Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Google Cloud Native
  3. API Docs
  4. accesscontextmanager
  5. accesscontextmanager/v1
  6. getServicePerimeter

Google Cloud Native is in preview. Google Cloud Classic is fully supported.

Google Cloud Native v0.32.0 published on Wednesday, Nov 29, 2023 by Pulumi
pulumi/pulumi-google-native

google-native.accesscontextmanager/v1.getServicePerimeter

Explore with Pulumi AI

google-native logo

Google Cloud Native is in preview. Google Cloud Classic is fully supported.

Google Cloud Native v0.32.0 published on Wednesday, Nov 29, 2023 by Pulumi
pulumi/pulumi-google-native

    Gets a service perimeter based on the resource name.

    Using getServicePerimeter

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getServicePerimeter(args: GetServicePerimeterArgs, opts?: InvokeOptions): Promise<GetServicePerimeterResult>
function getServicePerimeterOutput(args: GetServicePerimeterOutputArgs, opts?: InvokeOptions): Output<GetServicePerimeterResult>
    def get_service_perimeter(access_policy_id: Optional[str] = None,
                          service_perimeter_id: Optional[str] = None,
                          opts: Optional[InvokeOptions] = None) -> GetServicePerimeterResult
def get_service_perimeter_output(access_policy_id: Optional[pulumi.Input[str]] = None,
                          service_perimeter_id: Optional[pulumi.Input[str]] = None,
                          opts: Optional[InvokeOptions] = None) -> Output[GetServicePerimeterResult]
    func LookupServicePerimeter(ctx *Context, args *LookupServicePerimeterArgs, opts ...InvokeOption) (*LookupServicePerimeterResult, error)
func LookupServicePerimeterOutput(ctx *Context, args *LookupServicePerimeterOutputArgs, opts ...InvokeOption) LookupServicePerimeterResultOutput

    > Note: This function is named LookupServicePerimeter in the Go SDK.

    public static class GetServicePerimeter 
{
    public static Task<GetServicePerimeterResult> InvokeAsync(GetServicePerimeterArgs args, InvokeOptions? opts = null)
    public static Output<GetServicePerimeterResult> Invoke(GetServicePerimeterInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetServicePerimeterResult> getServicePerimeter(GetServicePerimeterArgs args, InvokeOptions options)
public static Output<GetServicePerimeterResult> getServicePerimeter(GetServicePerimeterArgs args, InvokeOptions options)

    fn::invoke:
  function: google-native:accesscontextmanager/v1:getServicePerimeter
  arguments:
    # arguments dictionary

    The following arguments are supported:

    getServicePerimeter Result

    The following output properties are available:

