v1alpha1

type ACL struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.type) || (has(self.initProvider) && has(self.initProvider.type))",message="spec.forProvider.type is a required parameter"
	Spec   ACLSpec   `json:"spec"`
	Status ACLStatus `json:"status,omitempty"`
}

type ACLInitParameters struct {

	// Specifies the IPv4 CIDR blocks from which console access or api access is allowed.
	// The ip_cidrs cannot repeat. The object structure is documented below.
	IPCidrs []IPCidrsInitParameters `json:"ipCidrs,omitempty" tf:"ip_cidrs,omitempty"`

	// Specifies the IP address ranges from which console access or api access is allowed.
	// The ip_ranges cannot repeat. The object structure is documented below.
	IPRanges []IPRangesInitParameters `json:"ipRanges,omitempty" tf:"ip_ranges,omitempty"`

	// Specifies the ACL is created through the Console or API.
	// Valid values are console and api. Changing this parameter will create a new ACL.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type ACLList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ACL `json:"items"`
}

type ACLObservation struct {

	// The ID of identity ACL.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Specifies the IPv4 CIDR blocks from which console access or api access is allowed.
	// The ip_cidrs cannot repeat. The object structure is documented below.
	IPCidrs []IPCidrsObservation `json:"ipCidrs,omitempty" tf:"ip_cidrs,omitempty"`

	// Specifies the IP address ranges from which console access or api access is allowed.
	// The ip_ranges cannot repeat. The object structure is documented below.
	IPRanges []IPRangesObservation `json:"ipRanges,omitempty" tf:"ip_ranges,omitempty"`

	// Specifies the ACL is created through the Console or API.
	// Valid values are console and api. Changing this parameter will create a new ACL.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type ACLParameters struct {

	// Specifies the IPv4 CIDR blocks from which console access or api access is allowed.
	// The ip_cidrs cannot repeat. The object structure is documented below.
	// +kubebuilder:validation:Optional
	IPCidrs []IPCidrsParameters `json:"ipCidrs,omitempty" tf:"ip_cidrs,omitempty"`

	// Specifies the IP address ranges from which console access or api access is allowed.
	// The ip_ranges cannot repeat. The object structure is documented below.
	// +kubebuilder:validation:Optional
	IPRanges []IPRangesParameters `json:"ipRanges,omitempty" tf:"ip_ranges,omitempty"`

	// Specifies the ACL is created through the Console or API.
	// Valid values are console and api. Changing this parameter will create a new ACL.
	// +kubebuilder:validation:Optional
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type ACLSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     ACLParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider ACLInitParameters `json:"initProvider,omitempty"`
}

type ACLStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        ACLObservation `json:"atProvider,omitempty"`
}

type AccessConfigInitParameters struct {

	// Specifies the access type of the identity provider.
	// Available options are:
	AccessType *string `json:"accessType,omitempty" tf:"access_type,omitempty"`

	// Specifies the authorization endpoint of the OpenID Connect identity
	// provider. This field is required only if the access type is set to program_console.
	AuthorizationEndpoint *string `json:"authorizationEndpoint,omitempty" tf:"authorization_endpoint,omitempty"`

	// Specifies the ID of a client registered with the OpenID Connect identity provider.
	ClientID *string `json:"clientId,omitempty" tf:"client_id,omitempty"`

	// Specifies the URL of the identity provider.
	// This field corresponds to the iss field in the ID token.
	ProviderURL *string `json:"providerUrl,omitempty" tf:"provider_url,omitempty"`

	// Response mode.
	// Valid values is form_post and fragment, default value is form_post.
	// This field is required only if the access type is set to program_console.
	ResponseMode *string `json:"responseMode,omitempty" tf:"response_mode,omitempty"`

	// Response type. Valid values is id_token, default value is id_token.
	// This field is required only if the access type is set to program_console.
	ResponseType *string `json:"responseType,omitempty" tf:"response_type,omitempty"`

	// Specifies the scopes of authorization requests. It is an array of one or more scopes.
	// Valid values are openid, email, profile and other values defined by you.
	// This field is required only if the access type is set to program_console.
	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`

	// Public key used to sign the ID token of the OpenID Connect identity provider.
	// This field is required only if the protocol is set to oidc.
	SigningKey *string `json:"signingKey,omitempty" tf:"signing_key,omitempty"`
}

type AccessConfigObservation struct {

	// Specifies the access type of the identity provider.
	// Available options are:
	AccessType *string `json:"accessType,omitempty" tf:"access_type,omitempty"`

	// Specifies the authorization endpoint of the OpenID Connect identity
	// provider. This field is required only if the access type is set to program_console.
	AuthorizationEndpoint *string `json:"authorizationEndpoint,omitempty" tf:"authorization_endpoint,omitempty"`

