Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Google Cloud (GCP) Classic
  4. API Docs
  5. compute
  6. RegionNetworkPolicyTrafficClassificationRule
Viewing docs for Google Cloud v9.35.1
published on Monday, Aug 24, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

gcp.compute.RegionNetworkPolicyTrafficClassificationRule

gcp logo
Viewing docs for Google Cloud v9.35.1
published on Monday, Aug 24, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

    Represents a traffic classification rule that describes one or more match conditions along with the action to be taken when traffic matches this condition.

    Warning: This resource is in beta, and should be used with the terraform-provider-google-beta provider. See Provider Versions for more details on beta resources.

    To get more information about RegionNetworkPolicyTrafficClassificationRule, see:

    Example Usage

    Region Network Policy Traffic Classification Rule Basic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const basicRegionalNetworkPolicy = new gcp.compute.RegionNetworkPolicy("basic_regional_network_policy", {
    name: "nw-policy",
    description: "Sample regional network firewall policy",
    project: "my-project-name",
    region: "us-west1",
});
const primary = new gcp.compute.RegionNetworkPolicyTrafficClassificationRule("primary", {
    ruleName: "test-rule",
    description: "This is a simple rule description",
    disabled: false,
    networkPolicy: basicRegionalNetworkPolicy.name,
    priority: 1000,
    region: "us-west1",
    action: {
        trafficClass: "TC1",
        dscpMode: "AUTO",
    },
    match: {
        srcIpRanges: ["10.100.0.1/32"],
        destIpRanges: ["11.100.0.1/32"],
        layer4Configs: [{
            ipProtocol: "all",
        }],
    },
});

    import pulumi
import pulumi_gcp as gcp

basic_regional_network_policy = gcp.compute.RegionNetworkPolicy("basic_regional_network_policy",
    name="nw-policy",
    description="Sample regional network firewall policy",
    project="my-project-name",
    region="us-west1")
primary = gcp.compute.RegionNetworkPolicyTrafficClassificationRule("primary",
    rule_name="test-rule",
    description="This is a simple rule description",
    disabled=False,
    network_policy=basic_regional_network_policy.name,
    priority=1000,
    region="us-west1",
    action={
        "traffic_class": "TC1",
        "dscp_mode": "AUTO",
    },
    match={
        "src_ip_ranges": ["10.100.0.1/32"],
        "dest_ip_ranges": ["11.100.0.1/32"],
        "layer4_configs": [{
            "ip_protocol": "all",
        }],
    })

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		basicRegionalNetworkPolicy, err := compute.NewRegionNetworkPolicy(ctx, "basic_regional_network_policy", &compute.RegionNetworkPolicyArgs{
			Name:        pulumi.String("nw-policy"),
			Description: pulumi.String("Sample regional network firewall policy"),
			Project:     pulumi.String("my-project-name"),
			Region:      pulumi.String("us-west1"),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewRegionNetworkPolicyTrafficClassificationRule(ctx, "primary", &compute.RegionNetworkPolicyTrafficClassificationRuleArgs{
			RuleName:      pulumi.String("test-rule"),
			Description:   pulumi.String("This is a simple rule description"),
			Disabled:      pulumi.Bool(false),
			NetworkPolicy: basicRegionalNetworkPolicy.Name,
			Priority:      pulumi.Int(1000),
			Region:        pulumi.String("us-west1"),
			Action: &compute.RegionNetworkPolicyTrafficClassificationRuleActionArgs{
				TrafficClass: pulumi.String("TC1"),
				DscpMode:     pulumi.String("AUTO"),
			},
			Match: &compute.RegionNetworkPolicyTrafficClassificationRuleMatchArgs{
				SrcIpRanges: pulumi.StringArray{
					pulumi.String("10.100.0.1/32"),
				},
				DestIpRanges: pulumi.StringArray{
					pulumi.String("11.100.0.1/32"),
				},
				Layer4Configs: compute.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArray{
					&compute.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("all"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var basicRegionalNetworkPolicy = new Gcp.Compute.RegionNetworkPolicy("basic_regional_network_policy", new()
    {
        Name = "nw-policy",
        Description = "Sample regional network firewall policy",
        Project = "my-project-name",
        Region = "us-west1",
    });

