{
  "description": "IAMAuditConfig is the schema for the IAM audit logging API.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "IAMAuditConfigSpec defines the desired state of IAMAuditConfig.",
      "properties": {
        "auditLogConfigs": {
          "description": "Required. The configuration for logging of each type of permission.",
          "items": {
            "properties": {
              "exemptedMembers": {
                "description": "Identities that do not cause logging for this type of permission. The format is the same as that for 'members' in IAMPolicy/IAMPolicyMember.",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "logType": {
                "description": "Permission type for which logging is to be configured. Must be one of 'DATA_READ', 'DATA_WRITE', or 'ADMIN_READ'.",
                "pattern": "^(DATA_READ|DATA_WRITE|ADMIN_READ)$",
                "type": "string"
              }
            },
            "required": [
              "logType"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "resourceRef": {
          "description": "Immutable. Required. The GCP resource to set the IAMAuditConfig on (e.g. project).",
          "properties": {
            "apiVersion": {
              "description": "APIVersion of the referenced resource",
              "type": "string"
            },
            "external": {
              "description": "The external name of the referenced resource",
              "type": "string"
            },
            "kind": {
              "description": "Kind of the referenced resource",
              "type": "string"
            },
            "name": {
              "type": "string"
            },
            "namespace": {
              "type": "string"
            }
          },
          "required": [
            "kind"
          ],
          "type": "object",
          "x-kubernetes-validations": [
            {
              "message": "resourceRef is immutable",
              "rule": "self == oldSelf"
            }
          ],
          "additionalProperties": false
        },
        "service": {
          "description": "Immutable. Required. The service for which to enable Data Access audit logs. The special value 'allServices' covers all services. Note that if there are audit configs covering both 'allServices' and a specific service, then the union of the two audit configs is used for that service: the 'logTypes' specified in each 'auditLogConfig' are enabled, and the 'exemptedMembers' in each 'auditLogConfig' are exempted.",
          "type": "string",
          "x-kubernetes-validations": [
            {
              "message": "service is immutable",
              "rule": "self == oldSelf"
            }
          ]
        }
      },
      "required": [
        "auditLogConfigs",
        "resourceRef",
        "service"
      ],
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "IAMAuditConfigStatus defines the observed state of IAMAuditConfig.",
      "properties": {
        "conditions": {
          "description": "Conditions represent the latest available observations of the IAMAuditConfig's current state.",
          "items": {
            "properties": {
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.",
                "type": "string"
              },
              "message": {
                "description": "Human-readable message indicating details about last transition.",
                "type": "string"
              },
              "reason": {
                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
                "type": "string"
              },
              "status": {
                "description": "Status is the status of the condition. Can be True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "Type is the type of the condition.",
                "type": "string"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "observedGeneration": {
          "description": "ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.",
          "format": "int64",
          "type": "integer"
        }
      },
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}