	// Specifies the ID of a client registered with the OpenID Connect identity provider.
	ClientID *string `json:"clientId,omitempty" tf:"client_id,omitempty"`

	// Specifies the URL of the identity provider.
	// This field corresponds to the iss field in the ID token.
	ProviderURL *string `json:"providerUrl,omitempty" tf:"provider_url,omitempty"`

	// Response mode.
	// Valid values is form_post and fragment, default value is form_post.
	// This field is required only if the access type is set to program_console.
	ResponseMode *string `json:"responseMode,omitempty" tf:"response_mode,omitempty"`

	// Response type. Valid values is id_token, default value is id_token.
	// This field is required only if the access type is set to program_console.
	ResponseType *string `json:"responseType,omitempty" tf:"response_type,omitempty"`

	// Specifies the scopes of authorization requests. It is an array of one or more scopes.
	// Valid values are openid, email, profile and other values defined by you.
	// This field is required only if the access type is set to program_console.
	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`

	// Public key used to sign the ID token of the OpenID Connect identity provider.
	// This field is required only if the protocol is set to oidc.
	SigningKey *string `json:"signingKey,omitempty" tf:"signing_key,omitempty"`
}

type AccessConfigParameters struct {

	// Specifies the access type of the identity provider.
	// Available options are:
	// +kubebuilder:validation:Optional
	AccessType *string `json:"accessType" tf:"access_type,omitempty"`

	// Specifies the authorization endpoint of the OpenID Connect identity
	// provider. This field is required only if the access type is set to program_console.
	// +kubebuilder:validation:Optional
	AuthorizationEndpoint *string `json:"authorizationEndpoint,omitempty" tf:"authorization_endpoint,omitempty"`

	// Specifies the ID of a client registered with the OpenID Connect identity provider.
	// +kubebuilder:validation:Optional
	ClientID *string `json:"clientId" tf:"client_id,omitempty"`

	// Specifies the URL of the identity provider.
	// This field corresponds to the iss field in the ID token.
	// +kubebuilder:validation:Optional
	ProviderURL *string `json:"providerUrl" tf:"provider_url,omitempty"`

	// Response mode.
	// Valid values is form_post and fragment, default value is form_post.
	// This field is required only if the access type is set to program_console.
	// +kubebuilder:validation:Optional
	ResponseMode *string `json:"responseMode,omitempty" tf:"response_mode,omitempty"`

	// Response type. Valid values is id_token, default value is id_token.
	// This field is required only if the access type is set to program_console.
	// +kubebuilder:validation:Optional
	ResponseType *string `json:"responseType,omitempty" tf:"response_type,omitempty"`

	// Specifies the scopes of authorization requests. It is an array of one or more scopes.
	// Valid values are openid, email, profile and other values defined by you.
	// This field is required only if the access type is set to program_console.
	// +kubebuilder:validation:Optional
	Scopes []*string `json:"scopes,omitempty" tf:"scopes,omitempty"`

	// Public key used to sign the ID token of the OpenID Connect identity provider.
	// This field is required only if the protocol is set to oidc.
	// +kubebuilder:validation:Optional
	SigningKey *string `json:"signingKey" tf:"signing_key,omitempty"`
}

type AccessKey struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.userId) || (has(self.initProvider) && has(self.initProvider.userId))",message="spec.forProvider.userId is a required parameter"
	Spec   AccessKeySpec   `json:"spec"`
	Status AccessKeyStatus `json:"status,omitempty"`
}

type AccessKeyInitParameters struct {

	// Specifies the description of the access key.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Either a base-64 encoded PGP public key, or a keybase username in the form
	// keybase:some_person_that_exists. Changing this creates a new resource.
	PgpKey *string `json:"pgpKey,omitempty" tf:"pgp_key,omitempty"`

	// Specifies the file name that can save access key and access secret key.
	// Defaults to ./credentials-{{user name}}.csv. Changing this creates a new resource.
	SecretFile *string `json:"secretFile,omitempty" tf:"secret_file,omitempty"`

	// Specifies the status of the access key. It must be active or inactive. Default value
	// is active.
	Status *string `json:"status,omitempty" tf:"status,omitempty"`

	// Specifies the ID of the user who is requesting to create an access key.
	// Changing this creates a new resource.
	UserID *string `json:"userId,omitempty" tf:"user_id,omitempty"`
}

type AccessKeyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessKey `json:"items"`
}

type AccessKeyObservation struct {

	// The time when the access key was created.
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// Specifies the description of the access key.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// The encrypted secret, base64 encoded.
	EncryptedSecret *string `json:"encryptedSecret,omitempty" tf:"encrypted_secret,omitempty"`