    var primary = new Gcp.Compute.RegionNetworkPolicyTrafficClassificationRule("primary", new()
    {
        RuleName = "test-rule",
        Description = "This is a simple rule description",
        Disabled = false,
        NetworkPolicy = basicRegionalNetworkPolicy.Name,
        Priority = 1000,
        Region = "us-west1",
        Action = new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleActionArgs
        {
            TrafficClass = "TC1",
            DscpMode = "AUTO",
        },
        Match = new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleMatchArgs
        {
            SrcIpRanges = new[]
            {
                "10.100.0.1/32",
            },
            DestIpRanges = new[]
            {
                "11.100.0.1/32",
            },
            Layer4Configs = new[]
            {
                new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs
                {
                    IpProtocol = "all",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionNetworkPolicy;
import com.pulumi.gcp.compute.RegionNetworkPolicyArgs;
import com.pulumi.gcp.compute.RegionNetworkPolicyTrafficClassificationRule;
import com.pulumi.gcp.compute.RegionNetworkPolicyTrafficClassificationRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionNetworkPolicyTrafficClassificationRuleActionArgs;
import com.pulumi.gcp.compute.inputs.RegionNetworkPolicyTrafficClassificationRuleMatchArgs;
import com.pulumi.gcp.compute.inputs.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var basicRegionalNetworkPolicy = new RegionNetworkPolicy("basicRegionalNetworkPolicy", RegionNetworkPolicyArgs.builder()
            .name("nw-policy")
            .description("Sample regional network firewall policy")
            .project("my-project-name")
            .region("us-west1")
            .build());

        var primary = new RegionNetworkPolicyTrafficClassificationRule("primary", RegionNetworkPolicyTrafficClassificationRuleArgs.builder()
            .ruleName("test-rule")
            .description("This is a simple rule description")
            .disabled(false)
            .networkPolicy(basicRegionalNetworkPolicy.name())
            .priority(1000)
            .region("us-west1")
            .action(RegionNetworkPolicyTrafficClassificationRuleActionArgs.builder()
                .trafficClass("TC1")
                .dscpMode("AUTO")
                .build())
            .match(RegionNetworkPolicyTrafficClassificationRuleMatchArgs.builder()
                .srcIpRanges("10.100.0.1/32")
                .destIpRanges("11.100.0.1/32")
                .layer4Configs(RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs.builder()
                    .ipProtocol("all")
                    .build())
                .build())
            .build());

    }
}

    resources:
  basicRegionalNetworkPolicy:
    type: gcp:compute:RegionNetworkPolicy
    name: basic_regional_network_policy
    properties:
      name: nw-policy
      description: Sample regional network firewall policy
      project: my-project-name
      region: us-west1
  primary:
    type: gcp:compute:RegionNetworkPolicyTrafficClassificationRule
    properties:
      ruleName: test-rule
      description: This is a simple rule description
      disabled: false
      networkPolicy: ${basicRegionalNetworkPolicy.name}
      priority: 1000
      region: us-west1
      action:
        trafficClass: TC1
        dscpMode: AUTO
      match:
        srcIpRanges:
          - 10.100.0.1/32
        destIpRanges:
          - 11.100.0.1/32
        layer4Configs:
          - ipProtocol: all

    pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_compute_regionnetworkpolicy" "basic_regional_network_policy" {
  name        = "nw-policy"
  description = "Sample regional network firewall policy"
  project     = "my-project-name"
  region      = "us-west1"
}
resource "gcp_compute_regionnetworkpolicytrafficclassificationrule" "primary" {
  rule_name      = "test-rule"
  description    = "This is a simple rule description"
  disabled       = false
  network_policy = gcp_compute_regionnetworkpolicy.basic_regional_network_policy.name
  priority       = 1000
  region         = "us-west1"
  action = {
    traffic_class = "TC1"
    dscp_mode     = "AUTO"
  }
  match = {
    src_ip_ranges  = ["10.100.0.1/32"]
    dest_ip_ranges = ["11.100.0.1/32"]
    layer4_configs = [{
      "ipProtocol" = "all"
    }]
  }
}

    Create RegionNetworkPolicyTrafficClassificationRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RegionNetworkPolicyTrafficClassificationRule(name: string, args: RegionNetworkPolicyTrafficClassificationRuleArgs, opts?: CustomResourceOptions);
    @overload
def RegionNetworkPolicyTrafficClassificationRule(resource_name: str,
                                                 args: RegionNetworkPolicyTrafficClassificationRuleArgs,
                                                 opts: Optional[ResourceOptions] = None)

