdentity>,
174    /// The Azure storage key configuration.
175    #[prost(message, optional, tag="102")]
176    pub azure_storage_key: ::core::option::Option<AzureStorageKey>,
177    /// The AWS IAM role configuration.
178    #[prost(message, optional, tag="103")]
179    pub aws_iam_role: ::core::option::Option<AwsIamRoleConfig>,
180    /// The Databricks managed GCP service account configuration.
181    #[prost(message, optional, tag="104")]
182    pub databricks_gcp_service_account: ::core::option::Option<DatabricksGcpServiceAccount>,
183}
184/// The purpose of a credential.
185#[cfg_attr(feature = "python", ::pyo3::pyclass)]
186#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
187#[repr(i32)]
188pub enum Purpose {
189    Unspecified = 0,
190    /// The credential is used to access external storage locations.
191    Storage = 1,
192    /// The credential is used to access external services.
193    Service = 2,
194}
195impl Purpose {
196    /// String value of the enum field names used in the ProtoBuf definition.
197    ///
198    /// The values are not transformed in any way and thus are considered stable
199    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
200    pub fn as_str_name(&self) -> &'static str {
201        match self {
202            Self::Unspecified => "PURPOSE_UNSPECIFIED",
203            Self::Storage => "STORAGE",
204            Self::Service => "SERVICE",
205        }
206    }
207    /// Creates an enum from field names used in the ProtoBuf definition.
208    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
209        match value {
210            "PURPOSE_UNSPECIFIED" => Some(Self::Unspecified),
211            "STORAGE" => Some(Self::Storage),
212            "SERVICE" => Some(Self::Service),
213            _ => None,
214        }
215    }
216}
217#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
218#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
219pub struct ListCredentialsRequest {
220    /// Return only credentials for the specified purpose.
221    #[prost(enumeration="Purpose", optional, tag="1")]
222    pub purpose: ::core::option::Option<i32>,
223    /// The maximum number of results per page that should be returned.
224    #[prost(int32, optional, tag="2")]
225    pub max_results: ::core::option::Option<i32>,
226    /// Opaque pagination token to go to next page based on previous query.
227    #[prost(string, optional, tag="3")]
228    pub page_token: ::core::option::Option<::prost::alloc::string::String>,
229}
230#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
231#[derive(Clone, PartialEq, ::prost::Message)]
232pub struct ListCredentialsResponse {
233    /// The credentials returned.
234    #[prost(message, repeated, tag="1")]
235    pub credentials: ::prost::alloc::vec::Vec<Credential>,
236    /// The next_page_token value to include in the next List request.
237    #[prost(string, optional, tag="2")]
238    pub next_page_token: ::core::option::Option<::prost::alloc::string::String>,
239}
240/// Create a new credential.
241#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
242#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
243pub struct CreateCredentialRequest {
244    /// The credential name. The name must be unique among storage and service credentials within the metastore.
245    #[prost(string, tag="1")]
246    pub name: ::prost::alloc::string::String,
247    /// Indicates the purpose of the credential.
248    #[prost(enumeration="Purpose", tag="2")]
249    pub purpose: i32,
250    /// Comment associated with the credential.
251    #[prost(string, optional, tag="3")]
252    pub comment: ::core::option::Option<::prost::alloc::string::String>,
253    /// Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.
254    #[prost(bool, optional, tag="4")]
255    pub read_only: ::core::option::Option<bool>,
256    /// Optional. Supplying true to this argument skips validation of the created set of credentials.
257    #[prost(bool, optional, tag="5")]
258    pub skip_validation: ::core::option::Option<bool>,
259    /// The Azure service principal configuration.
260    #[prost(message, optional, tag="100")]
261    pub azure_service_principal: ::core::option::Option<AzureServicePrincipal>,
262    /// The Azure managed identity configuration.
263    #[prost(message, optional, tag="101")]
264    pub azure_managed_identity: ::core::option::Option<AzureManagedIdentity>,
265    /// The Azure storage key configuration.
266    #[prost(message, optional, tag="102")]
267    pub azure_storage_key: ::core::option::Option<AzureStorageKey>,
268    /// The AWS IAM role configuration.
269    #[prost(message, optional, tag="103")]
270    pub aws_iam_role: ::core::option::Option<AwsIamRoleConfig>,
271    /// The Databricks managed GCP service account configuration.
272    #[prost(message, optional, tag="104")]
273    pub databricks_gcp_service_account: ::core::option::Option<DatabricksGcpServiceAccount>,
274}
275/// Get a credential.
276#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
277#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
278pub struct GetCredentialRequest {
279    /// Name of credential.
280    #[prost(string, tag="1")]
281    pub name: ::prost::alloc::string::String,
282}
283/// Update a credential.
284#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
285#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
286pub struct UpdateCredentialRequest {
287    /// Name of credential.
288    #[prost(string, tag="1")]
289    pub name: ::prost::alloc::string::String,
290    /// New name of the credential.
291    #[prost(string, optional, tag="2")]
292    pub new_name: ::core::option::Option<::prost::alloc::string::String>,
293    /// Comment associated with the credential.
294    #[prost(string, optional, tag="3")]
295    pub comment: ::core::option::Option<::prost::alloc::string::String>,
296    /// Whether the credential is usable only for read operations. Only applicable when purpose is STORAGE.
297    #[prost(bool, optional, tag="4")]
298    pub read_only: ::core::option::Option<bool>,
299    /// Username of current owner of credential.
300    #[prost(string, optional, tag="5")]
301    pub owner: ::core::option::Option<::prost::alloc::string::String>,
302    /// Supply true to this argument to skip validation of the updated credential.
303    #[prost(bool, optional, tag="6")]
304    pub skip_validation: ::core::option::Option<bool>,
305    /// Force an update even if there are dependent services (when purpose is SERVICE)
306    /// or dependent external locations and external tables (when purpose is STORAGE).
307    #[prost(bool, optional, tag="7")]
308    pub force: ::core::option::Option<bool>,
309    /// The Azure service principal configuration.
310    #[prost(message, optional, tag="100")]
311    pub azure_service_principal: ::core::option::Option<AzureServicePrincipal>,
312    /// The Azure managed identity configuration.
313    #[prost(message, optional, tag="101")]
314    pub azure_managed_identity: ::core::option::Option<AzureManagedIdentity>,
315    /// The Azure storage key configuration.
316    #[prost(message, optional, tag="102")]
317    pub azure_storage_key: ::core::option::Option<AzureStorageKey>,
318    /// The AWS IAM role configuration.
319    #[prost(message, optional, tag="103")]
320    pub aws_iam_role: ::core::option::Option<AwsIamRoleConfig>,
321    /// The Databricks managed GCP service account configuration.
322    #[prost(message, optional, tag="104")]
323    pub databricks_gcp_service_account: ::core::option::Option<DatabricksGcpServiceAccount>,
324}
325/// Delete a credential.
326#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
327#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
328pub struct DeleteCredentialRequest {
329    /// Name of credential.
330    #[prost(string, tag="1")]
331    pub name: ::prost::alloc::string::String,
332}
333include!("unitycatalog.credentials.v1.serde.rs");
334// @@protoc_insertion_point(module)
unitycatalog_common/models/_gen/unitycatalog.credentials.v1.rs

unitycatalog_common/models/_gen/
unitycatalog.credentials.v1.rs