	// The access key ID.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// The fingerprint of the PGP key used to encrypt the secret
	KeyFingerprint *string `json:"keyFingerprint,omitempty" tf:"key_fingerprint,omitempty"`

	// Either a base-64 encoded PGP public key, or a keybase username in the form
	// keybase:some_person_that_exists. Changing this creates a new resource.
	PgpKey *string `json:"pgpKey,omitempty" tf:"pgp_key,omitempty"`

	// Specifies the file name that can save access key and access secret key.
	// Defaults to ./credentials-{{user name}}.csv. Changing this creates a new resource.
	SecretFile *string `json:"secretFile,omitempty" tf:"secret_file,omitempty"`

	// Specifies the status of the access key. It must be active or inactive. Default value
	// is active.
	Status *string `json:"status,omitempty" tf:"status,omitempty"`

	// Specifies the ID of the user who is requesting to create an access key.
	// Changing this creates a new resource.
	UserID *string `json:"userId,omitempty" tf:"user_id,omitempty"`

	// The name of IAM user.
	UserName *string `json:"userName,omitempty" tf:"user_name,omitempty"`
}

type AccessKeyParameters struct {

	// Specifies the description of the access key.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Either a base-64 encoded PGP public key, or a keybase username in the form
	// keybase:some_person_that_exists. Changing this creates a new resource.
	// +kubebuilder:validation:Optional
	PgpKey *string `json:"pgpKey,omitempty" tf:"pgp_key,omitempty"`

	// Specifies the file name that can save access key and access secret key.
	// Defaults to ./credentials-{{user name}}.csv. Changing this creates a new resource.
	// +kubebuilder:validation:Optional
	SecretFile *string `json:"secretFile,omitempty" tf:"secret_file,omitempty"`

	// Specifies the status of the access key. It must be active or inactive. Default value
	// is active.
	// +kubebuilder:validation:Optional
	Status *string `json:"status,omitempty" tf:"status,omitempty"`

	// Specifies the ID of the user who is requesting to create an access key.
	// Changing this creates a new resource.
	// +kubebuilder:validation:Optional
	UserID *string `json:"userId,omitempty" tf:"user_id,omitempty"`
}

type AccessKeySpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     AccessKeyParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider AccessKeyInitParameters `json:"initProvider,omitempty"`
}

type AccessKeyStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        AccessKeyObservation `json:"atProvider,omitempty"`
}

type Agency struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || (has(self.initProvider) && has(self.initProvider.name))",message="spec.forProvider.name is a required parameter"
	Spec   AgencySpec   `json:"spec"`
	Status AgencyStatus `json:"status,omitempty"`
}

type AgencyInitParameters struct {

	// Specifies an array of one or more role names which stand for the permissions
	// to be granted to agency on all resources, including those in enterprise projects, region-specific projects,
	// and global services under your account.
	// +listType=set
	AllResourcesRoles []*string `json:"allResourcesRoles,omitempty" tf:"all_resources_roles,omitempty"`

	// Specifies the name of delegated user domain.
	// schema: Required
	DelegatedDomainName *string `json:"delegatedDomainName,omitempty" tf:"delegated_domain_name,omitempty"`

	// Specifies the name of agency. The name is a string of 1 to 64 characters.
	// Changing this will create a new agency.
	// schema: Internal
	DelegatedServiceName *string `json:"delegatedServiceName,omitempty" tf:"delegated_service_name,omitempty"`

	// Specifies the supplementary information about the agency. The value is a string of
	// 0 to 255 characters, excluding these characters: '@#$%^&*<>\'.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies an array of one or more role names which stand for the permissions to be
	// granted to agency on domain.
	// +listType=set
	DomainRoles []*string `json:"domainRoles,omitempty" tf:"domain_roles,omitempty"`

	// Specifies the validity period of an agency. The valid value are FOREVER, ONEDAY
	// or the specific days, for example, "20". The default value is FOREVER.
	Duration *string `json:"duration,omitempty" tf:"duration,omitempty"`

	// Specifies the name of agency. The name is a string of 1 to 64 characters.
	// Changing this will create a new agency.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// Specifies an array of one or more roles and projects which are used to grant
	// permissions to agency on project. The structure is documented below.
	ProjectRole []ProjectRoleInitParameters `json:"projectRole,omitempty" tf:"project_role,omitempty"`
}

type AgencyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Agency `json:"items"`
}

type AgencyObservation struct {

	// Specifies an array of one or more role names which stand for the permissions
	// to be granted to agency on all resources, including those in enterprise projects, region-specific projects,
	// and global services under your account.
	// +listType=set
	AllResourcesRoles []*string `json:"allResourcesRoles,omitempty" tf:"all_resources_roles,omitempty"`

	// The time when the agency was created.
	CreateTime *string `json:"createTime,omitempty" tf:"create_time,omitempty"`