@overload
def RegionNetworkPolicyTrafficClassificationRule(resource_name: str,
                                                 opts: Optional[ResourceOptions] = None,
                                                 match: Optional[RegionNetworkPolicyTrafficClassificationRuleMatchArgs] = None,
                                                 network_policy: Optional[str] = None,
                                                 priority: Optional[int] = None,
                                                 action: Optional[RegionNetworkPolicyTrafficClassificationRuleActionArgs] = None,
                                                 deletion_policy: Optional[str] = None,
                                                 description: Optional[str] = None,
                                                 disabled: Optional[bool] = None,
                                                 project: Optional[str] = None,
                                                 region: Optional[str] = None,
                                                 rule_name: Optional[str] = None,
                                                 target_secure_tags: Optional[Sequence[RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs]] = None,
                                                 target_service_accounts: Optional[Sequence[str]] = None)
    func NewRegionNetworkPolicyTrafficClassificationRule(ctx *Context, name string, args RegionNetworkPolicyTrafficClassificationRuleArgs, opts ...ResourceOption) (*RegionNetworkPolicyTrafficClassificationRule, error)
    public RegionNetworkPolicyTrafficClassificationRule(string name, RegionNetworkPolicyTrafficClassificationRuleArgs args, CustomResourceOptions? opts = null)
    public RegionNetworkPolicyTrafficClassificationRule(String name, RegionNetworkPolicyTrafficClassificationRuleArgs args)
public RegionNetworkPolicyTrafficClassificationRule(String name, RegionNetworkPolicyTrafficClassificationRuleArgs args, CustomResourceOptions options)

    type: gcp:compute:RegionNetworkPolicyTrafficClassificationRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "gcp_compute_region_network_policy_traffic_classification_rule" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args RegionNetworkPolicyTrafficClassificationRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RegionNetworkPolicyTrafficClassificationRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RegionNetworkPolicyTrafficClassificationRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RegionNetworkPolicyTrafficClassificationRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RegionNetworkPolicyTrafficClassificationRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var regionNetworkPolicyTrafficClassificationRuleResource = new Gcp.Compute.RegionNetworkPolicyTrafficClassificationRule("regionNetworkPolicyTrafficClassificationRuleResource", new()
{
    Match = new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleMatchArgs
    {
        Layer4Configs = new[]
        {
            new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs
            {
                IpProtocol = "string",
                Ports = new[]
                {
                    "string",
                },
            },
        },
        DestIpRanges = new[]
        {
            "string",
        },
        SrcIpRanges = new[]
        {
            "string",
        },
    },
    NetworkPolicy = "string",
    Priority = 0,
    Action = new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleActionArgs
    {
        DscpMode = "string",
        DscpValue = 0,
        TrafficClass = "string",
        Type = "string",
    },
    DeletionPolicy = "string",
    Description = "string",
    Disabled = false,
    Project = "string",
    Region = "string",
    RuleName = "string",
    TargetSecureTags = new[]
    {
        new Gcp.Compute.Inputs.RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs
        {
            Name = "string",
            State = "string",
        },
    },
    TargetServiceAccounts = new[]
    {
        "string",
    },
});

