Module accesscontextmanager

This provider is a derived work of the Terraform Provider distributed under MPL 2.0. If you encounter a bug or missing feature, first check the pulumi/pulumi-gcp repo; however, if that doesn’t turn up anything, please consult the source terraform-providers/terraform-provider-google repo.

Resources

Others

Resources

Resource AccessLevel

class AccessLevel extends CustomResource

An AccessLevel is a label that can be applied to requests to GCP services, along with a list of requirements necessary for the label to be applied.

To get more information about AccessLevel, see:

Example Usage - Access Context Manager Access Level Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessLevel = new gcp.accesscontextmanager.AccessLevel("access-level", {
    basic: {
        conditions: [{
            devicePolicy: {
                osConstraints: [{
                    osType: "DESKTOP_CHROME_OS",
                }],
                requireScreenLock: false,
            },
        }],
    },
    parent: pulumi.interpolate`accessPolicies/${google_access_context_manager_access_policy_test_access.name}`,
    title: "chromeosNoLock",
});
const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});

This content is derived from https://github.com/terraform-providers/terraform-provider-google/blob/master/website/docs/r/access_context_manager_access_level.html.markdown.

constructor

new AccessLevel(name: string, args: AccessLevelArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessLevel resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessLevelState, opts?: pulumi.CustomResourceOptions): AccessLevel

Get an existing AccessLevel resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccessLevel

Returns true if the given object is an instance of AccessLevel. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property basic

public basic: pulumi.Output<AccessLevelBasic | undefined>;

A set of predefined conditions for the access level and a combining function.

property description

public description: pulumi.Output<string | undefined>;

Description of the AccessLevel and its use. Does not affect behavior.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

property parent

public parent: pulumi.Output<string>;

The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}

property title

public title: pulumi.Output<string>;

Human readable title. Must be unique within the Policy.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource AccessPolicy

class AccessPolicy extends CustomResource

AccessPolicy is a container for AccessLevels (which define the necessary attributes to use GCP services) and ServicePerimeters (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization.

To get more information about AccessPolicy, see:

Example Usage - Access Context Manager Access Policy Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});

This content is derived from https://github.com/terraform-providers/terraform-provider-google/blob/master/website/docs/r/access_context_manager_access_policy.html.markdown.

constructor

new AccessPolicy(name: string, args: AccessPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessPolicy resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessPolicyState, opts?: pulumi.CustomResourceOptions): AccessPolicy

Get an existing AccessPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccessPolicy

Returns true if the given object is an instance of AccessPolicy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property createTime

public createTime: pulumi.Output<string>;

Time the AccessPolicy was created in UTC.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

Resource name of the AccessPolicy. Format: {policy_id}

property parent

public parent: pulumi.Output<string>;

The parent of this AccessPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id}

property title

public title: pulumi.Output<string>;

Human readable title. Does not affect behavior.

property updateTime

public updateTime: pulumi.Output<string>;

Time the AccessPolicy was updated in UTC.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource ServicePerimeter

class ServicePerimeter extends CustomResource

ServicePerimeter describes a set of GCP resources which can freely import and export data amongst themselves, but not export outside of the ServicePerimeter. If a request with a source within this ServicePerimeter has a target outside of the ServicePerimeter, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only GCP projects as members, a single GCP project may belong to multiple Service Perimeter Bridges.

To get more information about ServicePerimeter, see:

Example Usage - Access Context Manager Service Perimeter Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});
const servicePerimeter = new gcp.accesscontextmanager.ServicePerimeter("service-perimeter", {
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    status: {
        restrictedServices: ["storage.googleapis.com"],
    },
    title: "restrictAll",
});
const accessLevel = new gcp.accesscontextmanager.AccessLevel("access-level", {
    basic: {
        conditions: [{
            devicePolicy: {
                osConstraints: [{
                    osType: "DESKTOP_CHROME_OS",
                }],
                requireScreenLock: false,
            },
        }],
    },
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    title: "chromeosNoLock",
});

This content is derived from https://github.com/terraform-providers/terraform-provider-google/blob/master/website/docs/r/access_context_manager_service_perimeter.html.markdown.

constructor

new ServicePerimeter(name: string, args: ServicePerimeterArgs, opts?: pulumi.CustomResourceOptions)

Create a ServicePerimeter resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ServicePerimeterState, opts?: pulumi.CustomResourceOptions): ServicePerimeter

Get an existing ServicePerimeter resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is ServicePerimeter

Returns true if the given object is an instance of ServicePerimeter. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property createTime

public createTime: pulumi.Output<string>;

Time the AccessPolicy was created in UTC.

property description

public description: pulumi.Output<string | undefined>;

Description of the ServicePerimeter and its use. Does not affect behavior.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

Resource name for the ServicePerimeter. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

property parent

public parent: pulumi.Output<string>;

The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}

property perimeterType

public perimeterType: pulumi.Output<string | undefined>;

Specifies the type of the Perimeter. There are two types: regular and bridge. Regular Service Perimeter contains resources, access levels, and restricted services. Every resource can be in at most ONE regular Service Perimeter. In addition to being in a regular service perimeter, a resource can also be in zero or more perimeter bridges. A perimeter bridge only contains resources. Cross project operations are permitted if all effected resources share some perimeter (whether bridge or regular). Perimeter Bridge does not contain access levels or services: those are governed entirely by the regular perimeter that resource is in. Perimeter Bridges are typically useful when building more complex topologies with many independent perimeters that need to share some data with a common perimeter, but should not be able to share data among themselves.

property status

public status: pulumi.Output<ServicePerimeterStatus | undefined>;

ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.

property title

public title: pulumi.Output<string>;

Human readable title. Must be unique within the Policy.

property updateTime

public updateTime: pulumi.Output<string>;

Time the AccessPolicy was updated in UTC.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource ServicePerimeterResource

class ServicePerimeterResource extends CustomResource

Allows configuring a single GCP resource that should be inside of a service perimeter. This resource is intended to be used in cases where it is not possible to compile a full list of projects to include in a gcp.accesscontextmanager.ServicePerimeter resource, to enable them to be added separately.

Note: If this resource is used alongside a gcp.accesscontextmanager.ServicePerimeter resource, the service perimeter resource must have a lifecycle block with ignoreChanges = [status[0].resources] so they don’t fight over which resources should be in the policy.

To get more information about ServicePerimeterResource, see:

This content is derived from https://github.com/terraform-providers/terraform-provider-google/blob/master/website/docs/r/access_context_manager_service_perimeter_resource.html.markdown.

constructor

new ServicePerimeterResource(name: string, args: ServicePerimeterResourceArgs, opts?: pulumi.CustomResourceOptions)

Create a ServicePerimeterResource resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ServicePerimeterResourceState, opts?: pulumi.CustomResourceOptions): ServicePerimeterResource

Get an existing ServicePerimeterResource resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is ServicePerimeterResource

Returns true if the given object is an instance of ServicePerimeterResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property perimeterName

public perimeterName: pulumi.Output<string>;

The name of the Service Perimeter to add this resource to.

property resource

public resource: pulumi.Output<string>;

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Others

interface AccessLevelArgs

interface AccessLevelArgs

The set of arguments for constructing a AccessLevel resource.

property basic

basic?: pulumi.Input<AccessLevelBasic>;

A set of predefined conditions for the access level and a combining function.

property description

description?: pulumi.Input<string>;

Description of the AccessLevel and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

property parent

parent: pulumi.Input<string>;

The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}

property title

title: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

interface AccessLevelState

interface AccessLevelState

Input properties used for looking up and filtering AccessLevel resources.

property basic

basic?: pulumi.Input<AccessLevelBasic>;

A set of predefined conditions for the access level and a combining function.

property description

description?: pulumi.Input<string>;

Description of the AccessLevel and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

property parent

parent?: pulumi.Input<string>;

The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}

property title

title?: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

interface AccessPolicyArgs

interface AccessPolicyArgs

The set of arguments for constructing a AccessPolicy resource.

property parent

parent: pulumi.Input<string>;

The parent of this AccessPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id}

property title

title: pulumi.Input<string>;

Human readable title. Does not affect behavior.

interface AccessPolicyState

interface AccessPolicyState

Input properties used for looking up and filtering AccessPolicy resources.

property createTime

createTime?: pulumi.Input<string>;

Time the AccessPolicy was created in UTC.

property name

name?: pulumi.Input<string>;

Resource name of the AccessPolicy. Format: {policy_id}

property parent

parent?: pulumi.Input<string>;

The parent of this AccessPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id}

property title

title?: pulumi.Input<string>;

Human readable title. Does not affect behavior.

property updateTime

updateTime?: pulumi.Input<string>;

Time the AccessPolicy was updated in UTC.

interface ServicePerimeterArgs

interface ServicePerimeterArgs

The set of arguments for constructing a ServicePerimeter resource.

property description

description?: pulumi.Input<string>;

Description of the ServicePerimeter and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the ServicePerimeter. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

property parent

parent: pulumi.Input<string>;

The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}

property perimeterType

perimeterType?: pulumi.Input<string>;

Specifies the type of the Perimeter. There are two types: regular and bridge. Regular Service Perimeter contains resources, access levels, and restricted services. Every resource can be in at most ONE regular Service Perimeter. In addition to being in a regular service perimeter, a resource can also be in zero or more perimeter bridges. A perimeter bridge only contains resources. Cross project operations are permitted if all effected resources share some perimeter (whether bridge or regular). Perimeter Bridge does not contain access levels or services: those are governed entirely by the regular perimeter that resource is in. Perimeter Bridges are typically useful when building more complex topologies with many independent perimeters that need to share some data with a common perimeter, but should not be able to share data among themselves.

property status

status?: pulumi.Input<ServicePerimeterStatus>;

ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.

property title

title: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

interface ServicePerimeterResourceArgs

interface ServicePerimeterResourceArgs

The set of arguments for constructing a ServicePerimeterResource resource.

property perimeterName

perimeterName: pulumi.Input<string>;

The name of the Service Perimeter to add this resource to.

property resource

resource: pulumi.Input<string>;

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}

interface ServicePerimeterResourceState

interface ServicePerimeterResourceState

Input properties used for looking up and filtering ServicePerimeterResource resources.

property perimeterName

perimeterName?: pulumi.Input<string>;

The name of the Service Perimeter to add this resource to.

property resource

resource?: pulumi.Input<string>;

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}

interface ServicePerimeterState

interface ServicePerimeterState

Input properties used for looking up and filtering ServicePerimeter resources.

property createTime

createTime?: pulumi.Input<string>;

Time the AccessPolicy was created in UTC.

property description

description?: pulumi.Input<string>;

Description of the ServicePerimeter and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the ServicePerimeter. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

property parent

parent?: pulumi.Input<string>;

The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}

property perimeterType

perimeterType?: pulumi.Input<string>;

Specifies the type of the Perimeter. There are two types: regular and bridge. Regular Service Perimeter contains resources, access levels, and restricted services. Every resource can be in at most ONE regular Service Perimeter. In addition to being in a regular service perimeter, a resource can also be in zero or more perimeter bridges. A perimeter bridge only contains resources. Cross project operations are permitted if all effected resources share some perimeter (whether bridge or regular). Perimeter Bridge does not contain access levels or services: those are governed entirely by the regular perimeter that resource is in. Perimeter Bridges are typically useful when building more complex topologies with many independent perimeters that need to share some data with a common perimeter, but should not be able to share data among themselves.

property status

status?: pulumi.Input<ServicePerimeterStatus>;

ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries.

property title

title?: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

property updateTime

updateTime?: pulumi.Input<string>;

Time the AccessPolicy was updated in UTC.