	// Specifies the name of delegated user domain.
	// schema: Required
	DelegatedDomainName *string `json:"delegatedDomainName,omitempty" tf:"delegated_domain_name,omitempty"`

	// Specifies the name of agency. The name is a string of 1 to 64 characters.
	// Changing this will create a new agency.
	// schema: Internal
	DelegatedServiceName *string `json:"delegatedServiceName,omitempty" tf:"delegated_service_name,omitempty"`

	// Specifies the supplementary information about the agency. The value is a string of
	// 0 to 255 characters, excluding these characters: '@#$%^&*<>\'.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies an array of one or more role names which stand for the permissions to be
	// granted to agency on domain.
	// +listType=set
	DomainRoles []*string `json:"domainRoles,omitempty" tf:"domain_roles,omitempty"`

	// Specifies the validity period of an agency. The valid value are FOREVER, ONEDAY
	// or the specific days, for example, "20". The default value is FOREVER.
	Duration *string `json:"duration,omitempty" tf:"duration,omitempty"`

	// The expiration time of agency.
	ExpireTime *string `json:"expireTime,omitempty" tf:"expire_time,omitempty"`

	// The agency ID.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Specifies the name of agency. The name is a string of 1 to 64 characters.
	// Changing this will create a new agency.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// Specifies an array of one or more roles and projects which are used to grant
	// permissions to agency on project. The structure is documented below.
	ProjectRole []ProjectRoleObservation `json:"projectRole,omitempty" tf:"project_role,omitempty"`
}

type AgencyParameters struct {

	// Specifies an array of one or more role names which stand for the permissions
	// to be granted to agency on all resources, including those in enterprise projects, region-specific projects,
	// and global services under your account.
	// +kubebuilder:validation:Optional
	// +listType=set
	AllResourcesRoles []*string `json:"allResourcesRoles,omitempty" tf:"all_resources_roles,omitempty"`

	// Specifies the name of delegated user domain.
	// schema: Required
	// +kubebuilder:validation:Optional
	DelegatedDomainName *string `json:"delegatedDomainName,omitempty" tf:"delegated_domain_name,omitempty"`

	// Specifies the name of agency. The name is a string of 1 to 64 characters.
	// Changing this will create a new agency.
	// schema: Internal
	// +kubebuilder:validation:Optional
	DelegatedServiceName *string `json:"delegatedServiceName,omitempty" tf:"delegated_service_name,omitempty"`

	// Specifies the supplementary information about the agency. The value is a string of
	// 0 to 255 characters, excluding these characters: '@#$%^&*<>\'.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies an array of one or more role names which stand for the permissions to be
	// granted to agency on domain.
	// +kubebuilder:validation:Optional
	// +listType=set
	DomainRoles []*string `json:"domainRoles,omitempty" tf:"domain_roles,omitempty"`

	// Specifies the validity period of an agency. The valid value are FOREVER, ONEDAY
	// or the specific days, for example, "20". The default value is FOREVER.
	// +kubebuilder:validation:Optional
	Duration *string `json:"duration,omitempty" tf:"duration,omitempty"`

	// Specifies the name of agency. The name is a string of 1 to 64 characters.
	// Changing this will create a new agency.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// Specifies an array of one or more roles and projects which are used to grant
	// permissions to agency on project. The structure is documented below.
	// +kubebuilder:validation:Optional
	ProjectRole []ProjectRoleParameters `json:"projectRole,omitempty" tf:"project_role,omitempty"`
}

type AgencySpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     AgencyParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider AgencyInitParameters `json:"initProvider,omitempty"`
}

type AgencyStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        AgencyObservation `json:"atProvider,omitempty"`
}

type ConversionRulesInitParameters struct {
}

type ConversionRulesLocalInitParameters struct {

	// Specifies the user group to which the federated user belongs on the cloud platform.
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// Specifies the name of a federated user on the cloud platform.
	Username *string `json:"username,omitempty" tf:"username,omitempty"`
}

type ConversionRulesLocalObservation struct {

	// Specifies the user group to which the federated user belongs on the cloud platform.
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// Specifies the name of a federated user on the cloud platform.
	Username *string `json:"username,omitempty" tf:"username,omitempty"`
}

type ConversionRulesLocalParameters struct {

	// Specifies the user group to which the federated user belongs on the cloud platform.
	// +kubebuilder:validation:Optional
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// Specifies the name of a federated user on the cloud platform.
	// +kubebuilder:validation:Optional
	Username *string `json:"username" tf:"username,omitempty"`
}

type ConversionRulesObservation struct {

	// The federated user information on the cloud platform.
	Local []LocalObservation `json:"local,omitempty" tf:"local,omitempty"`