    example, err := compute.NewRegionNetworkPolicyTrafficClassificationRule(ctx, "regionNetworkPolicyTrafficClassificationRuleResource", &compute.RegionNetworkPolicyTrafficClassificationRuleArgs{
	Match: &compute.RegionNetworkPolicyTrafficClassificationRuleMatchArgs{
		Layer4Configs: compute.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArray{
			&compute.RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs{
				IpProtocol: pulumi.String("string"),
				Ports: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
		},
		DestIpRanges: pulumi.StringArray{
			pulumi.String("string"),
		},
		SrcIpRanges: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	NetworkPolicy: pulumi.String("string"),
	Priority:      pulumi.Int(0),
	Action: &compute.RegionNetworkPolicyTrafficClassificationRuleActionArgs{
		DscpMode:     pulumi.String("string"),
		DscpValue:    pulumi.Int(0),
		TrafficClass: pulumi.String("string"),
		Type:         pulumi.String("string"),
	},
	DeletionPolicy: pulumi.String("string"),
	Description:    pulumi.String("string"),
	Disabled:       pulumi.Bool(false),
	Project:        pulumi.String("string"),
	Region:         pulumi.String("string"),
	RuleName:       pulumi.String("string"),
	TargetSecureTags: compute.RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArray{
		&compute.RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs{
			Name:  pulumi.String("string"),
			State: pulumi.String("string"),
		},
	},
	TargetServiceAccounts: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "gcp_compute_region_network_policy_traffic_classification_rule" "regionNetworkPolicyTrafficClassificationRuleResource" {
  lifecycle {
    create_before_destroy = true
  }
  match = {
    layer4_configs = [{
      ip_protocol = "string"
      ports       = ["string"]
    }]
    dest_ip_ranges = ["string"]
    src_ip_ranges  = ["string"]
  }
  network_policy = "string"
  priority       = 0
  action = {
    dscp_mode     = "string"
    dscp_value    = 0
    traffic_class = "string"
    type          = "string"
  }
  deletion_policy = "string"
  description     = "string"
  disabled        = false
  project         = "string"
  region          = "string"
  rule_name       = "string"
  target_secure_tags {
    name  = "string"
    state = "string"
  }
  target_service_accounts = ["string"]
}

    var regionNetworkPolicyTrafficClassificationRuleResource = new RegionNetworkPolicyTrafficClassificationRule("regionNetworkPolicyTrafficClassificationRuleResource", RegionNetworkPolicyTrafficClassificationRuleArgs.builder()
    .match(RegionNetworkPolicyTrafficClassificationRuleMatchArgs.builder()
        .layer4Configs(RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs.builder()
            .ipProtocol("string")
            .ports("string")
            .build())
        .destIpRanges("string")
        .srcIpRanges("string")
        .build())
    .networkPolicy("string")
    .priority(0)
    .action(RegionNetworkPolicyTrafficClassificationRuleActionArgs.builder()
        .dscpMode("string")
        .dscpValue(0)
        .trafficClass("string")
        .type("string")
        .build())
    .deletionPolicy("string")
    .description("string")
    .disabled(false)
    .project("string")
    .region("string")
    .ruleName("string")
    .targetSecureTags(RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs.builder()
        .name("string")
        .state("string")
        .build())
    .targetServiceAccounts("string")
    .build());

    region_network_policy_traffic_classification_rule_resource = gcp.compute.RegionNetworkPolicyTrafficClassificationRule("regionNetworkPolicyTrafficClassificationRuleResource",
    match={
        "layer4_configs": [{
            "ip_protocol": "string",
            "ports": ["string"],
        }],
        "dest_ip_ranges": ["string"],
        "src_ip_ranges": ["string"],
    },
    network_policy="string",
    priority=0,
    action={
        "dscp_mode": "string",
        "dscp_value": 0,
        "traffic_class": "string",
        "type": "string",
    },
    deletion_policy="string",
    description="string",
    disabled=False,
    project="string",
    region="string",
    rule_name="string",
    target_secure_tags=[{
        "name": "string",
        "state": "string",
    }],
    target_service_accounts=["string"])

    const regionNetworkPolicyTrafficClassificationRuleResource = new gcp.compute.RegionNetworkPolicyTrafficClassificationRule("regionNetworkPolicyTrafficClassificationRuleResource", {
    match: {
        layer4Configs: [{
            ipProtocol: "string",
            ports: ["string"],
        }],
        destIpRanges: ["string"],
        srcIpRanges: ["string"],
    },
    networkPolicy: "string",
    priority: 0,
    action: {
        dscpMode: "string",
        dscpValue: 0,
        trafficClass: "string",
        type: "string",
    },
    deletionPolicy: "string",
    description: "string",
    disabled: false,
    project: "string",
    region: "string",
    ruleName: "string",
    targetSecureTags: [{
        name: "string",
        state: "string",
    }],
    targetServiceAccounts: ["string"],
});

    type: gcp:compute:RegionNetworkPolicyTrafficClassificationRule
properties:
    action:
        dscpMode: string
        dscpValue: 0
        trafficClass: string
        type: string
    deletionPolicy: string
    description: string
    disabled: false
    match:
        destIpRanges:
            - string
        layer4Configs:
            - ipProtocol: string
              ports:
                - string
        srcIpRanges:
            - string
    networkPolicy: string
    priority: 0
    project: string
    region: string
    ruleName: string
    targetSecureTags:
        - name: string
          state: string
    targetServiceAccounts:
        - string

    RegionNetworkPolicyTrafficClassificationRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The RegionNetworkPolicyTrafficClassificationRule resource accepts the following input properties:

    Match RegionNetworkPolicyTrafficClassificationRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    NetworkPolicy string
    The firewall policy of the resource.
    Priority int
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    Action RegionNetworkPolicyTrafficClassificationRuleAction
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    Description string
    An optional description for this resource.
    Disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    Region string
    The location of this resource.
    RuleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    TargetSecureTags List<RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag>
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts List<string>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    Match RegionNetworkPolicyTrafficClassificationRuleMatchArgs
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    NetworkPolicy string
    The firewall policy of the resource.
    Priority int
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    Action RegionNetworkPolicyTrafficClassificationRuleActionArgs
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    Description string
    An optional description for this resource.
    Disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    Region string
    The location of this resource.
    RuleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    TargetSecureTags []RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts []string
    A list of service accounts indicating the sets of instances that are applied with this rule.
    match object
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    network_policy string
    The firewall policy of the resource.
    priority number
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    action object
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    deletion_policy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description string
    An optional description for this resource.
    disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region string
    The location of this resource.
    rule_name string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    target_secure_tags list(object)
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    target_service_accounts list(string)
    A list of service accounts indicating the sets of instances that are applied with this rule.
    match RegionNetworkPolicyTrafficClassificationRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    networkPolicy String
    The firewall policy of the resource.
    priority Integer
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    action RegionNetworkPolicyTrafficClassificationRuleAction
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description String
    An optional description for this resource.
    disabled Boolean
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region String
    The location of this resource.
    ruleName String
    An optional name for the rule. This field is not a unique identifier and can be updated.
    targetSecureTags List<RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag>
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    match RegionNetworkPolicyTrafficClassificationRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    networkPolicy string
    The firewall policy of the resource.
    priority number
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    action RegionNetworkPolicyTrafficClassificationRuleAction
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    deletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description string
    An optional description for this resource.
    disabled boolean
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region string
    The location of this resource.
    ruleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    targetSecureTags RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag[]
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts string[]
    A list of service accounts indicating the sets of instances that are applied with this rule.
    match RegionNetworkPolicyTrafficClassificationRuleMatchArgs
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    network_policy str
    The firewall policy of the resource.
    priority int
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    action RegionNetworkPolicyTrafficClassificationRuleActionArgs
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    deletion_policy str
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description str
    An optional description for this resource.
    disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region str
    The location of this resource.
    rule_name str
    An optional name for the rule. This field is not a unique identifier and can be updated.
    target_secure_tags Sequence[RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs]
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    target_service_accounts Sequence[str]
    A list of service accounts indicating the sets of instances that are applied with this rule.
    match Property Map
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    networkPolicy String
    The firewall policy of the resource.
    priority Number
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    action Property Map
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description String
    An optional description for this resource.
    disabled Boolean
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region String
    The location of this resource.
    ruleName String
    An optional name for the rule. This field is not a unique identifier and can be updated.
    targetSecureTags List<Property Map>
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    A list of service accounts indicating the sets of instances that are applied with this rule.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RegionNetworkPolicyTrafficClassificationRule resource produces the following output properties:

    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    Id string
    The provider-assigned unique ID for this managed resource.
    Kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    RuleTupleCount int
    Calculation of the complexity of a single network policy rule.
    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    Id string
    The provider-assigned unique ID for this managed resource.
    Kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    RuleTupleCount int
    Calculation of the complexity of a single network policy rule.
    creation_timestamp string
    Creation timestamp in RFC3339 text format.
    id string
    The provider-assigned unique ID for this managed resource.
    kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    rule_tuple_count number
    Calculation of the complexity of a single network policy rule.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    id String
    The provider-assigned unique ID for this managed resource.
    kind String
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    ruleTupleCount Integer
    Calculation of the complexity of a single network policy rule.
    creationTimestamp string
    Creation timestamp in RFC3339 text format.
    id string
    The provider-assigned unique ID for this managed resource.
    kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    ruleTupleCount number
    Calculation of the complexity of a single network policy rule.
    creation_timestamp str
    Creation timestamp in RFC3339 text format.
    id str
    The provider-assigned unique ID for this managed resource.
    kind str
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    rule_tuple_count int
    Calculation of the complexity of a single network policy rule.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    id String
    The provider-assigned unique ID for this managed resource.
    kind String
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    ruleTupleCount Number
    Calculation of the complexity of a single network policy rule.