    Description string
    Description of the ServicePerimeter and its use. Does not affect behavior.
    Name string
    Resource name for the ServicePerimeter. Format: accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}. The service_perimeter component must begin with a letter, followed by alphanumeric characters or _. After you create a ServicePerimeter, you cannot change its name.
    PerimeterType string
    Perimeter type indicator. A single project or VPC network is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
    Spec Pulumi.GoogleNative.AccessContextManager.V1.Outputs.ServicePerimeterConfigResponse
    Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set.
    Status Pulumi.GoogleNative.AccessContextManager.V1.Outputs.ServicePerimeterConfigResponse
    Current ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.
    Title string
    Human readable title. Must be unique within the Policy.
    UseExplicitDryRunSpec bool
    Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. use_explicit_dry_run_spec must bet set to True if any of the fields in the spec are set to non-default values.
    Description string
    Description of the ServicePerimeter and its use. Does not affect behavior.
    Name string
    Resource name for the ServicePerimeter. Format: accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}. The service_perimeter component must begin with a letter, followed by alphanumeric characters or _. After you create a ServicePerimeter, you cannot change its name.
    PerimeterType string
    Perimeter type indicator. A single project or VPC network is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
    Spec ServicePerimeterConfigResponse
    Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set.
    Status ServicePerimeterConfigResponse
    Current ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.
    Title string
    Human readable title. Must be unique within the Policy.
    UseExplicitDryRunSpec bool
    Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. use_explicit_dry_run_spec must bet set to True if any of the fields in the spec are set to non-default values.
    description String
    Description of the ServicePerimeter and its use. Does not affect behavior.
    name String
    Resource name for the ServicePerimeter. Format: accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}. The service_perimeter component must begin with a letter, followed by alphanumeric characters or _. After you create a ServicePerimeter, you cannot change its name.
    perimeterType String
    Perimeter type indicator. A single project or VPC network is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
    spec ServicePerimeterConfigResponse
    Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set.
    status ServicePerimeterConfigResponse
    Current ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.
    title String
    Human readable title. Must be unique within the Policy.
    useExplicitDryRunSpec Boolean
    Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. use_explicit_dry_run_spec must bet set to True if any of the fields in the spec are set to non-default values.
    description string
    Description of the ServicePerimeter and its use. Does not affect behavior.
    name string
    Resource name for the ServicePerimeter. Format: accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}. The service_perimeter component must begin with a letter, followed by alphanumeric characters or _. After you create a ServicePerimeter, you cannot change its name.
    perimeterType string
    Perimeter type indicator. A single project or VPC network is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
    spec ServicePerimeterConfigResponse
    Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set.
    status ServicePerimeterConfigResponse
    Current ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.
    title string
    Human readable title. Must be unique within the Policy.
    useExplicitDryRunSpec boolean
    Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. use_explicit_dry_run_spec must bet set to True if any of the fields in the spec are set to non-default values.
    description str
    Description of the ServicePerimeter and its use. Does not affect behavior.
    name str
    Resource name for the ServicePerimeter. Format: accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}. The service_perimeter component must begin with a letter, followed by alphanumeric characters or _. After you create a ServicePerimeter, you cannot change its name.
    perimeter_type str
    Perimeter type indicator. A single project or VPC network is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
    spec ServicePerimeterConfigResponse
    Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set.
    status ServicePerimeterConfigResponse
    Current ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.
    title str
    Human readable title. Must be unique within the Policy.
    use_explicit_dry_run_spec bool
    Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. use_explicit_dry_run_spec must bet set to True if any of the fields in the spec are set to non-default values.
    description String
    Description of the ServicePerimeter and its use. Does not affect behavior.
    name String
    Resource name for the ServicePerimeter. Format: accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}. The service_perimeter component must begin with a letter, followed by alphanumeric characters or _. After you create a ServicePerimeter, you cannot change its name.
    perimeterType String
    Perimeter type indicator. A single project or VPC network is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty.
    spec Property Map
    Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the "use_explicit_dry_run_spec" flag is set.
    status Property Map
    Current ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.
    title String
    Human readable title. Must be unique within the Policy.
    useExplicitDryRunSpec Boolean
    Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. use_explicit_dry_run_spec must bet set to True if any of the fields in the spec are set to non-default values.

    Supporting Types

    ApiOperationResponse

    MethodSelectors List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.MethodSelectorResponse>
    API methods or permissions to allow. Method or permission must belong to the service specified by service_name field. A single MethodSelector entry with * specified for the method field will allow all methods AND permissions for the service specified in service_name.
    ServiceName string
    The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with service_name field set to * will allow all methods AND permissions for all services.
    MethodSelectors []MethodSelectorResponse
    API methods or permissions to allow. Method or permission must belong to the service specified by service_name field. A single MethodSelector entry with * specified for the method field will allow all methods AND permissions for the service specified in service_name.
    ServiceName string
    The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with service_name field set to * will allow all methods AND permissions for all services.
    methodSelectors List<MethodSelectorResponse>
    API methods or permissions to allow. Method or permission must belong to the service specified by service_name field. A single MethodSelector entry with * specified for the method field will allow all methods AND permissions for the service specified in service_name.
    serviceName String
    The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with service_name field set to * will allow all methods AND permissions for all services.
    methodSelectors MethodSelectorResponse[]
    API methods or permissions to allow. Method or permission must belong to the service specified by service_name field. A single MethodSelector entry with * specified for the method field will allow all methods AND permissions for the service specified in service_name.
    serviceName string
    The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with service_name field set to * will allow all methods AND permissions for all services.
    method_selectors Sequence[MethodSelectorResponse]
    API methods or permissions to allow. Method or permission must belong to the service specified by service_name field. A single MethodSelector entry with * specified for the method field will allow all methods AND permissions for the service specified in service_name.
    service_name str
    The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with service_name field set to * will allow all methods AND permissions for all services.
    methodSelectors List<Property Map>
    API methods or permissions to allow. Method or permission must belong to the service specified by service_name field. A single MethodSelector entry with * specified for the method field will allow all methods AND permissions for the service specified in service_name.
    serviceName String
    The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with service_name field set to * will allow all methods AND permissions for all services.