	// The description of the identity provider.
	Remote []RemoteObservation `json:"remote,omitempty" tf:"remote,omitempty"`
}

type ConversionRulesParameters struct {
}

type ConversionRulesRemoteInitParameters struct {

	// Specifies the attribute in the IDP assertion.
	Attribute *string `json:"attribute,omitempty" tf:"attribute,omitempty"`

	// Specifies the condition of conversion rule.
	// Available options are:
	Condition *string `json:"condition,omitempty" tf:"condition,omitempty"`

	// Specifies the rule is matched only if the specified strings appear in the attribute type.
	Value []*string `json:"value,omitempty" tf:"value,omitempty"`
}

type ConversionRulesRemoteObservation struct {

	// Specifies the attribute in the IDP assertion.
	Attribute *string `json:"attribute,omitempty" tf:"attribute,omitempty"`

	// Specifies the condition of conversion rule.
	// Available options are:
	Condition *string `json:"condition,omitempty" tf:"condition,omitempty"`

	// Specifies the rule is matched only if the specified strings appear in the attribute type.
	Value []*string `json:"value,omitempty" tf:"value,omitempty"`
}

type ConversionRulesRemoteParameters struct {

	// Specifies the attribute in the IDP assertion.
	// +kubebuilder:validation:Optional
	Attribute *string `json:"attribute" tf:"attribute,omitempty"`

	// Specifies the condition of conversion rule.
	// Available options are:
	// +kubebuilder:validation:Optional
	Condition *string `json:"condition,omitempty" tf:"condition,omitempty"`

	// Specifies the rule is matched only if the specified strings appear in the attribute type.
	// +kubebuilder:validation:Optional
	Value []*string `json:"value,omitempty" tf:"value,omitempty"`
}

type Group struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || (has(self.initProvider) && has(self.initProvider.name))",message="spec.forProvider.name is a required parameter"
	Spec   GroupSpec   `json:"spec"`
	Status GroupStatus `json:"status,omitempty"`
}

type GroupInitParameters struct {

	// Specifies the description of the group.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies the name of the group. The length is less than or equal to 64 bytes.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`
}

type GroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Group `json:"items"`
}

type GroupMembership struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.group) || (has(self.initProvider) && has(self.initProvider.group))",message="spec.forProvider.group is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.users) || (has(self.initProvider) && has(self.initProvider.users))",message="spec.forProvider.users is a required parameter"
	Spec   GroupMembershipSpec   `json:"spec"`
	Status GroupMembershipStatus `json:"status,omitempty"`
}

type GroupMembershipInitParameters struct {

	// Specifies the group ID of this membership.
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// Specifies a list of IAM user IDs to associate to the group.
	// +listType=set
	Users []*string `json:"users,omitempty" tf:"users,omitempty"`
}

type GroupMembershipList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GroupMembership `json:"items"`
}

type GroupMembershipObservation struct {

	// Specifies the group ID of this membership.
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// The resource ID in UUID format.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Specifies a list of IAM user IDs to associate to the group.
	// +listType=set
	Users []*string `json:"users,omitempty" tf:"users,omitempty"`
}

type GroupMembershipParameters struct {

	// Specifies the group ID of this membership.
	// +kubebuilder:validation:Optional
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// Specifies a list of IAM user IDs to associate to the group.
	// +kubebuilder:validation:Optional
	// +listType=set
	Users []*string `json:"users,omitempty" tf:"users,omitempty"`
}

type GroupMembershipSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     GroupMembershipParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider GroupMembershipInitParameters `json:"initProvider,omitempty"`
}

type GroupMembershipStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        GroupMembershipObservation `json:"atProvider,omitempty"`
}

type GroupObservation struct {

	// Specifies the description of the group.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// The resource ID in UUID format.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Specifies the name of the group. The length is less than or equal to 64 bytes.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`
}

type GroupParameters struct {

	// Specifies the description of the group.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies the name of the group. The length is less than or equal to 64 bytes.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`
}

type GroupRoleAssignment struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              GroupRoleAssignmentSpec   `json:"spec"`
	Status            GroupRoleAssignmentStatus `json:"status,omitempty"`
}

type GroupRoleAssignmentInitParameters struct {

	// Specifies the domain to assign the role in.
	// Changing this parameter will create a new resource.
	DomainID *string `json:"domainId,omitempty" tf:"domain_id,omitempty"`

	// Specifies the enterprise project to assign the role in.
	// Changing this parameter will create a new resource.
	EnterpriseProjectID *string `json:"enterpriseProjectId,omitempty" tf:"enterprise_project_id,omitempty"`

	// Specifies the group to assign the role to.
	// Changing this parameter will create a new resource.
	// +crossplane:generate:reference:type=github.com/huaweicloud/provider-huaweicloud/apis/iam/v1alpha1.Group
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	GroupID *string `json:"groupId,omitempty" tf:"group_id,omitempty"`

	// Reference to a Group in iam to populate groupId.
	// +kubebuilder:validation:Optional
	GroupIDRef *v1.Reference `json:"groupIdRef,omitempty" tf:"-"`

	// Selector for a Group in iam to populate groupId.
	// +kubebuilder:validation:Optional
	GroupIDSelector *v1.Selector `json:"groupIdSelector,omitempty" tf:"-"`

	// Specifies the project to assign the role in.
	// If project_id is set to all, it means that the specified user group will be able to use all projects,
	// including existing and future projects.
	ProjectID *string `json:"projectId,omitempty" tf:"project_id,omitempty"`

	// Specifies the role to assign.
	// Changing this parameter will create a new resource.
	// +crossplane:generate:reference:type=github.com/huaweicloud/provider-huaweicloud/apis/iam/v1alpha1.Role
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	RoleID *string `json:"roleId,omitempty" tf:"role_id,omitempty"`

	// Reference to a Role in iam to populate roleId.
	// +kubebuilder:validation:Optional
	RoleIDRef *v1.Reference `json:"roleIdRef,omitempty" tf:"-"`

	// Selector for a Role in iam to populate roleId.
	// +kubebuilder:validation:Optional
	RoleIDSelector *v1.Selector `json:"roleIdSelector,omitempty" tf:"-"`
}

type GroupRoleAssignmentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GroupRoleAssignment `json:"items"`
}

type GroupRoleAssignmentObservation struct {

	// Specifies the domain to assign the role in.
	// Changing this parameter will create a new resource.
	DomainID *string `json:"domainId,omitempty" tf:"domain_id,omitempty"`

	// Specifies the enterprise project to assign the role in.
	// Changing this parameter will create a new resource.
	EnterpriseProjectID *string `json:"enterpriseProjectId,omitempty" tf:"enterprise_project_id,omitempty"`

	// Specifies the group to assign the role to.
	// Changing this parameter will create a new resource.
	GroupID *string `json:"groupId,omitempty" tf:"group_id,omitempty"`

	// The resource ID. When assign in domain, the format is <group_id>/<role_id>/<domain_id>;
	// when assign in project, the format is <group_id>/<role_id>/<project_id>;
	// when assign in enterprise project, the format is <group_id>/<role_id>/<enterprise_project_id>;
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Specifies the project to assign the role in.
	// If project_id is set to all, it means that the specified user group will be able to use all projects,
	// including existing and future projects.
	ProjectID *string `json:"projectId,omitempty" tf:"project_id,omitempty"`

	// Specifies the role to assign.
	// Changing this parameter will create a new resource.
	RoleID *string `json:"roleId,omitempty" tf:"role_id,omitempty"`
}

type GroupRoleAssignmentParameters struct {

	// Specifies the domain to assign the role in.
	// Changing this parameter will create a new resource.
	// +kubebuilder:validation:Optional
	DomainID *string `json:"domainId,omitempty" tf:"domain_id,omitempty"`

	// Specifies the enterprise project to assign the role in.
	// Changing this parameter will create a new resource.
	// +kubebuilder:validation:Optional
	EnterpriseProjectID *string `json:"enterpriseProjectId,omitempty" tf:"enterprise_project_id,omitempty"`

	// Specifies the group to assign the role to.
	// Changing this parameter will create a new resource.
	// +crossplane:generate:reference:type=github.com/huaweicloud/provider-huaweicloud/apis/iam/v1alpha1.Group
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	// +kubebuilder:validation:Optional
	GroupID *string `json:"groupId,omitempty" tf:"group_id,omitempty"`

	// Reference to a Group in iam to populate groupId.
	// +kubebuilder:validation:Optional
	GroupIDRef *v1.Reference `json:"groupIdRef,omitempty" tf:"-"`

	// Selector for a Group in iam to populate groupId.
	// +kubebuilder:validation:Optional
	GroupIDSelector *v1.Selector `json:"groupIdSelector,omitempty" tf:"-"`

	// Specifies the project to assign the role in.
	// If project_id is set to all, it means that the specified user group will be able to use all projects,
	// including existing and future projects.
	// +kubebuilder:validation:Optional
	ProjectID *string `json:"projectId,omitempty" tf:"project_id,omitempty"`

	// Specifies the role to assign.
	// Changing this parameter will create a new resource.
	// +crossplane:generate:reference:type=github.com/huaweicloud/provider-huaweicloud/apis/iam/v1alpha1.Role
	// +crossplane:generate:reference:extractor=github.com/crossplane/upjet/pkg/resource.ExtractResourceID()
	// +kubebuilder:validation:Optional
	RoleID *string `json:"roleId,omitempty" tf:"role_id,omitempty"`