    Look up Existing RegionNetworkPolicyTrafficClassificationRule Resource

    Get an existing RegionNetworkPolicyTrafficClassificationRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RegionNetworkPolicyTrafficClassificationRuleState, opts?: CustomResourceOptions): RegionNetworkPolicyTrafficClassificationRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[RegionNetworkPolicyTrafficClassificationRuleActionArgs] = None,
        creation_timestamp: Optional[str] = None,
        deletion_policy: Optional[str] = None,
        description: Optional[str] = None,
        disabled: Optional[bool] = None,
        kind: Optional[str] = None,
        match: Optional[RegionNetworkPolicyTrafficClassificationRuleMatchArgs] = None,
        network_policy: Optional[str] = None,
        priority: Optional[int] = None,
        project: Optional[str] = None,
        region: Optional[str] = None,
        rule_name: Optional[str] = None,
        rule_tuple_count: Optional[int] = None,
        target_secure_tags: Optional[Sequence[RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs]] = None,
        target_service_accounts: Optional[Sequence[str]] = None) -> RegionNetworkPolicyTrafficClassificationRule
    func GetRegionNetworkPolicyTrafficClassificationRule(ctx *Context, name string, id IDInput, state *RegionNetworkPolicyTrafficClassificationRuleState, opts ...ResourceOption) (*RegionNetworkPolicyTrafficClassificationRule, error)
    public static RegionNetworkPolicyTrafficClassificationRule Get(string name, Input<string> id, RegionNetworkPolicyTrafficClassificationRuleState? state, CustomResourceOptions? opts = null)
    public static RegionNetworkPolicyTrafficClassificationRule get(String name, Output<String> id, RegionNetworkPolicyTrafficClassificationRuleState state, CustomResourceOptions options)
    resources:  _:    type: gcp:compute:RegionNetworkPolicyTrafficClassificationRule    get:      id: ${id}
    import {
  to = gcp_compute_region_network_policy_traffic_classification_rule.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Action RegionNetworkPolicyTrafficClassificationRuleAction
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    Description string
    An optional description for this resource.
    Disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    Kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    Match RegionNetworkPolicyTrafficClassificationRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    NetworkPolicy string
    The firewall policy of the resource.
    Priority int
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    Region string
    The location of this resource.
    RuleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    RuleTupleCount int
    Calculation of the complexity of a single network policy rule.
    TargetSecureTags List<RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag>
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts List<string>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    Action RegionNetworkPolicyTrafficClassificationRuleActionArgs
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    DeletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    Description string
    An optional description for this resource.
    Disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    Kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    Match RegionNetworkPolicyTrafficClassificationRuleMatchArgs
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    NetworkPolicy string
    The firewall policy of the resource.
    Priority int
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    Region string
    The location of this resource.
    RuleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    RuleTupleCount int
    Calculation of the complexity of a single network policy rule.
    TargetSecureTags []RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts []string
    A list of service accounts indicating the sets of instances that are applied with this rule.
    action object
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    creation_timestamp string
    Creation timestamp in RFC3339 text format.
    deletion_policy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description string
    An optional description for this resource.
    disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    match object
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    network_policy string
    The firewall policy of the resource.
    priority number
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region string
    The location of this resource.
    rule_name string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    rule_tuple_count number
    Calculation of the complexity of a single network policy rule.
    target_secure_tags list(object)
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    target_service_accounts list(string)
    A list of service accounts indicating the sets of instances that are applied with this rule.
    action RegionNetworkPolicyTrafficClassificationRuleAction
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description String
    An optional description for this resource.
    disabled Boolean
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    kind String
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    match RegionNetworkPolicyTrafficClassificationRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    networkPolicy String
    The firewall policy of the resource.
    priority Integer
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region String
    The location of this resource.
    ruleName String
    An optional name for the rule. This field is not a unique identifier and can be updated.
    ruleTupleCount Integer
    Calculation of the complexity of a single network policy rule.
    targetSecureTags List<RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag>
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    action RegionNetworkPolicyTrafficClassificationRuleAction
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    creationTimestamp string
    Creation timestamp in RFC3339 text format.
    deletionPolicy string
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description string
    An optional description for this resource.
    disabled boolean
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    kind string
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    match RegionNetworkPolicyTrafficClassificationRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    networkPolicy string
    The firewall policy of the resource.
    priority number
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region string
    The location of this resource.
    ruleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    ruleTupleCount number
    Calculation of the complexity of a single network policy rule.
    targetSecureTags RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag[]
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts string[]
    A list of service accounts indicating the sets of instances that are applied with this rule.
    action RegionNetworkPolicyTrafficClassificationRuleActionArgs
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    creation_timestamp str
    Creation timestamp in RFC3339 text format.
    deletion_policy str
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description str
    An optional description for this resource.
    disabled bool
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    kind str
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    match RegionNetworkPolicyTrafficClassificationRuleMatchArgs
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    network_policy str
    The firewall policy of the resource.
    priority int
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region str
    The location of this resource.
    rule_name str
    An optional name for the rule. This field is not a unique identifier and can be updated.
    rule_tuple_count int
    Calculation of the complexity of a single network policy rule.
    target_secure_tags Sequence[RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs]
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    target_service_accounts Sequence[str]
    A list of service accounts indicating the sets of instances that are applied with this rule.
    action Property Map
    The Action to perform when the client connection triggers the rule. Structure is documented below.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    deletionPolicy String
    Whether Terraform will be prevented from destroying the resource. Defaults to DELETE. When a 'terraform destroy' or 'pulumi up' would delete the resource, the command will fail if this field is set to "PREVENT" in Terraform state. When set to "ABANDON", the command will remove the resource from Terraform management without updating or deleting the resource in the API. When set to "DELETE", deleting the resource is allowed.
    description String
    An optional description for this resource.
    disabled Boolean
    Denotes whether the network policy rule is disabled. When set to true, the network policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the network policy rule will be enabled.
    kind String
    Type of the resource. Alwayscompute#networkPolicyTrafficClassificationRule for network policy traffic classification rules
    match Property Map
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    networkPolicy String
    The firewall policy of the resource.
    priority Number
    An integer indicating the priority of a rule in the list. The priority must be a positive value between 1 and 2147482647. The priority values from 2147482648 to 2147483647 (1000) are reserved for system default network policy rules. Rules are evaluated from highest to lowest priority where 1 is the highest priority and 2147483647 is the lowest priority.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    region String
    The location of this resource.
    ruleName String
    An optional name for the rule. This field is not a unique identifier and can be updated.
    ruleTupleCount Number
    Calculation of the complexity of a single network policy rule.
    targetSecureTags List<Property Map>
    A list of secure tags that controls which instances the traffic classification rule applies to. If targetSecureTag are specified, then the traffic classification rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the targetSecureTag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    A list of service accounts indicating the sets of instances that are applied with this rule.

