valid {
    input.ReqMap.resource == STRING
    input.Qs.options.requestedPolicyVersion == INTEGER
    input.ProviderMetadata.Region == STRING
}

enum_AuditLogConfigLogType := [ "LOG_TYPE_UNSPECIFIED", "ADMIN_READ", "DATA_WRITE", "DATA_READ" ]
enum_AuthorizationLoggingOptionsPermissionType := [ "PERMISSION_TYPE_UNSPECIFIED", "ADMIN_READ", "ADMIN_WRITE", "DATA_READ", "DATA_WRITE" ]
enum_CloudAuditOptionsLogName := [ "UNSPECIFIED_LOG_NAME", "ADMIN_ACTIVITY", "DATA_ACCESS" ]
enum_ConditionIam := [ "NO_ATTR", "AUTHORITY", "ATTRIBUTION", "SECURITY_REALM", "APPROVER", "JUSTIFICATION_TYPE", "CREDENTIALS_TYPE", "CREDS_ASSERTION" ]
enum_ConditionOp := [ "NO_OP", "EQUALS", "NOT_EQUALS", "IN", "NOT_IN", "DISCHARGED" ]
enum_ConditionSys := [ "NO_ATTR", "REGION", "SERVICE", "NAME", "IP" ]
enum_DataAccessOptionsLogMode := [ "LOG_MODE_UNSPECIFIED", "LOG_FAIL_CLOSED" ]
enum_RuleAction := [ "NO_ACTION", "ALLOW", "ALLOW_WITH_LOG", "DENY", "DENY_WITH_LOG", "LOG" ]

valid {
    input.Body.policy.auditConfigs[_].auditLogConfigs[_].exemptedMembers[_] == STRING
    input.Body.policy.auditConfigs[_].auditLogConfigs[_].ignoreChildExemptions == BOOLEAN
    input.Body.policy.auditConfigs[_].auditLogConfigs[_].logType == enum_AuditLogConfigLogType[_]
    input.Body.policy.auditConfigs[_].service == STRING
    input.Body.policy.bindings[_].bindingId == STRING
    input.Body.policy.bindings[_].condition.description == STRING
    input.Body.policy.bindings[_].condition.expression == STRING
    input.Body.policy.bindings[_].condition.location == STRING
    input.Body.policy.bindings[_].condition.title == STRING
    input.Body.policy.bindings[_].members[_] == STRING
    input.Body.policy.bindings[_].role == STRING
    input.Body.policy.etag == STRING
    input.Body.policy.rules[_].action == enum_RuleAction[_]
    input.Body.policy.rules[_].conditions[_].iam == enum_ConditionIam[_]
    input.Body.policy.rules[_].conditions[_].op == enum_ConditionOp[_]
    input.Body.policy.rules[_].conditions[_].svc == STRING
    input.Body.policy.rules[_].conditions[_].sys == enum_ConditionSys[_]
    input.Body.policy.rules[_].conditions[_].values[_] == STRING
    input.Body.policy.rules[_].description == STRING
    input.Body.policy.rules[_].in[_] == STRING
    input.Body.policy.rules[_].logConfig[_].cloudAudit.authorizationLoggingOptions.permissionType == enum_AuthorizationLoggingOptionsPermissionType[_]
    input.Body.policy.rules[_].logConfig[_].cloudAudit.logName == enum_CloudAuditOptionsLogName[_]
    input.Body.policy.rules[_].logConfig[_].counter.customFields[_].name == STRING
    input.Body.policy.rules[_].logConfig[_].counter.customFields[_].value == STRING
    input.Body.policy.rules[_].logConfig[_].counter.field == STRING
    input.Body.policy.rules[_].logConfig[_].counter.metric == STRING
    input.Body.policy.rules[_].logConfig[_].dataAccess.logMode == enum_DataAccessOptionsLogMode[_]
    input.Body.policy.rules[_].notIn[_] == STRING
    input.Body.policy.rules[_].permissions[_] == STRING
    input.Body.policy.version == INTEGER
    input.Body.updateMask == STRING
    input.ReqMap.resource == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.Body.permissions[_] == STRING
    input.ReqMap.resource == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.ReqMap.name == STRING
    input.Qs.filter == STRING
    input.Qs.includeUnrevealedLocations == BOOLEAN
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.Body.STRING == STRING
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

valid {
    input.ReqMap.name == STRING
    input.Qs.filter == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}