	// Reference to a Role in iam to populate roleId.
	// +kubebuilder:validation:Optional
	RoleIDRef *v1.Reference `json:"roleIdRef,omitempty" tf:"-"`

	// Selector for a Role in iam to populate roleId.
	// +kubebuilder:validation:Optional
	RoleIDSelector *v1.Selector `json:"roleIdSelector,omitempty" tf:"-"`
}

type GroupRoleAssignmentSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     GroupRoleAssignmentParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider GroupRoleAssignmentInitParameters `json:"initProvider,omitempty"`
}

type GroupRoleAssignmentStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        GroupRoleAssignmentObservation `json:"atProvider,omitempty"`
}

type GroupSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     GroupParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider GroupInitParameters `json:"initProvider,omitempty"`
}

type GroupStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        GroupObservation `json:"atProvider,omitempty"`
}

type IPCidrsInitParameters struct {

	// Specifies the IPv4 CIDR block, for example, 192.168.0.0/24.
	Cidr *string `json:"cidr,omitempty" tf:"cidr,omitempty"`

	// Specifies a description about an IPv4 CIDR block. This parameter can contain a
	// maximum of 255 characters and the following characters are not allowed:@#%^&*<>\.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`
}

type IPCidrsObservation struct {

	// Specifies the IPv4 CIDR block, for example, 192.168.0.0/24.
	Cidr *string `json:"cidr,omitempty" tf:"cidr,omitempty"`

	// Specifies a description about an IPv4 CIDR block. This parameter can contain a
	// maximum of 255 characters and the following characters are not allowed:@#%^&*<>\.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`
}

type IPCidrsParameters struct {

	// Specifies the IPv4 CIDR block, for example, 192.168.0.0/24.
	// +kubebuilder:validation:Optional
	Cidr *string `json:"cidr" tf:"cidr,omitempty"`

	// Specifies a description about an IPv4 CIDR block. This parameter can contain a
	// maximum of 255 characters and the following characters are not allowed:@#%^&*<>\.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`
}

type IPRangesInitParameters struct {

	// Specifies a description about an IP address range. This parameter can contain a
	// maximum of 255 characters and the following characters are not allowed:@#%^&*<>\.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies the Ip address range, for example, 0.0.0.0-255.255.255.0.
	Range *string `json:"range,omitempty" tf:"range,omitempty"`
}

type IPRangesObservation struct {

	// Specifies a description about an IP address range. This parameter can contain a
	// maximum of 255 characters and the following characters are not allowed:@#%^&*<>\.
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies the Ip address range, for example, 0.0.0.0-255.255.255.0.
	Range *string `json:"range,omitempty" tf:"range,omitempty"`
}

type IPRangesParameters struct {

	// Specifies a description about an IP address range. This parameter can contain a
	// maximum of 255 characters and the following characters are not allowed:@#%^&*<>\.
	// +kubebuilder:validation:Optional
	Description *string `json:"description,omitempty" tf:"description,omitempty"`

	// Specifies the Ip address range, for example, 0.0.0.0-255.255.255.0.
	// +kubebuilder:validation:Optional
	Range *string `json:"range" tf:"range,omitempty"`
}

type LocalInitParameters struct {
}

type LocalObservation struct {

	// The user group to which the federated user belongs on the cloud platform.
	Group *string `json:"group,omitempty" tf:"group,omitempty"`

	// The name of a federated user on the cloud platform.
	Username *string `json:"username,omitempty" tf:"username,omitempty"`
}

type LocalParameters struct {
}

type LoginPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              LoginPolicySpec   `json:"spec"`
	Status            LoginPolicyStatus `json:"status,omitempty"`
}

type LoginPolicyInitParameters struct {

	// Specifies the validity period (days) to disable users
	// if they have not logged in within the period. The valid value is range from 0 to 240.
	AccountValidityPeriod *float64 `json:"accountValidityPeriod,omitempty" tf:"account_validity_period,omitempty"`

	// Specifies the custom information that will be displayed
	// upon successful login.
	CustomInfoForLogin *string `json:"customInfoForLogin,omitempty" tf:"custom_info_for_login,omitempty"`

	// Specifies the duration (minutes) to lock users out.
	// The valid value is range from 15 to 1440, defaults to 15.
	LockoutDuration *float64 `json:"lockoutDuration,omitempty" tf:"lockout_duration,omitempty"`

	// Specifies the number of unsuccessful login attempts to lock users out.
	// The valid value is range from 3 to 10, defaults to 5.
	LoginFailedTimes *float64 `json:"loginFailedTimes,omitempty" tf:"login_failed_times,omitempty"`

	// Specifies the period (minutes) to count the number of unsuccessful
	// login attempts. The valid value is range from 15 to 60, defaults to 15.
	PeriodWithLoginFailures *float64 `json:"periodWithLoginFailures,omitempty" tf:"period_with_login_failures,omitempty"`

	// Specifies the session timeout (minutes) that will apply if you or users created
	// using your account do not perform any operations within a specific period.
	// The valid value is range from 15 to 1,440, defaults to 60.
	SessionTimeout *float64 `json:"sessionTimeout,omitempty" tf:"session_timeout,omitempty"`

	// Specifies whether to display last login information upon successful login.
	// The value can be true or false.
	ShowRecentLoginInfo *bool `json:"showRecentLoginInfo,omitempty" tf:"show_recent_login_info,omitempty"`
}

type LoginPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []LoginPolicy `json:"items"`
}

type LoginPolicyObservation struct {

	// Specifies the validity period (days) to disable users
	// if they have not logged in within the period. The valid value is range from 0 to 240.
	AccountValidityPeriod *float64 `json:"accountValidityPeriod,omitempty" tf:"account_validity_period,omitempty"`

	// Specifies the custom information that will be displayed
	// upon successful login.
	CustomInfoForLogin *string `json:"customInfoForLogin,omitempty" tf:"custom_info_for_login,omitempty"`

	// The ID of account login policy, which is the same as the account ID.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// Specifies the duration (minutes) to lock users out.
	// The valid value is range from 15 to 1440, defaults to 15.
	LockoutDuration *float64 `json:"lockoutDuration,omitempty" tf:"lockout_duration,omitempty"`

	// Specifies the number of unsuccessful login attempts to lock users out.
	// The valid value is range from 3 to 10, defaults to 5.
	LoginFailedTimes *float64 `json:"loginFailedTimes,omitempty" tf:"login_failed_times,omitempty"`

	// Specifies the period (minutes) to count the number of unsuccessful
	// login attempts. The valid value is range from 15 to 60, defaults to 15.
	PeriodWithLoginFailures *float64 `json:"periodWithLoginFailures,omitempty" tf:"period_with_login_failures,omitempty"`

	// Specifies the session timeout (minutes) that will apply if you or users created
	// using your account do not perform any operations within a specific period.
	// The valid value is range from 15 to 1,440, defaults to 60.
	SessionTimeout *float64 `json:"sessionTimeout,omitempty" tf:"session_timeout,omitempty"`

	// Specifies whether to display last login information upon successful login.
	// The value can be true or false.
	ShowRecentLoginInfo *bool `json:"showRecentLoginInfo,omitempty" tf:"show_recent_login_info,omitempty"`
}

type LoginPolicyParameters struct {

	// Specifies the validity period (days) to disable users
	// if they have not logged in within the period. The valid value is range from 0 to 240.
	// +kubebuilder:validation:Optional
	AccountValidityPeriod *float64 `json:"accountValidityPeriod,omitempty" tf:"account_validity_period,omitempty"`

	// Specifies the custom information that will be displayed
	// upon successful login.
	// +kubebuilder:validation:Optional
	CustomInfoForLogin *string `json:"customInfoForLogin,omitempty" tf:"custom_info_for_login,omitempty"`

	// Specifies the duration (minutes) to lock users out.
	// The valid value is range from 15 to 1440, defaults to 15.
	// +kubebuilder:validation:Optional
	LockoutDuration *float64 `json:"lockoutDuration,omitempty" tf:"lockout_duration,omitempty"`

	// Specifies the number of unsuccessful login attempts to lock users out.
	// The valid value is range from 3 to 10, defaults to 5.
	// +kubebuilder:validation:Optional
	LoginFailedTimes *float64 `json:"loginFailedTimes,omitempty" tf:"login_failed_times,omitempty"`

	// Specifies the period (minutes) to count the number of unsuccessful
	// login attempts. The valid value is range from 15 to 60, defaults to 15.
	// +kubebuilder:validation:Optional
	PeriodWithLoginFailures *float64 `json:"periodWithLoginFailures,omitempty" tf:"period_with_login_failures,omitempty"`

	// Specifies the session timeout (minutes) that will apply if you or users created
	// using your account do not perform any operations within a specific period.
	// The valid value is range from 15 to 1,440, defaults to 60.
	// +kubebuilder:validation:Optional
	SessionTimeout *float64 `json:"sessionTimeout,omitempty" tf:"session_timeout,omitempty"`

	// Specifies whether to display last login information upon successful login.
	// The value can be true or false.
	// +kubebuilder:validation:Optional
	ShowRecentLoginInfo *bool `json:"showRecentLoginInfo,omitempty" tf:"show_recent_login_info,omitempty"`
}