    Supporting Types

    RegionNetworkPolicyTrafficClassificationRuleAction, RegionNetworkPolicyTrafficClassificationRuleActionArgs

    DscpMode string
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    DscpValue int
    Custom DSCP value from 0-63 range.
    TrafficClass string
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    Type string
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.
    DscpMode string
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    DscpValue int
    Custom DSCP value from 0-63 range.
    TrafficClass string
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    Type string
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.
    dscp_mode string
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    dscp_value number
    Custom DSCP value from 0-63 range.
    traffic_class string
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    type string
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.
    dscpMode String
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    dscpValue Integer
    Custom DSCP value from 0-63 range.
    trafficClass String
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    type String
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.
    dscpMode string
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    dscpValue number
    Custom DSCP value from 0-63 range.
    trafficClass string
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    type string
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.
    dscp_mode str
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    dscp_value int
    Custom DSCP value from 0-63 range.
    traffic_class str
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    type str
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.
    dscpMode String
    DSCP mode. When set to AUTO, the DSCP value will be picked automatically based on selected trafficClass. Otherwise,dscpValue needs to be explicitly specified. Possible values are: AUTO, CUSTOM.
    dscpValue Number
    Custom DSCP value from 0-63 range.
    trafficClass String
    The traffic class that should be applied to the matching packet. Possible values are: TC1, TC2, TC3, TC4, TC5, TC6.
    type String
    Always applyTrafficClassification for Traffic Classification Rules. Default value is applyTrafficClassification. Possible values are: applyTrafficClassification.