    EgressFromResponse

    Identities List<string>
    A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
    IdentityType string
    Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    SourceRestriction string
    Whether to enforce traffic restrictions based on sources field. If the sources fields is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
    Sources List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.EgressSourceResponse>
    Sources that this EgressPolicy authorizes access from. If this field is not empty, then source_restriction must be set to SOURCE_RESTRICTION_ENABLED.
    Identities []string
    A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
    IdentityType string
    Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    SourceRestriction string
    Whether to enforce traffic restrictions based on sources field. If the sources fields is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
    Sources []EgressSourceResponse
    Sources that this EgressPolicy authorizes access from. If this field is not empty, then source_restriction must be set to SOURCE_RESTRICTION_ENABLED.
    identities List<String>
    A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
    identityType String
    Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sourceRestriction String
    Whether to enforce traffic restrictions based on sources field. If the sources fields is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
    sources List<EgressSourceResponse>
    Sources that this EgressPolicy authorizes access from. If this field is not empty, then source_restriction must be set to SOURCE_RESTRICTION_ENABLED.
    identities string[]
    A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
    identityType string
    Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sourceRestriction string
    Whether to enforce traffic restrictions based on sources field. If the sources fields is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
    sources EgressSourceResponse[]
    Sources that this EgressPolicy authorizes access from. If this field is not empty, then source_restriction must be set to SOURCE_RESTRICTION_ENABLED.
    identities Sequence[str]
    A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
    identity_type str
    Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    source_restriction str
    Whether to enforce traffic restrictions based on sources field. If the sources fields is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
    sources Sequence[EgressSourceResponse]
    Sources that this EgressPolicy authorizes access from. If this field is not empty, then source_restriction must be set to SOURCE_RESTRICTION_ENABLED.
    identities List<String>
    A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only.
    identityType String
    Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sourceRestriction String
    Whether to enforce traffic restrictions based on sources field. If the sources fields is non-empty, then this field must be set to SOURCE_RESTRICTION_ENABLED.
    sources List<Property Map>
    Sources that this EgressPolicy authorizes access from. If this field is not empty, then source_restriction must be set to SOURCE_RESTRICTION_ENABLED.

    EgressPolicyResponse

    EgressFrom Pulumi.GoogleNative.AccessContextManager.V1.Inputs.EgressFromResponse
    Defines conditions on the source of a request causing this EgressPolicy to apply.
    EgressTo Pulumi.GoogleNative.AccessContextManager.V1.Inputs.EgressToResponse
    Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.
    EgressFrom EgressFromResponse
    Defines conditions on the source of a request causing this EgressPolicy to apply.
    EgressTo EgressToResponse
    Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.
    egressFrom EgressFromResponse
    Defines conditions on the source of a request causing this EgressPolicy to apply.
    egressTo EgressToResponse
    Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.
    egressFrom EgressFromResponse
    Defines conditions on the source of a request causing this EgressPolicy to apply.
    egressTo EgressToResponse
    Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.
    egress_from EgressFromResponse
    Defines conditions on the source of a request causing this EgressPolicy to apply.
    egress_to EgressToResponse
    Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.
    egressFrom Property Map
    Defines conditions on the source of a request causing this EgressPolicy to apply.
    egressTo Property Map
    Defines the conditions on the ApiOperation and destination resources that cause this EgressPolicy to apply.

    EgressSourceResponse

    AccessLevel string
    An AccessLevel resource name that allows protected resources inside the ServicePerimeters to access outside the ServicePerimeter boundaries. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If an AccessLevel name is not specified, only resources within the perimeter can be accessed through Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all EgressSources will be allowed.
    AccessLevel string
    An AccessLevel resource name that allows protected resources inside the ServicePerimeters to access outside the ServicePerimeter boundaries. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If an AccessLevel name is not specified, only resources within the perimeter can be accessed through Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all EgressSources will be allowed.
    accessLevel String
    An AccessLevel resource name that allows protected resources inside the ServicePerimeters to access outside the ServicePerimeter boundaries. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If an AccessLevel name is not specified, only resources within the perimeter can be accessed through Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all EgressSources will be allowed.
    accessLevel string
    An AccessLevel resource name that allows protected resources inside the ServicePerimeters to access outside the ServicePerimeter boundaries. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If an AccessLevel name is not specified, only resources within the perimeter can be accessed through Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all EgressSources will be allowed.
    access_level str
    An AccessLevel resource name that allows protected resources inside the ServicePerimeters to access outside the ServicePerimeter boundaries. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If an AccessLevel name is not specified, only resources within the perimeter can be accessed through Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all EgressSources will be allowed.
    accessLevel String
    An AccessLevel resource name that allows protected resources inside the ServicePerimeters to access outside the ServicePerimeter boundaries. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If an AccessLevel name is not specified, only resources within the perimeter can be accessed through Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all EgressSources will be allowed.

    EgressToResponse

    ExternalResources List<string>
    A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.
    Operations List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.ApiOperationResponse>
    A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom. A request matches if it uses an operation/service in this list.
    Resources List<string>
    A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.
    ExternalResources []string
    A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.
    Operations []ApiOperationResponse
    A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom. A request matches if it uses an operation/service in this list.
    Resources []string
    A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.
    externalResources List<String>
    A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.
    operations List<ApiOperationResponse>
    A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom. A request matches if it uses an operation/service in this list.
    resources List<String>
    A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.
    externalResources string[]
    A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.
    operations ApiOperationResponse[]
    A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom. A request matches if it uses an operation/service in this list.
    resources string[]
    A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.
    external_resources Sequence[str]
    A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.
    operations Sequence[ApiOperationResponse]
    A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom. A request matches if it uses an operation/service in this list.
    resources Sequence[str]
    A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.
    externalResources List<String>
    A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.
    operations List<Property Map>
    A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom. A request matches if it uses an operation/service in this list.
    resources List<String>
    A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.

    IngressFromResponse

    Identities List<string>
    A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
    IdentityType string
    Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    Sources List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.IngressSourceResponse>
    Sources that this IngressPolicy authorizes access from.
    Identities []string
    A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
    IdentityType string
    Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    Sources []IngressSourceResponse
    Sources that this IngressPolicy authorizes access from.
    identities List<String>
    A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
    identityType String
    Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sources List<IngressSourceResponse>
    Sources that this IngressPolicy authorizes access from.
    identities string[]
    A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
    identityType string
    Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sources IngressSourceResponse[]
    Sources that this IngressPolicy authorizes access from.
    identities Sequence[str]
    A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
    identity_type str
    Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sources Sequence[IngressSourceResponse]
    Sources that this IngressPolicy authorizes access from.
    identities List<String>
    A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only.
    identityType String
    Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access.
    sources List<Property Map>
    Sources that this IngressPolicy authorizes access from.

    IngressPolicyResponse

    IngressFrom Pulumi.GoogleNative.AccessContextManager.V1.Inputs.IngressFromResponse
    Defines the conditions on the source of a request causing this IngressPolicy to apply.
    IngressTo Pulumi.GoogleNative.AccessContextManager.V1.Inputs.IngressToResponse
    Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.
    IngressFrom IngressFromResponse
    Defines the conditions on the source of a request causing this IngressPolicy to apply.
    IngressTo IngressToResponse
    Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.
    ingressFrom IngressFromResponse
    Defines the conditions on the source of a request causing this IngressPolicy to apply.
    ingressTo IngressToResponse
    Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.
    ingressFrom IngressFromResponse
    Defines the conditions on the source of a request causing this IngressPolicy to apply.
    ingressTo IngressToResponse
    Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.
    ingress_from IngressFromResponse
    Defines the conditions on the source of a request causing this IngressPolicy to apply.
    ingress_to IngressToResponse
    Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.
    ingressFrom Property Map
    Defines the conditions on the source of a request causing this IngressPolicy to apply.
    ingressTo Property Map
    Defines the conditions on the ApiOperation and request destination that cause this IngressPolicy to apply.

    IngressSourceResponse

    AccessLevel string
    An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all IngressSources will be allowed.
    Resource string
    A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}. The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.
    AccessLevel string
    An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all IngressSources will be allowed.
    Resource string
    A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}. The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.
    accessLevel String
    An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all IngressSources will be allowed.
    resource String
    A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}. The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.
    accessLevel string
    An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all IngressSources will be allowed.
    resource string
    A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}. The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.
    access_level str
    An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all IngressSources will be allowed.
    resource str
    A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}. The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.
    accessLevel String
    An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for access_level, then all IngressSources will be allowed.
    resource String
    A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}. The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.

    IngressToResponse

    Operations List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.ApiOperationResponse>
    A list of ApiOperations allowed to be performed by the sources specified in corresponding IngressFrom in this ServicePerimeter.
    Resources List<string>
    A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed.
    Operations []ApiOperationResponse
    A list of ApiOperations allowed to be performed by the sources specified in corresponding IngressFrom in this ServicePerimeter.
    Resources []string
    A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed.
    operations List<ApiOperationResponse>
    A list of ApiOperations allowed to be performed by the sources specified in corresponding IngressFrom in this ServicePerimeter.
    resources List<String>
    A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed.
    operations ApiOperationResponse[]
    A list of ApiOperations allowed to be performed by the sources specified in corresponding IngressFrom in this ServicePerimeter.
    resources string[]
    A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed.
    operations Sequence[ApiOperationResponse]
    A list of ApiOperations allowed to be performed by the sources specified in corresponding IngressFrom in this ServicePerimeter.
    resources Sequence[str]
    A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed.
    operations List<Property Map>
    A list of ApiOperations allowed to be performed by the sources specified in corresponding IngressFrom in this ServicePerimeter.
    resources List<String>
    A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed.

    MethodSelectorResponse

    Method string
    Value for method should be a valid method name for the corresponding service_name in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed.
    Permission string
    Value for permission should be a valid Cloud IAM permission for the corresponding service_name in ApiOperation.
    Method string
    Value for method should be a valid method name for the corresponding service_name in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed.
    Permission string
    Value for permission should be a valid Cloud IAM permission for the corresponding service_name in ApiOperation.
    method String
    Value for method should be a valid method name for the corresponding service_name in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed.
    permission String
    Value for permission should be a valid Cloud IAM permission for the corresponding service_name in ApiOperation.
    method string
    Value for method should be a valid method name for the corresponding service_name in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed.
    permission string
    Value for permission should be a valid Cloud IAM permission for the corresponding service_name in ApiOperation.
    method str
    Value for method should be a valid method name for the corresponding service_name in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed.
    permission str
    Value for permission should be a valid Cloud IAM permission for the corresponding service_name in ApiOperation.
    method String
    Value for method should be a valid method name for the corresponding service_name in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed.
    permission String
    Value for permission should be a valid Cloud IAM permission for the corresponding service_name in ApiOperation.

    ServicePerimeterConfigResponse

    AccessLevels List<string>
    A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.
    EgressPolicies List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.EgressPolicyResponse>
    List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
    IngressPolicies List<Pulumi.GoogleNative.AccessContextManager.V1.Inputs.IngressPolicyResponse>
    List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
    Resources List<string>
    A list of Google Cloud resources that are inside of the service perimeter. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}.
    RestrictedServices List<string>
    Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
    VpcAccessibleServices Pulumi.GoogleNative.AccessContextManager.V1.Inputs.VpcAccessibleServicesResponse
    Configuration for APIs allowed within Perimeter.
    AccessLevels []string
    A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.
    EgressPolicies []EgressPolicyResponse
    List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
    IngressPolicies []IngressPolicyResponse
    List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
    Resources []string
    A list of Google Cloud resources that are inside of the service perimeter. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}.
    RestrictedServices []string
    Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
    VpcAccessibleServices VpcAccessibleServicesResponse
    Configuration for APIs allowed within Perimeter.
    accessLevels List<String>
    A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.
    egressPolicies List<EgressPolicyResponse>
    List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
    ingressPolicies List<IngressPolicyResponse>
    List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
    resources List<String>
    A list of Google Cloud resources that are inside of the service perimeter. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}.
    restrictedServices List<String>
    Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
    vpcAccessibleServices VpcAccessibleServicesResponse
    Configuration for APIs allowed within Perimeter.
    accessLevels string[]
    A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.
    egressPolicies EgressPolicyResponse[]
    List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
    ingressPolicies IngressPolicyResponse[]
    List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
    resources string[]
    A list of Google Cloud resources that are inside of the service perimeter. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}.
    restrictedServices string[]
    Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
    vpcAccessibleServices VpcAccessibleServicesResponse
    Configuration for APIs allowed within Perimeter.
    access_levels Sequence[str]
    A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.
    egress_policies Sequence[EgressPolicyResponse]
    List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
    ingress_policies Sequence[IngressPolicyResponse]
    List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
    resources Sequence[str]
    A list of Google Cloud resources that are inside of the service perimeter. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}.
    restricted_services Sequence[str]
    Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
    vpc_accessible_services VpcAccessibleServicesResponse
    Configuration for APIs allowed within Perimeter.
    accessLevels List<String>
    A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.
    egressPolicies List<Property Map>
    List of EgressPolicies to apply to the perimeter. A perimeter may have multiple EgressPolicies, each of which is evaluated separately. Access is granted if any EgressPolicy grants it. Must be empty for a perimeter bridge.
    ingressPolicies List<Property Map>
    List of IngressPolicies to apply to the perimeter. A perimeter may have multiple IngressPolicies, each of which is evaluated separately. Access is granted if any Ingress Policy grants it. Must be empty for a perimeter bridge.
    resources List<String>
    A list of Google Cloud resources that are inside of the service perimeter. Currently only projects and VPCs are allowed. Project format: projects/{project_number} VPC network format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NAME}.
    restrictedServices List<String>
    Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
    vpcAccessibleServices Property Map
    Configuration for APIs allowed within Perimeter.

    VpcAccessibleServicesResponse

    AllowedServices List<string>
    The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
    EnableRestriction bool
    Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
    AllowedServices []string
    The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
    EnableRestriction bool
    Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
    allowedServices List<String>
    The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
    enableRestriction Boolean
    Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
    allowedServices string[]
    The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
    enableRestriction boolean
    Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
    allowed_services Sequence[str]
    The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
    enable_restriction bool
    Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.
    allowedServices List<String>
    The list of APIs usable within the Service Perimeter. Must be empty unless 'enable_restriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter.
    enableRestriction Boolean
    Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowed_services'.

    Package Details

    Repository
    Google Cloud Native pulumi/pulumi-google-native
    License
    Apache-2.0
    google-native logo

    Google Cloud Native is in preview. Google Cloud Classic is fully supported.

    Google Cloud Native v0.32.0 published on Wednesday, Nov 29, 2023 by Pulumi
    pulumi/pulumi-google-native