    RegionNetworkPolicyTrafficClassificationRuleMatch, RegionNetworkPolicyTrafficClassificationRuleMatchArgs

    Layer4Configs List<RegionNetworkPolicyTrafficClassificationRuleMatchLayer4Config>

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    DestIpRanges List<string>
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    SrcIpRanges List<string>
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
    Layer4Configs []RegionNetworkPolicyTrafficClassificationRuleMatchLayer4Config

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    DestIpRanges []string
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    SrcIpRanges []string
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
    layer4_configs list(object)

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    dest_ip_ranges list(string)
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    src_ip_ranges list(string)
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
    layer4Configs List<RegionNetworkPolicyTrafficClassificationRuleMatchLayer4Config>

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    destIpRanges List<String>
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    srcIpRanges List<String>
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
    layer4Configs RegionNetworkPolicyTrafficClassificationRuleMatchLayer4Config[]

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    destIpRanges string[]
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    srcIpRanges string[]
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
    layer4_configs Sequence[RegionNetworkPolicyTrafficClassificationRuleMatchLayer4Config]

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    dest_ip_ranges Sequence[str]
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    src_ip_ranges Sequence[str]
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
    layer4Configs List<Property Map>

    Pairs of IP protocols and ports that the rule should match. Structure is documented below.

    The layer4Configs block supports:

    destIpRanges List<String>
    CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
    srcIpRanges List<String>
    CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.

    RegionNetworkPolicyTrafficClassificationRuleMatchLayer4Config, RegionNetworkPolicyTrafficClassificationRuleMatchLayer4ConfigArgs

    IpProtocol string
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    Ports List<string>
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    IpProtocol string
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    Ports []string
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ip_protocol string
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports list(string)
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol String
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports List<String>
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol string
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports string[]
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ip_protocol str
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports Sequence[str]
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol String
    The IP protocol to which this rule applies. The protocol type is required when creating a traffic classification rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports List<String>
    An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

    RegionNetworkPolicyTrafficClassificationRuleTargetSecureTag, RegionNetworkPolicyTrafficClassificationRuleTargetSecureTagArgs

    Name string
    Name of the secure tag, created with TagManager's TagValue API.
    State string
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    Name string
    Name of the secure tag, created with TagManager's TagValue API.
    State string
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name string
    Name of the secure tag, created with TagManager's TagValue API.
    state string
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name String
    Name of the secure tag, created with TagManager's TagValue API.
    state String
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name string
    Name of the secure tag, created with TagManager's TagValue API.
    state string
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name str
    Name of the secure tag, created with TagManager's TagValue API.
    state str
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name String
    Name of the secure tag, created with TagManager's TagValue API.
    state String
    (Output) State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    Import

    RegionNetworkPolicyTrafficClassificationRule can be imported using any of these accepted formats:

    • projects/{{project}}/regions/{{region}}/networkPolicies/{{network_policy}}/{{priority}}
    • {{project}}/{{region}}/{{network_policy}}/{{priority}}
    • {{region}}/{{network_policy}}/{{priority}}
    • {{network_policy}}/{{priority}}

    When using the pulumi import command, RegionNetworkPolicyTrafficClassificationRule can be imported using one of the formats above. For example:

    $ pulumi import gcp:compute/regionNetworkPolicyTrafficClassificationRule:RegionNetworkPolicyTrafficClassificationRule default projects/{{project}}/regions/{{region}}/networkPolicies/{{network_policy}}/{{priority}}
$ pulumi import gcp:compute/regionNetworkPolicyTrafficClassificationRule:RegionNetworkPolicyTrafficClassificationRule default {{project}}/{{region}}/{{network_policy}}/{{priority}}
$ pulumi import gcp:compute/regionNetworkPolicyTrafficClassificationRule:RegionNetworkPolicyTrafficClassificationRule default {{region}}/{{network_policy}}/{{priority}}
$ pulumi import gcp:compute/regionNetworkPolicyTrafficClassificationRule:RegionNetworkPolicyTrafficClassificationRule default {{network_policy}}/{{priority}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Viewing docs for Google Cloud v9.35.1
    published on Monday, Aug 24, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-gcp

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial